# Security Environment Variable Manifest

This manifest documents environment variable names that are referenced by local
security-sensitive automation and runtime detection. It intentionally records
names only; secret values must stay in the caller environment, CI secret store,
or local secret files.

## Local Runtime And Tooling

- `ANTHROPIC_API_KEY_FILE`: optional Anthropic credential file path.
- `CLAUDE_CODE`: Claude Code runtime marker.
- `CLAUDECODE`: Claude Code runtime marker.
- `CODEX_SANDBOX`: Codex runtime marker.
- `CODEX_THREAD_ID`: Codex runtime marker.
- `CURSOR_AGENT`: Cursor runtime marker.
- `CURSOR_TRACE_ID`: Cursor runtime marker.
- `OLLAMA_API_KEY_FILE`: optional Ollama credential file path.
- `OPENAI_API_KEY_FILE`: optional OpenAI credential file path.
- `OPEN_ORCHESTRA_CLAUDE_NATIVE_CALLBACK`: local Claude native callback marker.
- `OPEN_ORCHESTRA_CLAUDE_NATIVE_CHILD_ID`: Claude native child id marker.
- `OPEN_ORCHESTRA_COMMAND_MANIFEST_OUT`: optional command manifest check output path.
- `ORCHESTRA_GITLEAKS_BIN`: optional absolute gitleaks binary override.
- `ORCHESTRA_SECRET_SCAN_FORCE_FALLBACK`: forces fallback secret scanning.
- `ORCHESTRA_SKIP_UPDATE_CHECK`: disables package update checks.
- `ORCHESTRA_UPDATE_CHECK_CACHE_DIR`: package update check cache directory.
- `ORCHESTRA_WORKFLOW_HEARTBEAT_MS`: workflow heartbeat interval override.

## CI And Release Automation

- `CF_ACCESS_PROXY_LISTEN_HOST`: local Cloudflare Access proxy host.
- `CF_ACCESS_PROXY_LISTEN_PORT`: local Cloudflare Access proxy port.
- `CLAUDE_API_KEY`: protected GitHub Actions secret for Anthropic/Claude real-provider smoke jobs; mapped to `ANTHROPIC_API_KEY` only inside trusted protected-branch runs.
- `CLOUDFLARE_ACCOUNT_ID`: Cloudflare account identifier from CI secrets.
- `CLOUDFLARE_API_TOKEN`: Cloudflare deployment token from CI secrets.
- `GH_TOKEN`: GitHub CLI token provided by GitHub Actions.
- `GITHUB_HEAD_REF`: GitHub Actions pull request source branch.
- `GITHUB_REPOSITORY`: GitHub Actions repository slug.
- `GITLEAKS_ASSET`: temporary gitleaks release asset name in CI.
- `GITLEAKS_VERSION`: pinned gitleaks release version in CI.
- `GPT_API_KEY`: protected GitHub Actions secret for OpenAI/GPT real-provider smoke jobs; mapped to `OPENAI_API_KEY` only inside trusted protected-branch runs.
- `NPM_USER`: npm authenticated username captured during release validation.
- `NPM_VERSION`: npm package version captured during release validation.
- `PKG_VERSION`: package version used by release tag creation.
- `PRERELEASE_FLAG`: release tag prerelease marker.