Configuration Reference¶

Every Zeroth setting is loaded from (in priority order): environment variables (ZEROTH_ prefix, nested via __), a local .env file, then zeroth.yaml. Both file paths are resolved once at process start from the launch working directory; set ZEROTH_ENV_FILE and ZEROTH_SETTINGS_FILE to absolute paths to pin them explicitly (recommended for deployments that execute repository-backed workloads). This reference is auto-generated from zeroth.platform.config.settings via scripts/dump_config.py — do not edit by hand.

CI runs python scripts/dump_config.py --check on every PR and fails if this file is stale.

Database¶

Database backend configuration.

Env Var	Type	Default	Secret
`ZEROTH_DATABASE__BACKEND`	`Literal[sqlite, postgres]`	`"sqlite"`
`ZEROTH_DATABASE__SQLITE_PATH`	`str`	`"zeroth.db"`
`ZEROTH_DATABASE__POSTGRES_DSN`	`SecretStr \\| None`	`None`	✓
`ZEROTH_DATABASE__POSTGRES_POOL_MIN`	`int`	`2`
`ZEROTH_DATABASE__POSTGRES_POOL_MAX`	`int`	`10`
`ZEROTH_DATABASE__ENCRYPTION_KEY`	`SecretStr \\| None`	`None`	✓

Redis¶

Redis connection settings, absorbing the existing RedisConfig fields.

Env Var	Type	Default	Secret
`ZEROTH_REDIS__MODE`	`Literal[local, disabled]`	`"local"`
`ZEROTH_REDIS__HOST`	`str`	`"127.0.0.1"`
`ZEROTH_REDIS__PORT`	`int`	`6379`
`ZEROTH_REDIS__PASSWORD`	`SecretStr \\| None`	`None`	✓
`ZEROTH_REDIS__KEY_PREFIX`	`str`	`"zeroth"`
`ZEROTH_REDIS__DB`	`int`	`0`
`ZEROTH_REDIS__TLS`	`bool`	`False`

Auth¶

Service authentication settings.

Env Var	Type	Default	Secret	Description
`ZEROTH_SERVICE_API_KEYS_JSON`	`SecretStr \\| None`	`None`	✓	JSON list of credential objects: `[{"credential_id", "secret", "subject", "roles", "tenant_id"?, "workspace_id"?}]`
`ZEROTH_SERVICE_BEARER_JSON`	`SecretStr \\| None`	`None`	✓	JSON bearer/JWT verification config (issuer, audience, jwks)
`ZEROTH_SERVICE_REVOKED_CREDENTIAL_IDS_JSON`	`list[str] \\| None`	`None`		JSON array of unique credential identifiers rejected after successful authentication (static credential_id; bearer jti or SHA-256 fingerprint)
`ZEROTH_AUTH__BROWSER_SESSION_SECRET`	`SecretStr \\| None`	`None`	✓	Shared HMAC secret for short-lived browser sessions; required in production and must contain at least 32 UTF-8 bytes
`ZEROTH_AUTH__BROWSER_SESSION_TTL_SECONDS`	`int`	`900`
`ZEROTH_AUTH__ALLOW_EPHEMERAL_BROWSER_SESSION_SECRET_DEVELOPMENT`	`bool`	`False`

Regulus¶

Regulus backend connection settings.

Env Var	Type	Default	Secret
`ZEROTH_REGULUS__ENABLED`	`bool`	`True`
`ZEROTH_REGULUS__BASE_URL`	`str`	`"http://localhost:8000/v1"`
`ZEROTH_REGULUS__API_KEY`	`SecretStr \\| None`	`None`	✓
`ZEROTH_REGULUS__BUDGET_CACHE_TTL`	`int`	`30`
`ZEROTH_REGULUS__REQUEST_TIMEOUT`	`float`	`5.0`
`ZEROTH_REGULUS__FAIL_CLOSED`	`bool`	`True`
`ZEROTH_REGULUS__PER_RUN_CAP_USD`	`float \\| None`	`None`

Memory¶

Memory backend configuration.

