.env.example

# AgentWorks - environment template
# Copy to .env and fill in the blanks. NEVER commit .env. NEVER paste real secrets into docs/FACTS.md.
# Prefilled values are PUBLIC, verified facts (deployed testnet contracts, chain ids, public endpoints).
# Blank = a secret or per-user value you must supply. Full reference: docs/FACTS.md + docs/STATUS.md.

# ── CAW (Cobo Agentic Wallet) ──────────────────────────────────────────
AGENT_WALLET_API_URL=https://api.agenticwallet.cobo.com
# Onboarding-time only (CLI). Leave blank if the track didn't issue one.
CAW_INVITATION_CODE=
# Per-agent wallet ids + api keys - created by `caw onboard` (Phase 2). SECRET; leave blank, fill from your onboard.
CAW_CLIENT_WALLET_ID=
CAW_CLIENT_API_KEY=
CAW_PROVIDER_WALLET_ID=
CAW_PROVIDER_API_KEY=
# EVM addresses of the two CAW wallets (public; same address across all EVM chains).
CAW_CLIENT_ADDRESS=
CAW_PROVIDER_ADDRESS=
# CAW chain / token ids - Ethereum Sepolia (the project switched off Base Sepolia in Phase 2).
CAW_CHAIN_ID=SETH
CAW_NATIVE_TOKEN_ID=SETH
CAW_USDC_TOKEN_ID=SETH_USDC

# ── Chain / RPC (Ethereum Sepolia, chainId 11155111) ───────────────────
# 'sepolia' is Foundry's canonical name for Ethereum Sepolia (forge/cast read $CHAIN as --chain).
CHAIN=sepolia
RPC_URL=https://sepolia.drpc.org
# Optional private/MEV-protected RPC (e.g. a Flashbots Protect endpoint). When set it is preferred
# for on-chain reads and is the endpoint a private-broadcast path would use once the CAW relay
# exposes private order flow. Leave blank to use RPC_URL. Defense-in-depth for the reveal - see docs/MEV.md.
PRIVATE_RPC_URL=
# Opt-in: route state-changing accept txs (the reveal) through the private-mempool hook in the CAW
# chokepoint. A documented no-op until the Cobo SDK exposes a private-order-flow field.
MEV_PROTECT=false
# Fresh THROWAWAY testnet key, funded with Sepolia ETH for gas. NEVER a real-funds key. SECRET.
DEPLOYER_PRIVATE_KEY=
# Etherscan API key (etherscan.io) for `forge verify` (V2 multichain). SECRET.
EXPLORER_API_KEY=

