Environment Reference

Review, validation, queue and operator environment settings, with code defaults and runtime-specific limits.

Environment selects infrastructure, credentials and runner flags. Repository config and workspace review policy are also stored data, not environment-only configuration. Provider credentials are resolved from environment by the application; they are sent to the chosen provider for authentication.

Source prefixes below: R/ is son-of-anton-review (feat/cloudflare-native); P/ is son-of-anton-operator-parity (feat/greptile-operator-parity). These are separate, unmerged trees. A library default, a Node process default and a checked-in Cloudflare deployment value are not interchangeable.

Runtime boundaries first

Keep the real GILF_ names. There is no general ANTON_ replacement in these entrypoints.
Native Cloudflare only projects the keys listed in R/cloudflare-native/src/container-env.js:15-86. Setting an arbitrary Worker variable does not set it inside the review container.
Swarm, planner, Prime, inversion and artifact-evidence flags are not forwarded. They cannot be enabled on this Cloudflare deployment by changing environment alone. Neither are role-specific model flags, legacy shadow-model flags, provider base URLs, prefixed model-key aliases or the docs-only override.
R/cloudflare-native/wrangler.jsonc:132-161 explicitly selects live publication, OpenRouter, z-ai/glm-5.3-flash, paid-model opt-in, Cloudflare Sandbox primary and E2B shadow. Those are checked-in deployment settings, not proof of the current remote deployment.
Node worker.mjs does not call resolveModelConfig: use GILF_CODEX_PROVIDER and GILF_CODEX_MODEL for its actual runner. GILF_MODEL_PROVIDER can change dashboard status without changing that Node runner (R/worker.mjs:43-54; R/src/codex-review-runner.js:2320-2326).

GitHub and Node state

Variable	Default / requirement	Consumer and effect
`GITHUB_WEBHOOK_SECRET`	Required by Node server and native ingress	Node server exits with `Missing GITHUB_WEBHOOK_SECRET`; ingress verifies HMAC. `R/server.mjs:21-25`; `R/cloudflare-native/src/ingress.js:275-286`
`GITHUB_APP_ID`	Required to mint App tokens	Native broker or Node App client. `R/cloudflare-native/src/key-broker-core.js:41-55`; `R/server.mjs:52-62`
`GITHUB_APP_PRIVATE_KEY`	Node inline PEM, or native broker secret	Node prefers it to the path and expands escaped newlines. Native review containers do not receive it.
`GITHUB_APP_PRIVATE_KEY_PATH`	Node alternative to inline PEM	Read from disk by server and worker; not a native container setting.
`GILF_REPOS`	Empty list	Node server seeds repo configs at startup. Not a deny-by-default allowlist. See Repo scoping. `R/server.mjs:64-74`
`GILF_DB_PATH`	Unset: in-memory state	SQLite when set. Traces use the same database. `R/server.mjs:27-35`
`GILF_QUEUE_DB_PATH`	Falls back to `GILF_DB_PATH`	Shared local queue file for server and worker. Without either path or a remote queue, separate processes have separate in-memory queues.
`GILF_QUEUE_URL`, `GILF_QUEUE_TOKEN`	Both required for remote queue selection	Together override local queue selection. `R/server.mjs:36-50`; `R/src/worker-runner.js:29-39`
`PORT`	Node server `8787`; container `8080`	`R/server.mjs:108-112`; `R/cloudflare-native/container/entrypoint.mjs:391`

Node automatically constructs GitHubPublisher when App id and private key are supplied (R/server.mjs:52-62; R/worker.mjs:35-41). GILF_PUBLISH_MODE=shadow does not prevent Node publication. That setting belongs to the native runtime.

Models

OpenRouter is recommended. OpenAI direct, Anthropic direct and Codex CLI are alternatives. See Model providers for runnable, runtime-specific configuration.

