TruvaG3 Limits & Configuration Cheatsheet

Quick reference for configurable defaults and enforced framework/provider boundaries. A value is overrideable only where its row names an environment variable or programmatic option; fixed validation limits cannot be raised.

Configuration precedence where all three layers exist: Functional option > environment variable > constructor/config default.

For full details on environment variables see ENVIRONMENT_VARIABLES_GUIDE.md. For programmatic configuration and With* options see API_REFERENCE.md.

Quick navigation: Token limits, execution limits, retry budgets, failed-operation views, and shared memory.

---

LLM Token Limits

What	Default	Env Var	Programmatic Override
Plan generation output	20000	TRUVAG3_PLAN_MAX_TOKENS	WithPlanAIOptions(&AIOptionsOverride{MaxTokens: IntPtr(n)})
Synthesis output	30000	TRUVAG3_SYNTHESIS_MAX_TOKENS	WithSynthesisAIOptions(&AIOptionsOverride{MaxTokens: IntPtr(n)})
Synthesis temperature	0.5	TRUVAG3_SYNTHESIS_TEMPERATURE	WithSynthesisAIOptions(&AIOptionsOverride{Temperature: Float32Ptr(t)})
Plan model override	—	TRUVAG3_PLAN_MODEL	WithPlanAIOptions(&AIOptionsOverride{Model: StringPtr(m)})
Synthesis model override	—	TRUVAG3_SYNTHESIS_MODEL	WithSynthesisAIOptions(&AIOptionsOverride{Model: StringPtr(m)})
Micro-resolution & semantic-retry model override	—	TRUVAG3_MICRO_RESOLUTION_MODEL	WithMicroResolutionAIOptions(&AIOptionsOverride{Model: StringPtr(m)})
Micro-resolution & semantic-retry output	2000 / 1000	TRUVAG3_MICRO_RESOLUTION_MAX_TOKENS	WithMicroResolutionAIOptions(&AIOptionsOverride{MaxTokens: IntPtr(n)})
Tiered selection output	2000	TRUVAG3_TIERED_SELECTION_MAX_TOKENS	WithTieredSelectionMaxTokens(n)
Core AI max tokens	2000	TRUVAG3_AI_MAX_TOKENS is a reserved struct tag, not read by LoadFromEnv	Explicit AI-client options or orchestration call options

TRUVAG3_MICRO_RESOLUTION_MAX_TOKENS / TRUVAG3_MICRO_RESOLUTION_MODEL are shared: they govern both micro-resolution and Layer 4 semantic retry (contextual re-resolution). The base defaults differ — micro-resolution is 2000 tokens, semantic retry is 1000 — but setting either env var (or WithMicroResolutionAIOptions) overrides both. There is no separate TRUVAG3_SEMANTIC_RETRY_MAX_TOKENS; raise the micro-resolution token limit if a semantic-retry response is being truncated. TRUVAG3_SEMANTIC_RETRY_MAX_ATTEMPTS (see Retry Budgets) controls retry count, not output tokens.

AI Request Policy, Routing, and Construction

What	Default / Limit	Environment	Programmatic Override
General provider request timeout for root ai constructors	300s	TRUVAG3_AI_TIMEOUT (positive Go duration; read by AI constructors, not core.Config.LoadFromEnv)	ai.WithTimeout(d)
Auto-detected client / framework-managed chain-entry timeout	300s, including Bedrock	TRUVAG3_AI_TIMEOUT	ai.WithTimeout(d) / ai.WithChainTimeout(d)
Request-policy model selector glob	At most 256 bytes	—	core.AIProviderSelector.Model
Heterogeneous chain entry name	1–256 bytes; no surrounding whitespace or controls; unique within the chain	—	First argument to ai.ProviderEntry / ai.ClientEntry
Heterogeneous ProviderEntry provider alias	1–256 bytes; no surrounding whitespace or controls	—	Second argument to ai.ProviderEntry
HTTP-provider resolver route identity	1–256 bytes; non-secret, no control characters	—	ai.ResolvedEndpoint.RouteIdentity
Bedrock resolver route identity	1–256 bytes; non-secret, no surrounding whitespace or controls	—	ai.ResolvedEndpoint.RouteIdentity
Provider error body used for internal classification	64 KiB; one additional byte is read only to detect overflow, after which captured bytes are discarded	—	Fixed security/privacy boundary; not operator-configurable
OpenAI-compatible SSE event	1 MiB	TRUVAG3_AI_SSE_EVENT_MAX_BYTES when positive	AIConfig.SSEEventMaxBytes; applies per complete event
OpenAI-compatible in-band error_type	64 bytes, lowercase ASCII letters/digits/underscore	—	Fixed syntax/cardinality boundary; malformed values become unmapped
OpenRouter provider request ID observation	128 bytes and gen-[A-Za-z0-9_-]+ syntax	—	Fixed security/cardinality boundary; invalid X-Generation-Id values are omitted
OpenRouter response model observation	256 bytes and validated public publisher/model slug syntax	—	Fixed security/cardinality boundary; invalid provider-reported values are omitted
OpenRouter request-body session_id	256 Unicode code points, valid UTF-8 string	—	Upstream routing constraint; distinct from framework correlation baggage

Provider rule model selectors use a case-insensitive glob in which * is the only wildcard. An unscoped rule is rejected unless AIProviderSelector.AllProviders is explicitly true. Route identities are reported and fingerprinted; credentials, raw endpoints, Azure deployment names, Vertex publisher-model IDs, Bedrock modelId values, and ARNs must not be used as route identities.

