Skip to main content

Configuration

Core Runtime Keys​

  • JHF_WARP_DATABASE_URL
  • JHF_WARP_OPENCLAW_HOST
  • JHF_WARP_OPENCLAW_MODE
  • JHF_WARP_OPENCLAW_STATUS_TIMEOUT_SECONDS
  • JHF_WARP_APPLY_TIMEOUT_SECONDS

Fabric / Authority Context​

  • JHF_WARP_FABRIC_CONTEXT_BASE_URL
  • JHF_WARP_FABRIC_CONTEXT_AUTH_TOKEN
  • JHF_WARP_REED_CONTEXT_BASE_URL — Reed context gateway, e.g. http://jhf-reed-context-gateway:18111. Unset means the route is never measured and every knowledge binding fails closed; it does not mean the route is down. The same internal-HTTP allowlist rules as Fabric apply.
  • JHF_WARP_REED_UPSTREAM_AVAILABLE — true only when the Bobbin upstream behind reed_context_assemble / _explain / _expand is actually reachable. Reported by the operator lane, never inferred: Reed answered /readyz 200 with every check true while reed_context_assemble answered 503 upstream_credential_unavailable. Only the exact string true counts; anything else denies. reed_context_describe and reed_context_report_missing_fact need no upstream and stay usable while this is false.
  • if JHF_WARP_FABRIC_CONTEXT_BASE_URL is set for a guarded live Fabric path, JHF_WARP_FABRIC_CONTEXT_AUTH_TOKEN is required
  • internal routes require Authorization: Bearer <token>
  • on the Host172 Warp container path, use http://jhf-fabric-api:8080 over the external jhf-fabric_net; do not use a Fabric port bound only to host loopback
  • when that internal HTTP endpoint is configured, JHF_WARP_ALLOW_INTERNAL_HTTP_TARGETS=true and JHF_WARP_ALLOWED_INTERNAL_HTTP_HOSTS must include jhf-fabric-api; the service name remains explicitly allowlisted rather than broadly trusted
  • the production Warp compose stack uses the warp-postgres alias for its own database to avoid DNS collisions on bridge networks

Downstream Integrations​

  • JHF_WARP_JHF_SHUTTLE_BASE_URL
  • JHF_WARP_JHF_PATTERN_BASE_URL
  • JHF_WARP_JHF_SPINDLE_BASE_URL
  • keep the admitted FIN-INV Spindle MCP lane on the canonical mounted CA path /run/helpifyr-certs/helpifyr-caddy-root.crt via NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, CURL_CA_BUNDLE, REQUESTS_CA_BUNDLE, and PIP_CERT

Control-Agent Settings​

  • JHF_WARP_DOUBTFIRE_ENABLED
  • JHF_WARP_DOUBTFIRE_API_BASE_URL
  • JHF_WARP_DOUBTFIRE_HEARTBEAT_MINUTES
  • JHF_WARP_DOUBTFIRE_TAKEOVER_HEARTBEATS

Verify After Changes​

python scripts/verify_host_env_contract.py deploy/env/jhf-warp.host.env.example
python scripts/verify_runtime_materialization.py
python scripts/verify_runtime_materialization.py --host <live-host>
# Required before any FIN-INV owner-decision lane is admitted. This checks only
# that the admitted Spindle target, credential, and CA trust values are
# configured; it never prints secret values.
python scripts/verify_runtime_materialization.py --host <live-host> --require-spindle-owner-readback

Run the owner-readback gate after the deployment-managed host environment is updated and before rebuilding jhf-warp-api for a FIN-INV lane.

License​

AGPLv3. See ../LICENSE (LICENSE).

Learn more at helpifyr.com.