Variable	Code default / precedence
`GILF_MODEL_PROVIDER`	Generic resolver: then `GILF_CODEX_PROVIDER`, then `codex`. Native entrypoint: then `GILF_CODEX_PROVIDER`, then `openrouter`. Node runner does not read the current name.
`GILF_MODEL`	Generic resolver uses it after the role override. Native entrypoint passes it to the runner. Node runner does not read it.
`GILF_MODEL_PRIMARY`, `GILF_MODEL_SHADOW`	Generic resolver only: role value, `GILF_MODEL`, legacy shadow model for shadow, `GILF_CODEX_MODEL`, provider default. Neither entrypoint wires this resolver into its runner.
`GILF_CODEX_PROVIDER`, `GILF_CODEX_MODEL`	Node runner defaults: `codex`, `gpt-5.5`. Native accepts them as fallbacks, but only the provider is in `FORWARDED_KEYS`. Always supply native `GILF_MODEL`.
`GILF_CODEX_SHADOW_PROVIDER`, `GILF_CODEX_SHADOW_MODEL`	Runner defaults: primary provider, no shadow model. No model means no shadow call. Not forwarded on native Cloudflare.
`OPENROUTER_API_KEY`, `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`	Provider-specific bare name, then respective `GILF_` alias in the provider abstraction. Native forwards bare names only.
`GILF_MODEL_PRICES`	Empty override map; JSON model-to-`input`/`output` USD per million tokens. Overrides built-in rates. Unknown model prices produce `null`, not free usage. Forwarded natively.
`GILF_OPENROUTER_REQUIRE_FREE`	On unless exactly `0`. Catalog lookup refuses nonzero or unknown prompt/completion prices. Native manifest explicitly sets `0`.
`GILF_OPENROUTER_MAX_TOKENS`	Unset. Despite the legacy name, the unified runner passes this cap to all HTTP providers (`R/src/codex-review-runner.js:2980-3024`). Not forwarded.
`GILF_OPENROUTER_BASE_URL`	`https://openrouter.ai/api/v1`
`GILF_OPENAI_BASE_URL`	`https://api.openai.com/v1`
`GILF_ANTHROPIC_BASE_URL`	`https://api.anthropic.com/v1`
`GILF_ANTHROPIC_VERSION`, `GILF_ANTHROPIC_MAX_TOKENS`	`2023-06-01`, `8192`
`GILF_OPENROUTER_REFERER`, `GILF_OPENROUTER_TITLE`	`https://agents.pelian.ai/gilf-pr-review/`, product name followed by `PR Review System`
`GILF_CODEX_BIN`, `GILF_CODEX_HOME`	`codex`, home directory plus `.codex`
`GILF_CODEX_TIMEOUT_MS`, `GILF_CODEX_REASONING_EFFORT`	`2700000` ms, unset
`GILF_CODEX_SHADOW_TIMEOUT_MS`, `GILF_CODEX_SHADOW_REASONING_EFFORT`	Minimum of primary timeout and `120000` ms, unset

The generic resolver's model defaults are gpt-4.1 for OpenAI, claude-sonnet-4-5 for Anthropic, gpt-5.5 for Codex and null for OpenRouter. These are not the actual runner's per-provider defaults: the runner falls back to gpt-5.5 regardless of provider. Explicitly select a model.

Sources: R/src/model-provider.js:15-93,169-289,327-385; R/src/codex-review-runner.js:2022-2057,2215-2221,2320-2337; R/cloudflare-native/container/entrypoint.mjs:314-348; R/cloudflare-native/src/container-env.js:15-86.

Swarm, planner, inversion and evidence

All rows here are runner-side settings. None are projected into native Cloudflare containers.

