Codex/public workshop content

10-26 Cloud Native AI Summit APAC/demo/.env.example

@@ -1,21 +1,44 @@
-# copy to .env and fill in; source with export semantics before running anything:
-#   set -a; source .env; set +a
-# stackql-deploy reads it with --env-file .env; the agent loads it itself.
+# copy to .env and fill in. The scripts source it; stackql-deploy reads it with
+# --env-file .env; the agent loads it itself. Never commit .env.
 
-# Fixture and offline mode need no environment variables.
-# Live model mode is opt-in: npm run agent requires --live-model and OPENAI_API_KEY.
-OPENAI_API_KEY=
-# Verified in current official OpenAI model/function-calling documentation.
-# Do not replace with a different model family or silently fall back.
-# Verified IDs: gpt-6-astra, gpt-6.1-sol, gpt-6-luna. Availability is account-specific.
-OPENAI_MODEL=gpt-6-astra
-# read_only prevents execution. safe requires interactive exact-plan confirmation.
-DEMO_POLICY_MODE=read_only
+# --- the model --------------------------------------------------------------
+ANTHROPIC_API_KEY=sk-ant-...
+# claude-sonnet-5-5 keeps a live run short; claude-opus-5-5 for a more careful report.
+ANTHROPIC_MODEL=claude-sonnet-5-5
+# low | medium | high | xhigh | max. Thinking is always on for the Claude 5 family;
+# effort is the latency and cost control.
+ANTHROPIC_EFFORT=medium
 
-# Retained StackQL/kind stack example; scripts require explicit disposable-cluster
-# confirmation and are not used by the fixture agent.
+# --- the platform: StackQL MCP server ----------------------------------------
+# read_only: writes refused by the server. safe: writes pause for operator approval.
+# The agent code never starts a full_access server.
+STACKQL_MCP_MODE=read_only
+# where providers are pulled to; k8s and github must be there (REGISTRY PULL k8s;
+# REGISTRY PULL github). Default is ~/.stackql.
+STACKQL_APPROOT=
+# an existing stackql binary for the npm launcher to use instead of downloading one
+# (for example "C:/Program Files/StackQL/stackql.exe", quoted because of the space)
+STACKQL_MCP_BIN=
+# the server writes its audit sink (stackql_mcp_server_<timestamp>.jsonl, one JSON record
+# per tool call, next to the run's transcript) into this directory. Default is runs/ under
+# the demo directory. `npm run audit` renders the newest one.
+STACKQL_AUDIT_DIR=
+# cap on model steps per run (each tool call round trip is a step)
+AGENT_MAX_STEPS=24
+# production posture: never offer the write tools to the model (default false, so the
+# server's refusal is what you see on screen)
+AGENT_HIDE_WRITE_TOOLS=false
+# newest MCP revision the server advertises; auto is fine (see agent.ts for why discovery is off)
+STACKQL_MCP_PROTOCOL_VERSION=auto
+
+# --- the estate: kind cluster via kubectl proxy --------------------------------
 KIND_CLUSTER=platform-demo
+# optional node image for kind create cluster. Docker Desktop on cgroup v1 cannot
+# bootstrap kind's newest default image; kindest/node:v1.33.1 works there.
+KIND_NODE_IMAGE=
 KUBE_CLUSTER_ADDR=localhost:8001
 KUBE_PROTOCOL=http
 K8S_NAMESPACE=shop
-STACKQL_APPROOT=
+# the stackql-deploy entry point, if it is not on PATH
+# (Windows: C:/Users/<you>/AppData/Roaming/Python/Python312/Scripts/stackql-deploy.exe)
+STACKQL_DEPLOY=