Interface FlowsafeWorkerEnv

Separation-of-duties exemption (var). Unset or a false spelling = SoD on (default); true = every decider may self-decide; a comma-separated role list (e.g. admin or admin,reviewer) = only those roles. Any invalid value falls back to OFF (fail closed).

Cron purges DECIDED approval records older than this (var; default 30; 0 = immediately).

Default SLA seconds for new approvals (var; default 14400 = 4h).

Optional audit export: queue producer binding + SIEM collector config.

D1: the approval store AND the Mastra snapshot table live here.

Optional per-tenant hub Durable Object namespace for live streaming. Present together with STREAM_TICKET_SECRET => the composer mounts the stream stage and fans approval mutations out to the tenant hub; either absent => streaming stays unmounted and the client remains poll-only.

Agent-inbox TTL in days. The purge cron reaps terminal mastra_notifications rows past this age (pending rows are never reaped — one may await a future deliverAt). UNSET/EMPTY/INVALID => the duty does not run and no notification ever expires (opt-in, like THREAD_RETENTION_DAYS — a durable inbox is meant to be readable until the host says otherwise).

Cron purges terminal run snapshots older than this (var; default 30; 0 = immediately).

The runner DO namespace createDoRunTopology drives.

Schedule-trigger history TTL in days. The purge cron reaps mastra_schedule_triggers rows past this age by their actualFireAt. UNSET/EMPTY/INVALID => the duty does not run (opt-in; a schedule's fire history is inspectable until the host sets a window). The schedule rows themselves are standing config — never TTL'd, reaped only at offboarding.

Dedicated stream-ticket signing secret. Absent means no streaming.

Agent-memory thread TTL in days (var; docs/agent-memory-tenancy.md item 7): the purge cron deletes threads untouched for longer than this, with their messages. UNSET, EMPTY, or INVALID => the duty does not run and no thread ever expires — the opt-in default, because a thread is a conversation a host means to keep, not a terminal run snapshot that is finished by definition. There is no safe number to pick on an operator's behalf here, so anything short of a number the operator actually named is answered by NOT deleting (a config-error line marks the invalid case). Unlike RUN_RETENTION_DAYS this var decides whether an irreversible delete happens at all, so it does not take numberVar's fallback — see optionalNumberVar in env-vars.ts.

Thread-state TTL in days. The purge cron reaps mastra_thread_state rows (state-signal lanes + goals) untouched for longer than this. UNSET/EMPTY/INVALID => the duty does not run (opt-in; an active goal bumps updatedAt so it never ages out).