Variable	Default / effect
`GILF_HYPOTHESIS_PRIMARY`	Off; exactly `1` permits usable hypothesis coverage to become primary.
`GILF_PRIME_SHADOW`	Off; exactly `1` enables a Prime worker. Also enabled by `GILF_HYPOTHESIS_PRIMARY=1` unless explicitly `0`. No worker means no swarm, not an automatic shadow swarm.
`GILF_HYPOTHESIS_CONCURRENCY`	`4`
`GILF_DISABLE_HYPOTHESIS_WORKERS`	Changes the harness manifest's `enabled` descriptor unless `1`; not a runner kill switch.
`GILF_HYPOTHESIS_PLANNER`	Off; exactly `1` enables planning, but no worker, a semantic skip or Codex planner provider skips the call.
`GILF_PLANNER_PROVIDER`, `GILF_PLANNER_MODEL`	Runner primary provider/model
`GILF_PLANNER_MAX_HYPOTHESES`, `GILF_PLANNER_MAX_DIFF_BYTES`, `GILF_PLANNER_TIMEOUT_MS`	`8`, `60000`, `60000` ms. Static hypotheses remain a floor.
`GILF_PRIME_PROVIDER`, `GILF_PRIME_MODEL`, `GILF_PRIME_THINKING`	Runner: `codex`; explicit runner model then `GILF_CODEX_MODEL` then `gpt-5.5`; `low`.
`GILF_PRIME_AGENT_BIN`, `GILF_PRIME_TIMEOUT_MS`, `GILF_PRIME_NO_CONTEXT_FILES`	`prime-agent`, `600000` ms, on unless exactly `0`.
`GILF_MODEL_INVERSION`	Off; accepts `1`, `true`, `yes`, `on`.
`GILF_MODEL_INVERSION_MAP`	JSON overrides the built-in author-family map; malformed JSON records an error and retains defaults. Human/unknown have no target.
`GILF_MODEL_INVERSION_MIN_CONFIDENCE`	`0.5` when unset or invalid; accepted range 0 to 1.
`GILF_EVIDENCE_ARTIFACTS`	Off; exactly `1` enables artifact processing.
`GILF_EVIDENCE_REQUIRE_ARTIFACTS`	Off; accepts `1`, `true`, `yes`, `on`; marks unsupported execution claims unverified when artifact processing runs.

Sources: R/src/codex-review-runner.js:2224-2226,2300-2314,2351-2366,3248-3267,3342-3353,3403-3405; R/src/prime-harness-adapter.js:153-163,212-222; R/src/author-model.js:15-16,161-231; R/src/harness-evolution.js:56-59.

Validation

Variable	Default / effect
`GILF_VALIDATION_EXECUTOR`	Explicit selection wins; otherwise repo `validation.provider`, then `GILF_VALIDATION_PROVIDER`, then `managed-crabbox`. Native projection supplies `managed-cf-sandbox` when unset.
`GILF_VALIDATION_PROVIDER`	Node env-derived repo config defaults to `crabbox`.
`GILF_VALIDATION_CODE_CHANGES_ONLY`	True unless exactly `false`; `0` does not disable this gate.
`GILF_INSTALL_TIMEOUT_MS`, `GILF_VALIDATION_TIMEOUT_MS`	Local collector defaults `900000` ms each. Not universal remote sandbox timeouts.
`GILF_GIT_TIMEOUT_MS`	`120000` ms
`GILF_VALIDATION_SHADOW_EXECUTOR`	Unset; must be a supported, different executor with a wired collector.
`GILF_VALIDATION_SHADOW_TIMEOUT_MS`	`600000` ms; clamps shadow lane config and bounds waiting.
`GILF_VALIDATION_COST_RATES`	JSON override of built-in CF/E2B rate cards, labeled `estimate:wall-clock`. Not a billing API.
`GILF_SKIP_CODEX_ON_VALIDATION_FAILURE`	Opt-in semantic skip; see source predicate and Troubleshooting.
`GILF_ALLOW_LOCAL_VALIDATION`	Host execution refused unless exactly `1`. Trusted repos only.
`GILF_CRABBOX_BIN`, `GILF_CRABBOX_ARGS`	`crabbox`, JSON array `[]`
`GILF_CRABBOX_CONFIG`, `GILF_CRABBOX_ALLOW_REPO_CONFIG`	No pinned path; repo executable config refused unless exactly `1`. Pinning alone does not bypass the refusal.
`GILF_CRABBOX_TIMEOUT_MS`	Collector default `2700000` ms
`E2B_API_KEY`	Required to execute E2B validation
`GILF_E2B_TIMEOUT_MS`	Collector fallback `600000` ms, but repo defaults can supply `2700000`. Native manifest explicitly supplies `600000`.
`GILF_E2B_CPU_COUNT`, `GILF_E2B_MEMORY_MB`, `GILF_E2B_TEMPLATE`	`2`, `512`, empty template
`GILF_E2B_ALLOW_INTERNET`, `GILF_E2B_ALLOWED_DOMAINS`	Repo default true, empty array. Internet disabled by `false` or `0`; domains are a JSON array. Not forwarded natively.
`GILF_E2B_BUDGET_USD`	Native dispatch default `50`; at the ceiling, withholds the exact `managed-e2b` shadow selector. D1 read errors log and leave the selector enabled. Not a primary-lane or monthly budget.
`GILF_CF_SANDBOX_ENABLED`	Native projection sets `1`; readiness hint, not a substitute for a wired collector.
`GILF_CF_SANDBOX_TIMEOUT_MS`	Collector default `1800000` ms; not forwarded.
`GILF_SELF_HOST_VALIDATION`	Exactly `1`, plus an executor command, required.
`GILF_SELF_HOST_EXECUTOR_CMD`, `GILF_SELF_HOST_EXECUTOR`	Command then legacy alias; unset otherwise.
`GILF_SELF_HOST_NETWORK`, `GILF_SELF_HOST_REPO_DIR`	Optional network intent; repo dir supplied by runner to the safe child environment, not an operator checkout override.
`GILF_SELF_HOST_TIMEOUT_MS`	`2700000` ms

