cron.env.example

# Deployment-specific config for the issue→PR cron.
# Copy this file to `cron.env` (gitignored) and edit. campaign-run.sh sources it if present.
# Anything left unset falls back to the defaults baked into campaign-run.sh.

# GitHub handle to assign every opened PR to (REQUIRED — set this to your account or a bot):
PR_ASSIGNEE="your-github-handle"

# Org scope — the SINGLE source of truth for which GitHub orgs the pipeline covers.
# Space- (or comma-) separated. Both run scripts derive the prompt owner-flags from this and
# export it so `pr-review-report --queue` reads the same list. Edit ONLY this to change scope.
# Default (if unset): "rainlanguage cyclofinance"
# ORGS="rainlanguage cyclofinance S01-Issuer"

# Where issue clones are made (must be writable; created if missing). Default: $HOME/code
# WORK_DIR="$HOME/code"

# Producer cron (campaign-run.sh) model + per-run caps:
# MODEL="claude-sonnet-4-6"     # claude-opus-4-8 for max rigor
# FALLBACK_MODELS="claude-opus-4-8 claude-sonnet-5"   # ordered fallbacks: on a MODEL/REVIEW_MODEL usage/quota
#                                                     # limit (429) the run retries these in order, so one
#                                                     # exhausted model can't stall the pipeline.
# MAXTIME="3h"                  # hard cap per run
# KEEP_RUNS=20                  # retained per-run traces

# AI-vetting cron (review-run.sh) model + caps:
# REVIEW_MODEL="claude-sonnet-4-6"   # claude-opus-4-8 for max review rigor
# REVIEW_MAXTIME="2h"
# REVIEW_KEEP_RUNS=20
# Neither role's MCP surface is configurable. The vetter always runs against the FSM MCP
# server (mcp__fsm__{unvetted,pr_context,pr_checkout,record_verdict,clone_release} +
# Read/Grep/Glob/Skill/ToolSearch, no Bash), so a non-FSM operation is unrepresentable.
# The PRODUCER's surface (campaign-mcp.json) is additive — it keeps its Bash — and holds the
# clone lifecycle plus its two output edges, `push` and `open_pr`. It is the only way it can
# delete a work clone at all (`rm -rf <clone>` is denied by a prefix-matched rule, #56), and
# the only way a rework it pushes is recorded as work anyone can count.

# Weekly-budget PACE GATE (`pr-review-report usage-gate`) — pause a tick unless usage is holding
# comfortably BEHIND a steady burn of the Claude plan's weekly budget, so interactive/BAU work
# always has standing headroom and the deferrable consumer (the cron, which re-ticks every 4h) is
# the one that waits (#158). Usage IS machine-readable: the gate reads /api/oauth/usage with the
# OAuth credential and takes `seven_day.utilization` and `seven_day.resets_at` from it, so there
# is no human checkpoint to go stale. Everything below is OPTIONAL.
#
# Two checks, in order: CEILING (pause at/over USAGE_CEILING_PCT, whatever the pace), then PACE
# (pause while usage is inside the last USAGE_HEADROOM_PCT points UNDER a linear burn toward the
# reset — i.e. the crons run only while at least that many points remain under the pace line, and
# they idle at each week's start until the pace line clears the headroom).
# USAGE_CEILING_PCT="90"                 # hard ceiling regardless of pace (default 90)
# USAGE_HEADROOM_PCT="5"                 # points the crons stay behind linear pace (default 5; positive = behind)
#
# USAGE_SLACK_PCT is RETIRED (#158): the pace comparison inverted, so a value written for the old
# name cannot be honoured or ignored silently — the gate REFUSES to gate while it is set (exit 2;
# the runner logs the reason and aborts the tick). Delete it rather than carrying its value over.
#
# CRON_FORCE IS NOT A SETTING AND MUST NOT APPEAR IN THIS FILE (#245). Running one tick past a gate
# PAUSE, to watch it, is an ARGUMENT to a single invocation:
#
#   CRON_DIR=<install-dir> nix run git+file://<install-dir>#campaign-run -- --force
#   CRON_DIR=<install-dir> nix run git+file://<install-dir>#review-run   -- --force
#
# A variable here would force EVERY scheduled tick, silently and for ever, which is the one thing a
# force must not be able to become. So both runners REFUSE to run while CRON_FORCE is set — exit 2,
# one line in the log — the same posture the gate takes toward USAGE_SLACK_PCT above.
#
# FALLBACK ONLY — used when the endpoint is unreachable, e.g. the token expired or the API moved.
# Not the normal path. With neither the endpoint nor a fallback the gate FAILS CLOSED and the
# crons PAUSE (#273): the gate never paces blind, and the pause's reason names the read failure
# so a stalled stretch reads as an endpoint problem from the log. `--force` runs one tick past it.
# USAGE_USED_PCT="60"                    # % of the weekly budget used, per your last /usage reading
# USAGE_RESET_AT="2026-07-19T00:00:00Z"  # when the weekly budget resets to 0 (ISO-8601 UTC)