Env Var	Type	Default
`ZEROTH_MEMORY__DEFAULT_CONNECTOR`	`str`	`"ephemeral"`
`ZEROTH_MEMORY__REDIS_KV_PREFIX`	`str`	`"zeroth:mem:kv"`
`ZEROTH_MEMORY__REDIS_THREAD_PREFIX`	`str`	`"zeroth:mem:thread"`

Pgvector¶

Pgvector-based vector memory configuration.

Env Var	Type	Default
`ZEROTH_PGVECTOR__ENABLED`	`bool`	`False`
`ZEROTH_PGVECTOR__TABLE_NAME`	`str`	`"zeroth_memory_vectors"`
`ZEROTH_PGVECTOR__EMBEDDING_MODEL`	`str`	`"text-embedding-3-small"`
`ZEROTH_PGVECTOR__EMBEDDING_DIMENSIONS`	`int`	`1536`

Chroma¶

ChromaDB vector memory configuration.

Env Var	Type	Default
`ZEROTH_CHROMA__ENABLED`	`bool`	`False`
`ZEROTH_CHROMA__HOST`	`str`	`"localhost"`
`ZEROTH_CHROMA__PORT`	`int`	`8000`
`ZEROTH_CHROMA__COLLECTION_PREFIX`	`str`	`"zeroth_memory"`

Elasticsearch¶

Elasticsearch memory backend configuration.

Env Var	Type	Default
`ZEROTH_ELASTICSEARCH__ENABLED`	`bool`	`False`
`ZEROTH_ELASTICSEARCH__HOSTS`	`list[str]`	`['http://localhost:9200']`
`ZEROTH_ELASTICSEARCH__INDEX_PREFIX`	`str`	`"zeroth_memory"`

Sandbox¶

Sandbox execution backend configuration.

Env Var	Type	Default
`ZEROTH_SANDBOX__BACKEND`	`Literal[local, docker, auto, sidecar]`	`"local"`
`ZEROTH_SANDBOX__SIDECAR_URL`	`str`	`"http://sandbox-sidecar:8001"`
`ZEROTH_SANDBOX__DOCKER_CONTAINER_NAME`	`str`	`"zeroth-sandbox"`
`ZEROTH_SANDBOX__DOCKER_BINARY`	`str`	`"docker"`
`ZEROTH_SANDBOX__ALLOW_UNTRUSTED_LOCAL_DEVELOPMENT`	`bool`	`False`
`ZEROTH_SANDBOX__ALLOW_UNISOLATED_MCP_DEVELOPMENT`	`bool`	`False`
`ZEROTH_SANDBOX__MCP_ISOLATION_IMAGE`	`str \\| None`	`None`
`ZEROTH_SANDBOX__MCP_ISOLATION_NETWORK`	`str`	`"none"`
`ZEROTH_SANDBOX__MCP_ISOLATION_ALLOWED_ENVIRONMENT_KEYS`	`tuple[str, Ellipsis]`	`()`
`ZEROTH_SANDBOX__MCP_ISOLATION_RUN_AS_USER`	`str`	`"65534:65534"`
`ZEROTH_SANDBOX__MCP_ISOLATION_CPUS`	`str`	`"1.0"`
`ZEROTH_SANDBOX__MCP_ISOLATION_MEMORY`	`str`	`"256m"`
`ZEROTH_SANDBOX__MCP_ISOLATION_PIDS_LIMIT`	`int`	`64`

Webhook¶

Webhook delivery system configuration.

Env Var	Type	Default
`ZEROTH_WEBHOOK__ENABLED`	`bool`	`True`
`ZEROTH_WEBHOOK__DELIVERY_POLL_INTERVAL`	`float`	`2.0`
`ZEROTH_WEBHOOK__DELIVERY_TIMEOUT`	`float`	`10.0`
`ZEROTH_WEBHOOK__MAX_DELIVERY_CONCURRENCY`	`int`	`16`
`ZEROTH_WEBHOOK__DEFAULT_MAX_RETRIES`	`int`	`5`
`ZEROTH_WEBHOOK__RETRY_BASE_DELAY`	`float`	`1.0`
`ZEROTH_WEBHOOK__RETRY_MAX_DELAY`	`float`	`300.0`

Approval Sla¶

Approval SLA timeout and escalation configuration.