Sources: R/src/validation-config.js:11-31; R/src/config.js:11-28; R/src/validation-executor.js:76-134,146-202,251-282,304-360,378-388,485-579; R/src/codex-review-runner.js:495-499,1152-1157,1254-1340,2335; R/cloudflare-native/src/cf-sandbox-validation.js:68-83; R/cloudflare-native/src/container-env.js:100-141. See Validation executors for merge precedence and isolation limits.

Queue, context and worker lifecycle

These legacy queue settings configure R/cloudflare/, not the native Cloudflare Queue.

Variable	Default / effect
`GILF_QUEUE_LEASE_SECONDS`	Node server `300` seconds. Worker computes `3600` seconds with untouched timeout defaults; an explicit positive value overrides it.
`GILF_QUEUE_NAME`, `GILF_QUEUE_SHARDS`	`global`, `8` shards (maximum `256`)
`GILF_QUEUE_DEFAULT_LEASE_SECONDS`, `GILF_QUEUE_DEFAULT_MAX_ATTEMPTS`	`300`, `8`
`GILF_QUEUE_ACKED_TTL_SECONDS`, `GILF_QUEUE_DEAD_LETTER_TTL_SECONDS`, `GILF_QUEUE_CLEANUP_INTERVAL_SECONDS`	`86400`, `604800`, `3600` seconds
`GILF_CONTEXT_GRAPH_URL`, `GILF_CONTEXT_GRAPH_TOKEN`	Fall back respectively to queue URL/token; no client unless both resolve.
`GILF_WORKER_MAX_JOBS`, `GILF_WORKER_CONCURRENCY`	`1`, `1`; Node worker drains a bounded batch then exits.
`GILF_WORKER_ID`	Hostname, with process id appended by worker
`GILF_REVIEW_WORK_ROOT`	OS temp directory plus `gilf-pr-review-workspaces`
`GILF_REVIEW_KEEP_WORKSPACE`	Node keeps workspace only for exact `true`
`GILF_REVIEWER_MODE`	`codex`; other values skip constructing `CodexReviewRunner`
`GILF_BASE_BRANCH_FALLBACK`	`main`
`GILF_CODEX_FOR_DOCS_ONLY`	Off; exact `1` disables the model fast-path skip. Not forwarded natively. Memory, custom guidance, commands and competitor context also prevent this skip.

The worker lease calculation uses a 10-minute model fallback while the runner model timeout is 45 minutes. Set explicit timeouts and a lease sized for the whole run; do not assume their defaults match.

Sources: R/src/worker-runner.js:14-39,42-72; R/worker.mjs:43-66; R/src/codex-review-runner.js:1780-1785,2306,2317-2337,2620-2626; R/cloudflare/src/queue-routing.js:15-26; R/cloudflare/src/queue-do.js:37-49,138,202.