# ── Contracts (deployed on Ethereum Sepolia - public) ──────────────────
# v1 Escrow (closed 1:1) bound to MockUSDC; submitWork carries the Irys id. (Pre-Phase-5 escrow was 0xe8eB3a02…)
ESCROW_CONTRACT_ADDRESS=0x812BcEEc2De8C8aC71C7af7A8E2d4467E65Fdf18
# v2 Escrow (Phase 6.5, OPEN marketplace): raw acceptJob(jobId) race - superseded by v3, kept for history.
ESCROW_V2_CONTRACT_ADDRESS=0xD6cB413c0E4a5839Fd4B02aFFeBF65e6868726b9
# v3 Escrow (MEV-hardened): sealed commit-reveal accept. Superseded by v4; kept for history.
ESCROW_V3_CONTRACT_ADDRESS=0xFAab4d6ff5CBEcD72a4e1B9315662e7846166D69
# Reveal timing - MUST match the deployed v3/v4 constructor args (Sepolia: delay=1, window=256).
REVEAL_DELAY_BLOCKS=1
REVEAL_WINDOW_BLOCKS=256
# v4 Escrow (committee consensus + staked disputes): createJob names an M-of-N evaluator committee that
# votes; a contested outcome escalates (staked) to a DECOUPLED, DECENTRALIZED arbiter (UMA OOv3) - never
# an operator key. The LIVE marketplace. See docs/ARBITRATION.md.
ESCROW_V4_CONTRACT_ADDRESS=0x17f58B3DcCad608867F19A88499f0F11C5F9b5bA
# v4 settlement timing - MUST match the deployed v4 ctor args (live Sepolia values).
VOTING_WINDOW_BLOCKS=600
DISPUTE_WINDOW_BLOCKS=50
DISPUTE_RESOLVE_WINDOW_BLOCKS=50
COMMITTEE_SIZE=3
COMMITTEE_QUORUM=2
# The decoupled arbiter adapter (IS the escrow's arbiter; rules via UMA OOv3, no operator key).
UMA_ARBITER_ADDRESS=0x850121Aa89C1C6d759F2751E01e8888e412a7a42
# UMA Optimistic Oracle V3 on Sepolia + its whitelisted bond currency (a 6-dp test USDC, NOT MockUSDC).
UMA_OOV3_ADDRESS=0xFd9e2642a170aDD10F53Ee14a93FcF2F31924944
UMA_BOND_CURRENCY=0x3870419Ba2BBf0127060bCB37f69A1b1C090992B  # 6TEST: UMA-whitelisted, zero-min, public mint
UMA_BOND=5000000
# Evaluator COMMITTEE — independent on BOTH axes: each member is its OWN CAW wallet (own TSS node + Pact +
# signing key) AND its OWN LLM (distinct provider/model), so a quorum is a genuine M-of-N of independent
# judges, not one wallet/model voting N times. Set CAW_EVALUATOR_{n}_WALLET_ID/_API_KEY/_ADDRESS per member;
# optionally give each its own model via _LLM_API_KEY/_LLM_BASE_URL/_LLM_MODEL (blank -> default LLM_*).
CAW_EVALUATOR_1_WALLET_ID=
CAW_EVALUATOR_1_API_KEY=
CAW_EVALUATOR_1_ADDRESS=
# member 1 LLM left blank -> uses the default LLM_* (e.g. DeepSeek)
CAW_EVALUATOR_2_WALLET_ID=
CAW_EVALUATOR_2_API_KEY=
CAW_EVALUATOR_2_ADDRESS=
CAW_EVALUATOR_2_LLM_API_KEY=          # e.g. Groq (https://console.groq.com/keys)
CAW_EVALUATOR_2_LLM_BASE_URL=https://api.groq.com/openai/v1
CAW_EVALUATOR_2_LLM_MODEL=llama-3.3-70b-versatile
CAW_EVALUATOR_3_WALLET_ID=
CAW_EVALUATOR_3_API_KEY=
CAW_EVALUATOR_3_ADDRESS=
CAW_EVALUATOR_3_LLM_API_KEY=          # e.g. Gemini (https://aistudio.google.com/apikey)
CAW_EVALUATOR_3_LLM_BASE_URL=https://generativelanguage.googleapis.com/v1beta/openai/
CAW_EVALUATOR_3_LLM_MODEL=gemini-2.5-flash
# Legacy single-wallet committee (one wallet, N addresses, shared LLM) is still supported as a fallback:
# CAW_EVALUATOR_WALLET_ID= / CAW_EVALUATOR_API_KEY= / CAW_EVALUATOR_ADDRESS_1..N=
# MockUSDC: our own 6-decimal, mintable USDC for a deterministic demo.
USDC_TOKEN_ADDRESS=0x4C4D1223BcC47E380CF4C37652EaDFe10A9Fd910

# ── Irys (deliverable storage - Phase 5, devnet) ───────────────────────
# EVM key that signs/funds the Irys devnet node. Optional: falls back to DEPLOYER_PRIVATE_KEY. SECRET.
IRYS_PRIVATE_KEY=
# Not needed for devnet (the SDK's .devnet() sets the node).
IRYS_NODE_URL=

# ── LLM (agent reasoning / evaluator) - DeepSeek (OpenAI-compatible) ───
# Drives the genuine fund / accept / reject decisions. SECRET.
LLM_API_KEY=
LLM_MODEL=deepseek-v4-flash
LLM_BASE_URL=https://api.deepseek.com

