OptionalAPPROVAL_Separation-of-duties exemption (var). Unset or a false spelling = SoD on
(default); true = every decider may self-decide; a comma-separated role
list (e.g. admin or admin,reviewer) = only those roles. Any invalid
value falls back to OFF (fail closed).
OptionalAPPROVAL_Maintenance purges DECIDED approval records older than this (default 30 days).
OptionalAPPROVAL_Default SLA seconds for new approvals (var; default 14400 = 4h).
OptionalAUDIT_Remote trusted-state Durable Object namespace used by external releases.
OptionalAUDIT_Optional audit queue producer; delivery belongs to the control plane.
D1: the approval store AND the Mastra snapshot table live here.
Per-deployment Worker-to-Durable-Object credential.
Provisioning-stamped deployment tag; must match the D1 sentinel.
OptionalFLEET_Fleet-controlled marker: audit export must use the trusted state proxy.
OptionalFLEET_Fleet-controlled marker: this private Worker terminates audit proxy calls.
OptionalFLEET_Fleet-controlled logical release-family name for trusted audit attribution.
OptionalFLEET_Fleet-controlled environment attribution for trusted state.
OptionalFLEET_Fleet-controlled marker: maintenance routes relay one-shot capabilities.
OptionalFLEET_Fleet Ed25519 public JWK used before external maintenance execution.
OptionalFLEET_Fleet resource group stamped onto trusted state.
OptionalFLEET_Distinguishes the trusted state runtime from an external candidate.
OptionalFLEET_Optional fleet release identity returned only by authenticated maintenance routes.
OptionalHUBOptional deployment hub Durable Object namespace for live streaming. Present together with STREAM_TICKET_SECRET => the composer mounts the stream stage and fans approval mutations out to the deployment hub; either absent => streaming stays unmounted and the client remains poll-only.
Fixed-name singleton that owns deployment maintenance alarms.
OptionalMAINTENANCE_Dedicated control-plane credential for maintenance administration.
OptionalNOTIFICATION_Agent-inbox TTL in days. The purge duty reaps terminal
mastra_notifications rows past this age (pending rows are never reaped —
one may await a future deliverAt). UNSET/EMPTY/INVALID => the duty does not
run and no notification ever expires (opt-in, like THREAD_RETENTION_DAYS —
a durable inbox is meant to be readable until the host says otherwise).
OptionalOUTBOUND_OptionalOUTBOUND_OptionalOUTBOUND_Named StateEgress service binding, present only on trusted state.
OptionalOUTBOUND_Dedicated trusted-state credential for the shared outbound entrypoint.
OptionalOUTBOUND_OptionalOUTBOUND_OptionalOUTBOUND_OptionalOUTBOUND_OptionalRUN_Maintenance purges terminal run snapshots older than this (default 30 days).
The runner DO namespace createDoRunTopology drives.
OptionalSCHEDULE_Schedule-trigger history TTL in days. The purge duty reaps
mastra_schedule_triggers rows past this age by their actualFireAt.
UNSET/EMPTY/INVALID => the duty does not run (opt-in; a schedule's fire
history is inspectable until the host sets a window). Schedule rows are
standing config with no TTL; an authorized DELETE removes them, and
deployment decommissioning removes any that remain.
OptionalSTART_How long a spent idempotency key stays answerable after its run settled — the key-validity horizon (var; defaults to RUN_RETENTION_DAYS, and is floored at it).
Set this ABOVE run retention when callers may retry a start later than this deployment keeps run summaries: until the horizon elapses such a retry is told ALREADY_SETTLED, and after it the same key reads as brand new and starts a second run.
OptionalSTREAM_Dedicated stream-ticket signing secret. Absent means no streaming.
OptionalTHREAD_Agent-memory thread TTL in days (docs/agent-memory-isolation.md#thread-retention): the purge duty deletes threads untouched for longer than this, with their messages. UNSET, EMPTY, or INVALID => the duty does not run and no thread ever expires — the opt-in default, because a thread is a conversation a host means to keep, not a terminal run snapshot that is finished by definition. There is no safe number to pick on an operator's behalf here, so anything short of a number the operator actually named is answered by NOT deleting (a config-error line marks the invalid case). Unlike RUN_RETENTION_DAYS this var decides whether an irreversible delete happens at all, so it does not take numberVar's fallback — see optionalNumberVar in env-vars.ts.
OptionalTHREAD_Thread-state TTL in days. The purge duty reaps
mastra_thread_state rows (state-signal lanes + goals) untouched for longer
than this. UNSET/EMPTY/INVALID => the duty does not run (opt-in; an active
goal bumps updatedAt so it never ages out).
The env bindings the composed Worker reads. A host's own Env extends this (its workers-typed D1Database/DurableObjectNamespace/Queue bindings satisfy these structural subsets) and adds whatever its hooks need.