.env.example is the complete checked-in configuration inventory. Copy it to a private .env.local; never commit credentials. Runtime environment validation lives in src/lib/config.ts and agent/harmonia_agent/config.py.
Core services
AWS_LOCAL_ENDPOINT and AWS_S3_LOCAL_ENDPOINT are explicit loopback test endpoints. They are not cloud deployment settings. Cognito sign-in has no local authentication bypass.
Models and costs
Intent, presentation, and status use Claude Haiku 4.5. Strategy, analysis, planning, writing, review, and production judgment use Claude Sonnet 4.6. Nova 2 Lite supplies visual observations and Transcribe supplies timed spoken evidence. Role overrides must identify actual available Bedrock model/profile IDs and be recorded in deployment evidence.
BEDROCK_TEXT_PRICING_JSON maps each exact configured model ID to numeric input and output prices in USD per million tokens. Missing prices fail closed. Private source indexing additionally requires EMBEDDING_INPUT_USD_PER_MILLION and EMBEDDING_PRICING_VERSION; its conservative reservation is not an observed provider bill. Set TRANSCRIBE_COST_PER_SECOND_USD, NOVA_REEL_COST_PER_SECOND_USD, and ELEVENLABS_MUSIC_COST_PER_SECOND_USD only from verified applicable pricing. Paid planner and Dream invocations also require bounded PRODUCTION_PLANNER_MAX_COST_USD and DREAM_MAX_COST_USD reservations.
HARMONIA_ALLOW_PAID_AWS=false is the default. Generated media additionally requires GENERATIVE_MEDIA_ENABLED and its provider capability checks. Resident autonomy requires explicit operator enablement and budget authority. Deployment authorization is separately controlled by HARMONIA_ALLOW_PAID_DEPLOYMENT in the deployment wrappers.
Secrets
CDK injects service tokens and the connection-envelope key through Secrets Manager. HARMONIA_INTEGRATION_SECRETS_JSON contains supported deployment-wide connector credentials; HARMONIA_PROVIDER_SETTINGS_JSON contains the allow-listed nonsecret settings. Bootstrap code validates and expands these before importing application configuration. Neither blob can override the paid AWS gate.
Per-workspace OAuth grants are obtained afresh and encrypted server-side. Retain Google Drive, Calendar, YouTube, external GCS brand-library support, and official social APIs as isolated integrations. Internal assets use S3. Telegram remains allow-listed with webhook validation, replay protection, and nonce-bound decisions through the normal approval service.
Evidence
Use the evidence runbook. Verify redacted evidence with:
A passing local evidence validator establishes internal consistency only. It does not establish that provider calls or deployment occurred.Last modified on September 14, 2026