# ── Agent service (FastAPI control surface, agents/server.py - Railway) ─
# Where the off-chain marketplace state (board.json, run artifacts, external registry.local.json) is kept.
# On ephemeral hosts (Railway), point this at a MOUNTED VOLUME so registrations/listings survive restarts.
# Leave blank for local dev (defaults to the in-repo agents/scripts/.market + agents/registry.local.json).
AGENT_DATA_DIR=
# Optional bearer tokens. If set, the endpoint requires `Authorization: Bearer <token>`. SECRET.
# REAL-MONEY SPEND GATE — the platform's STANDING agents (provider + committee) spend the platform wallet's
# gas. When AGENT_ARM_TOKEN is set, the service boots DISARMED and the standing agents/watcher launch only
# after an explicit `POST /arm` with this bearer (POST /disarm stops them). Leave blank for testnet/dev to
# auto-start at boot per PLATFORM_AGENTS/SETTLEMENT_WATCHER. **Set this on any real-money (mainnet) host.**
AGENT_ARM_TOKEN=
# Standing-agent + watcher toggles. On a real-money host prefer PLATFORM_AGENTS=0 as the default posture and
# arm deliberately; blank/1 = enabled (subject to the arm gate above).
PLATFORM_AGENTS=1
SETTLEMENT_WATCHER=1
# VERDICT_TOKEN guards POST /committee/verdict (the framework-neutral M-of-N committee verdict service /
# evaluation-as-a-service; see docs/INTEGRATIONS.md). Legacy ACP_VERDICT_TOKEN is still honored as a fallback.
VERDICT_TOKEN=
# AGENT_REGISTER_TOKEN guards POST /marketplace/register* (set to curate onboarding; blank = open self-service).
AGENT_REGISTER_TOKEN=
# Per-job USDC reward CEILING enforced at the marketplace layer (server.marketplace_post_calldata /
# mcp_server.post_job). CAW bounds the escrow path by allowlist + tx-count but NOT by USDC value, so this
# app-layer cap + conservative platform-wallet funding ARE the value ceiling. Start conservative on mainnet.
MAX_JOB_REWARD_USDC=100
# CORS allowlist for the dashboard origin(s). '*' (default) is fine for the demo; on a real-money host LOCK
# this to the dashboard origin (e.g. https://your-dashboard.vercel.app).
AGENT_CORS_ORIGINS=*

# ── MCP server (agents/mcp_server.py - the open agent socket) ───────────
# Run by an EXTERNAL operator to plug their own agent into the marketplace as a client or provider.
# These are the operator's OWN CAW wallet (their key authority) - they stay on the operator's machine and
# are NEVER sent to the AgentWorks platform; the MCP server signs locally and self-creates its Pact.
MCP_WALLET_ID=
MCP_API_KEY=
MCP_ADDRESS=
MCP_ROLE=provider          # 'client' or 'provider'
# Marketplace board base URL the MCP server reads for discovery + listing (defaults to the live Railway service).
AGENT_API=https://insightful-wisdom-production-5c62.up.railway.app

# ── Web dashboard (/web) - PUBLIC, exposed to the browser ──────────────
# Public testnet values surfaced by the Next.js demo surface. No secrets here.
NEXT_PUBLIC_RPC_URL=https://sepolia.drpc.org
NEXT_PUBLIC_ESCROW_ADDRESS=0x812BcEEc2De8C8aC71C7af7A8E2d4467E65Fdf18
# v2 open-marketplace escrow (Phase 6.5, legacy) - raw acceptJob race.
NEXT_PUBLIC_ESCROW_V2_ADDRESS=0xD6cB413c0E4a5839Fd4B02aFFeBF65e6868726b9
# v3 open-marketplace escrow (MEV-hardened, commit-reveal) - the LIVE Marketplace board reads this.
NEXT_PUBLIC_ESCROW_V3_ADDRESS=0xFAab4d6ff5CBEcD72a4e1B9315662e7846166D69
# Deployed autonomous agent service base URL (Railway). Empty = on-chain reads only, no live trigger.
NEXT_PUBLIC_AGENT_API=https://insightful-wisdom-production-5c62.up.railway.app
NEXT_PUBLIC_USDC_ADDRESS=0x4C4D1223BcC47E380CF4C37652EaDFe10A9Fd910
NEXT_PUBLIC_CLIENT_CAW=0x6dfbd0ac9feb5bb9a9ffeaf54df203c1633c1ddd
NEXT_PUBLIC_PROVIDER_CAW=0xef9349b3273b1a54faaf701231f499fe0282e643
# 2nd provider address (same Provider wallet, distinct msg.sender) - the live accept-race competitor.
NEXT_PUBLIC_PROVIDER_CAW_B=0x7ea0701d657e3427c2bb3bc195e943a81c5fc69e
NEXT_PUBLIC_EXPLORER_BASE=https://sepolia.etherscan.io
NEXT_PUBLIC_IRYS_GATEWAY=https://devnet.irys.xyz
# Set to 0 to hide the "Run live" button (artifacts-only deterministic mode).
NEXT_PUBLIC_ENABLE_LIVE_RUN=1

# ── Coinbase CDP (legacy - Base Sepolia faucet; UNUSED after the Eth Sepolia switch) ──
# Kept for reference only; the project no longer depends on CDP. Leave blank.
CDP_API_KEY_ID=
CDP_API_KEY_SECRET=
CDP_WALLET_SECRET=