Env Var	Type	Default	Secret	Description
`ZEROTH_APPROVAL_SLA__ENABLED`	`bool`	`True`
`ZEROTH_APPROVAL_SLA__CHECKER_POLL_INTERVAL`	`float`	`10.0`

Approval Notifications¶

Env Var	Type	Default
`ZEROTH_APPROVAL_NOTIFICATIONS__ENABLED`	`bool`	`False`
`ZEROTH_APPROVAL_NOTIFICATIONS__SLACK`	`SlackNotificationSettings`	`SlackNotificationSettings(webhook_url=None, timeout=10.0)`
`ZEROTH_APPROVAL_NOTIFICATIONS__EMAIL`	`EmailNotificationSettings`	`EmailNotificationSettings(smtp_host=None, smtp_port=587, from_address=None, to_addresses=[], username=None, password=None, use_tls=True, timeout=10.0)`

Dispatch¶

Dispatch and horizontal scaling configuration.

Env Var	Type	Default
`ZEROTH_DISPATCH__ARQ_ENABLED`	`bool`	`False`
`ZEROTH_DISPATCH__SHUTDOWN_TIMEOUT`	`float`	`30.0`
`ZEROTH_DISPATCH__POLL_INTERVAL`	`float`	`0.5`

Tls¶

TLS configuration for direct uvicorn SSL.

Env Var	Type	Default	Secret	Description
`ZEROTH_TLS__CERTFILE`	`str \\| None`	`None`
`ZEROTH_TLS__KEYFILE`	`str \\| None`	`None`

Artifact Store¶

Configuration for the artifact storage subsystem.

Env Var	Type	Default
`ZEROTH_ARTIFACT_STORE__BACKEND`	`Literal[filesystem, redis]`	`"filesystem"`
`ZEROTH_ARTIFACT_STORE__DEFAULT_TTL_SECONDS`	`int`	`3600`
`ZEROTH_ARTIFACT_STORE__FILESYSTEM_BASE_DIR`	`str`	`".zeroth/artifacts"`
`ZEROTH_ARTIFACT_STORE__REDIS_KEY_PREFIX`	`str`	`"zeroth:artifact"`
`ZEROTH_ARTIFACT_STORE__MAX_ARTIFACT_SIZE_BYTES`	`int`	`104857600`

Http Client¶

Global resilient-HTTP-client configuration.

Env Var	Type	Default
`ZEROTH_HTTP_CLIENT__MAX_RETRIES`	`int`	`3`
`ZEROTH_HTTP_CLIENT__RETRY_BACKOFF_BASE`	`float`	`0.5`
`ZEROTH_HTTP_CLIENT__RETRY_MAX_DELAY`	`float`	`60.0`
`ZEROTH_HTTP_CLIENT__RETRYABLE_STATUS_CODES`	`set[int]`	`{408, 429, 500, 502, 503, 504}`
`ZEROTH_HTTP_CLIENT__CIRCUIT_BREAKER_THRESHOLD`	`int`	`5`
`ZEROTH_HTTP_CLIENT__CIRCUIT_BREAKER_RESET_TIMEOUT`	`float`	`30.0`
`ZEROTH_HTTP_CLIENT__POOL_MAX_CONNECTIONS`	`int`	`100`
`ZEROTH_HTTP_CLIENT__POOL_MAX_KEEPALIVE`	`int`	`20`
`ZEROTH_HTTP_CLIENT__POOL_KEEPALIVE_EXPIRY`	`float`	`5.0`
`ZEROTH_HTTP_CLIENT__DEFAULT_TIMEOUT`	`float`	`30.0`
`ZEROTH_HTTP_CLIENT__DEFAULT_RATE_LIMIT_RATE`	`float`	`10.0`
`ZEROTH_HTTP_CLIENT__DEFAULT_RATE_LIMIT_BURST`	`int`	`20`

Tracing¶

OpenTelemetry tracing configuration (requires the otel extra).

