.env.example

# OpenRouter Council Backend  (slice OD-3 — see docs/prd/openrouter-council-backend.prd.md)
# Never commit real secrets. Copy to .env (gitignored) and fill in locally.

# Backend selector. `mock` keeps /concilium on its default Claude-only path and is
# what tests use. Set to `openrouter` to opt into the OpenRouter diversity backend.
COUNCIL_BACKEND=mock

# Fail-closed diversity policy. When true, <COUNCIL_MIN_BACKENDS distinct NORMALIZED
# base models => abort COUNCIL_DIVERSITY_UNAVAILABLE; NEVER a silent Claude-only fallback.
COUNCIL_FAIL_CLOSED=true
COUNCIL_MIN_BACKENDS=2
COUNCIL_TIMEOUT_SECONDS=45

OPENROUTER_API_KEY=
OPENROUTER_HTTP_REFERER=
OPENROUTER_APP_TITLE=Plumbline

# One slot per council body (market-realist, tech-arbiter, skeptic, distribution-realist).
# Diversity is counted on the NORMALIZED base model id: variant/price/provider suffixes
# (:nitro, :floor, :exacto, :<variant>) are stripped before comparison, so two variants
# of the same base model count as ONE. This is a necessary-not-sufficient guard against
# Schein-Diversität (see RISK-B-007) — it does NOT prove real model diversity.
COUNCIL_1_MODEL=
COUNCIL_2_MODEL=
COUNCIL_3_MODEL=
COUNCIL_4_MODEL=

# Optional lowercase aliases for convenience. Canonical names are uppercase (they win).
council_1=
council_2=
council_3=
council_4=

# ── OpenRouter Inference Path (slice openrouter-inference — docs/prd/openrouter-inference.prd.md) ──
#
# !!! BUDGET WARNING — READ THIS !!!
# COUNCIL_MAX_TOKENS_PER_RUN is a TOKEN cap, **NOT a USD / cost cap**. It hard-bounds the
# OUTPUT via a sent `max_tokens` and bounds the INPUT only by an offline heuristic (≈, not
# exact — OpenRouter bills on the provider's native tokenizer). A run staying under this
# token cap can STILL cost real money on an expensive model. There is NO USD guard in this
# slice. Choose a cheap/free model if cost matters; this cap will NOT save you from an
# expensive one.
COUNCIL_MAX_TOKENS_PER_RUN=20000

# Model for the inference path. Free model is the DEFAULT; configurable to ANY OpenRouter
# model id. Availability is verified at runtime (never hardcoded as stable truth) — a free
# model can return 402 (no balance) / 429 (rate cap) for reasons unrelated to your config.
COUNCIL_INFERENCE_MODEL=

# REAL-CALL GATE (off by default). The `infer --live` flag only performs a real, billable
# POST when this env is EXACTLY `1`. Leave UNSET/blank for offline use. The test suite never
# sets this, so tests never spend credits. Set to 1 ONLY for the deliberate opt-in smoke.
COUNCIL_INFERENCE_LIVE=

# --- DeepSeek-Review council runner (Slice 2) -------------------------------------------
# The body/character/preset runner (config/claude/lib/deepseek_review.py) REUSES the budget
# cap (COUNCIL_MAX_TOKENS_PER_RUN), the model override (COUNCIL_INFERENCE_MODEL), the key
# (OPENROUTER_API_KEY), and the double live gate (--live + COUNCIL_INFERENCE_LIVE=1) above.
# It introduces NO new key surface. The model for a body/character/preset role with no
# explicit override is resolved at runtime by the editable, preference-ordered free-family
# resolver in council_presets.py over the LIVE OpenRouter catalog (fail-closed on an
# unreachable catalog — never a stale pick).
#
# DEEPSEEK_CHARACTERS_DIR overrides the characters ROOT (default: concilium/characters).
# This exists ONLY so the offline test suite can point the runner at synthetic fixture
# characters without touching the read-only committed library; leave UNSET in normal use.
DEEPSEEK_CHARACTERS_DIR=