Publishing and observability

Variable	Default / effect
`GILF_PUBLISH_MODE`	Native only: unset/blank becomes `shadow`; trimmed case-insensitive `shadow`/`live` accepted, other values throw. Manifest explicitly uses `live`.
`GILF_PUBLISH_ON_CODEX_FAILURE`	Off; exact `1` permits degraded fallback after semantic failure when usable hypothesis recovery is unavailable. Not forwarded natively.
`GILF_OPERATOR_UI_ENABLED`, `GILF_OPERATOR_UI_TOKEN`	Node dashboard disabled unless `1`; when enabled, missing/wrong token fails closed with `401 operator_auth_required` (`R/src/operator-dashboard.js:601-620`).
`GILF_TRACING`, `GILF_ENV`	Tracing on unless `0`/`false`; environment label `production`. Native entrypoint explicitly creates its tracer enabled.
`GILF_PRODUCT_NAME`	`Son of Anton`
`GILF_WATCHDOG_ALERT_CHANNEL`, `GILF_WATCHDOG_ALERT_ACCOUNT`, `GILF_WATCHDOG_ALERT_TARGET`	Node watchdog: `telegram`, `gilfoyle`, unset target
`GILF_BENCHMARK_RULES_PATH`	Current directory plus `pr-review-system/generated/benchmark-rules.md`

GILF_BROKER_URL, GILF_BROKER_TOKEN and GILF_BROKER_ALLOW_LOCAL_KEY are not implemented configuration in these runtime entrypoints. Native uses the KEY_BROKER service binding and its outbound transport, not those design-era variables.

Sources: R/cloudflare-native/src/publish-mode.js:26-69; R/cloudflare-native/container/entrypoint.mjs:273-302,378-385; R/src/codex-review-runner.js:2338,2706-2707; R/server.mjs:76-84; R/src/trace-emitter.js:9-10,54; R/src/branding.js:1; R/bin/gilf-pr-agent-watchdog.mjs:15-18.

Dashboard proxy and parity Worker

anton-ui/worker/proxy-utils.js:1-64 reads SON_OF_ANTON_API_BASE / SON_OF_ANTON_API_TOKEN, falling back to GILF_OPERATOR_API_BASE / GILF_OPERATOR_UI_TOKEN. Its interim OPERATOR_REQUIRE_AUTH gate is off unless truthy; when enabled, callers need OPERATOR_ACCESS_TOKEN. This is not the authentication design of anton-ui-trace-parity, whose Worker has session authentication. Do not copy the base UI's default-off gate into that deployment.

The parity UI requires session authentication (anton-ui-trace-parity/worker/index.js:20-32). Its SON_OF_ANTON_ADMIN_TOKEN supplies privileged backend requests; missing configuration gives admin_backend_not_configured (:42-47). WorkOS settings are implemented in this tree, not merely an unseen worktree: WORKOS_CLIENT_ID, WORKOS_ISSUER and comma-separated WORKOS_ALLOWED_USER_IDS are validated by anton-ui-trace-parity/worker/workos-auth.js:11-18. The issuer must be the client-scoped https://api.workos.com/user_management/CLIENT_ID, and the allowed-user list must be nonempty. These are not the complete session deployment prerequisites; they do not configure the original anton-ui bearer gate.

P/cloudflare/src/env.js:1-10 resolves canonical SON_OF_ANTON_ names before legacy GILF_ names for suffixes its callers request. This is not a global alias system for Node or native container settings.

Suffixes	Purpose
`QUEUE_ENQUEUE_TOKEN`, `QUEUE_WORKER_TOKEN`, `QUEUE_ADMIN_TOKEN`	Enqueue; claim/ack/fail/renew; queue inspection
`CONTEXT_GRAPH_TOKEN`	Context graph route authentication
`REVIEW_STATE_SYNC_TOKEN`, `REVIEW_STATE_READ_TOKEN`	State synchronization and health/read access
`OPERATOR_READ_TOKEN`, `OPERATOR_COMMAND_TOKEN`, `OPERATOR_BRIDGE_TOKEN`, `OPERATOR_ADMIN_TOKEN`	Route-specific operator read, command, bridge and administration access
`QUEUE`, `QUEUE_NAME`	Durable Object binding and routing name

Sources: P/cloudflare/src/worker.js:39-85,111-157. Settings writes need the admin token; generated anton_ API keys do not authorize policy writes. See Dashboard settings. Public source availability and license terms remain unestablished; these paths identify local source evidence, not public download promises.

On this page