Env Var	Type	Default
`ZEROTH_TRACING__ENABLED`	`bool`	`False`
`ZEROTH_TRACING__SERVICE_NAME`	`str`	`"zeroth-core"`
`ZEROTH_TRACING__OTLP_ENDPOINT`	`str \\| None`	`None`

Secrets¶

Secret-resolution backend configuration (WS-F).

Env Var	Type	Default	Secret
`ZEROTH_SECRETS__BACKEND`	`Literal[env, vault]`	`"env"`
`ZEROTH_SECRETS__ALLOW_ENV_FALLBACK`	`bool`	`True`
`ZEROTH_SECRETS__VAULT_ADDR`	`str \\| None`	`None`
`ZEROTH_SECRETS__VAULT_MOUNT`	`str`	`"secret"`
`ZEROTH_SECRETS__VAULT_ROLE_ID`	`SecretStr \\| None`	`None`	✓
`ZEROTH_SECRETS__VAULT_SECRET_ID`	`SecretStr \\| None`	`None`	✓
`ZEROTH_SECRETS__VAULT_TOKEN`	`SecretStr \\| None`	`None`	✓
`ZEROTH_SECRETS__VAULT_CACHE_TTL`	`float`	`300.0`
`ZEROTH_SECRETS__LLM_KEY_MAP`	`dict[str, str]`	`{}`
`ZEROTH_SECRETS__LLM_BASE_URL_MAP`	`dict[str, str]`	`{}`

Provenance¶

Keyed provenance-signing configuration (WS-D).

Env Var	Type	Default	Secret
`ZEROTH_PROVENANCE__MODE`	`Literal[env, kms, off]`	`"env"`
`ZEROTH_PROVENANCE__ALGORITHM`	`str`	`"HS256"`
`ZEROTH_PROVENANCE__SIGNING_KEY_REF`	`str \\| None`	`None`
`ZEROTH_PROVENANCE__SIGNING_KEY_ID`	`str`	`"dev-local"`
`ZEROTH_PROVENANCE__PUBLIC_KEYS_JSON`	`SecretStr \\| None`	`None`	✓
`ZEROTH_PROVENANCE__RETIRED_KEYS_JSON`	`SecretStr \\| None`	`None`	✓

Certification¶

Server-owned identity of the artifact served by this process.

Env Var	Type	Default	Secret	Description
`ZEROTH_CERTIFICATION__SERVING_APP_COMMIT`	`str \\| None`	`None`
`ZEROTH_CERTIFICATION__SERVING_IMAGE_DIGEST`	`str \\| None`	`None`

Policy¶

Behavioral capability-enforcement configuration (WS-C).

Env Var	Type	Default
`ZEROTH_POLICY__ENFORCE_CAPABILITIES`	`bool`	`True`
`ZEROTH_POLICY__LOCAL_NETWORK_STRICT`	`bool`	`True`
`ZEROTH_POLICY__DEFINITIONS`	`tuple[dict[str, Any], Ellipsis]`	`()`

Retention¶

WS-E retention / right-to-erasure configuration.

Env Var	Type	Default
`ZEROTH_RETENTION__ENABLED`	`bool`	`False`
`ZEROTH_RETENTION__WORKER_POLL_INTERVAL`	`float`	`3600.0`
`ZEROTH_RETENTION__DEFAULT_AUDIT_TTL_SECONDS`	`int \\| None`	`None`
`ZEROTH_RETENTION__DEFAULT_RUN_TTL_SECONDS`	`int \\| None`	`None`

Langgraph Gateway¶

Configuration for the optional Agent Server-compatible gateway.

Env Var	Type	Default	Description
`ZEROTH_LANGGRAPH_GATEWAY__ENABLED`	`bool`	`False`
`ZEROTH_LANGGRAPH_GATEWAY__UPSTREAM_URL`	`str \\| None`	`None`
`ZEROTH_LANGGRAPH_GATEWAY__UPSTREAM_AUDIENCE`	`str \\| None`	`None`
`ZEROTH_LANGGRAPH_GATEWAY__DEPLOYMENT_REF`	`str \\| None`	`None`
`ZEROTH_LANGGRAPH_GATEWAY__UPSTREAM_CREDENTIAL_REF`	`str \\| None`	`None`
`ZEROTH_LANGGRAPH_GATEWAY__UPSTREAM_CREDENTIAL_HEADER`	`str`	`"Authorization"`
`ZEROTH_LANGGRAPH_GATEWAY__UPSTREAM_CREDENTIAL_SCHEME`	`str`	`"Bearer"`
`ZEROTH_LANGGRAPH_GATEWAY__CONNECT_TIMEOUT_SECONDS`	`float`	`5.0`
`ZEROTH_LANGGRAPH_GATEWAY__READ_TIMEOUT_SECONDS`	`float`	`60.0`
`ZEROTH_LANGGRAPH_GATEWAY__WRITE_TIMEOUT_SECONDS`	`float`	`60.0`
`ZEROTH_LANGGRAPH_GATEWAY__POOL_TIMEOUT_SECONDS`	`float`	`5.0`
`ZEROTH_LANGGRAPH_GATEWAY__CONTEXT_TTL_SECONDS`	`int`	`300`
`ZEROTH_LANGGRAPH_GATEWAY__MAX_GOVERNED_BODY_BYTES`	`int`	`1048576`
`ZEROTH_LANGGRAPH_GATEWAY__UNKNOWN_ENDPOINT_MODE`	`Literal[deny, pass_ungoverned]`	`"deny"`
`ZEROTH_LANGGRAPH_GATEWAY__REQUIRE_FULL_TOOL_ENFORCEMENT`	`bool`	`False`
`ZEROTH_LANGGRAPH_GATEWAY__POLICY_BINDINGS`	`tuple[str, Ellipsis]`	`()`
`ZEROTH_LANGGRAPH_GATEWAY__EXPECTED_TOOL_INVENTORY_FINGERPRINT`	`str \\| None`	`None`	Server-owned canonical tool-inventory digest required for ENFORCED evidence; missing or mismatched values remain OBSERVED
`ZEROTH_LANGGRAPH_GATEWAY__SUPPORTED_LANGGRAPH_VERSIONS`	`tuple[str, Ellipsis]`	`('1.2.9',)`
`ZEROTH_LANGGRAPH_GATEWAY__SUPPORTED_AGENT_SERVER_VERSIONS`	`tuple[str, Ellipsis]`	`('0.11.1',)`
`ZEROTH_LANGGRAPH_GATEWAY__HEARTBEAT_INTERVAL_SECONDS`	`int`	`30`
`ZEROTH_LANGGRAPH_GATEWAY__STALE_THRESHOLD_SECONDS`	`int`	`90`

Github¶

GitHub App integration configuration (ZER-37).

Env Var	Type	Default
`ZEROTH_GITHUB__ENABLED`	`bool`	`False`
`ZEROTH_GITHUB__APP_ID`	`str`	`""`
`ZEROTH_GITHUB__API_BASE_URL`	`str`	`"https://api.github.com"`
`ZEROTH_GITHUB__GIT_BASE_URL`	`str`	`"https://github.com"`
`ZEROTH_GITHUB__PRIVATE_KEY_SECRET_NAME`	`str`	`"github.app_private_key"`
`ZEROTH_GITHUB__WEBHOOK_SECRET_NAME`	`str`	`"github.webhook_secret"`
`ZEROTH_GITHUB__CACHE_DIR`	`str`	`""`
`ZEROTH_GITHUB__MAX_FILE_BYTES`	`int`	`52428800`
`ZEROTH_GITHUB__MAX_TOTAL_BYTES`	`int`	`524288000`
`ZEROTH_GITHUB__MAX_FILE_COUNT`	`int`	`50000`
`ZEROTH_GITHUB__CHECKOUT_TTL_SECONDS`	`int`	`900`
`ZEROTH_GITHUB__STAGING_DIR`	`str`	`""`
`ZEROTH_GITHUB__REPO_RUN_POLL_SECONDS`	`float`	`1.0`