AWS Bedrock Provider (-tags bedrock)

What	Default / Limit	Environment	Programmatic Override
Region	us-east-1	AWS_REGION, then AWS_DEFAULT_REGION	ai.WithRegion(region)
Direct generation model	anthropic.claude-sonnet-5; an invocation that would use the implicit default is accepted only in us-east-1 after per-request model selection	—	ai.WithModel(modelID), per-request model, SDK-destination EndpointResolver, or direct-package Client.SetDefaultModel(modelID)
Explicit standalone/direct-package request timeout	60m	—	ai.WithTimeout(d)
In-provider retries	3 retries / 4 AWS SDK total attempts	TRUVAG3_AI_RETRY_ATTEMPTS when positive	ai.WithMaxRetries(n); SDK attempts are max(1, n+1)
Converse modelId / resolver Deployment	Framework pre-validation: 1–2048 bytes with no surrounding whitespace or controls; AWS additionally validates supported model/resource formats	—	Resolver output
Resolver route identity	1–256 bytes; non-secret, no surrounding whitespace or controls	—	Resolver output
Converse maxTokens (logical max_tokens)	Framework range: positive 32-bit integer (1–2,147,483,647); the selected model may impose a lower maximum	—	Portable MaxTokens or policy path /inference_config/max_tokens
Converse temperature / topP (logical top_p)	Finite value from 0 through 1; the selected model may impose narrower constraints	—	Portable parameters or /inference_config/* policy paths
Converse stopSequences	Framework maximum: 2500 non-empty strings; the selected model may impose a lower maximum	—	Bedrock request policy path /inference_config/stop_sequences
Titan embedding model	amazon.titan-embed-text-v2:0	—	bedrock.WithEmbeddingModel(modelID) per call
Titan V1 migration pin	amazon.titan-embed-text-v1; 1536 dimensions; inherited V2 controls omitted, explicitly supplied V2 controls rejected	—	bedrock.WithEmbeddingModel(bedrock.ModelTitanEmbedV1)
Titan V2 input text	Non-empty; AWS model limit is 8,192 tokens or 50,000 characters (the framework pre-validates only non-empty input)	—	Client.GetEmbeddings text argument
Titan V2 dimensions	1024 when omitted (AWS default); otherwise 256, 512, or 1024	—	bedrock.WithEmbeddingDimensions(n) per call
Titan V2 normalization	true when omitted (AWS default)	—	bedrock.WithEmbeddingNormalization(bool) per call; bedrock.WithoutEmbeddingNormalization() omits an inherited client setting

The resolver deployment is an opaque AWS SDK modelId; TruvaG3 does not add a geographic or global inference-profile prefix. Raw model/profile IDs and ARNs must not be used as route identities. The resolver must preserve semantic equivalence because sampling policy follows the semantic model rather than the opaque deployment.

Current Bedrock Claude sampling contracts are enforced before SDK invocation: the checks cover both inferenceConfig and case-insensitive sampling keys in additionalModelRequestFields. Fable temperature/top-p are Converse common fields and must end in inferenceConfig; unique legacy Extra spellings remain policy-editable until final validation, while duplicates and unremediated additional copies fail locally. JSON UseNumber, named, and unsigned numeric values remain numeric, including in nested additional fields.

Semantic model family	Effective sampling constraint
*anthropic.claude-sonnet-5*	temperature, top_p, and top_k must be absent
*anthropic.claude-opus-4-7*	temperature, top_p, and top_k must be absent
*anthropic.claude-opus-4-8*	temperature, top_p, and top_k must be absent
*anthropic.claude-fable-5*	Incompatible inherited temperature and top_k are omitted; explicit temperature must be 1 and explicit top_p must be at least 0.99 and less than 1

Current Mythos model cards expose the Messages surface rather than Converse, so Mythos is not part of this SDK-native Converse compatibility table.

Provider contract sources: AWS Converse, AWS inference configuration, the Claude Opus 4.7 model card, the Claude Opus 4.8 model card, the Claude Fable 5 model card, and Titan Text Embeddings V2.

AI Provider Compatibility Boundaries

Surface / family	Enforced behavior
Direct Anthropic and Vertex Claude: Haiku 5.5, Opus 4.7/4.8/5 (including 5.5), Sonnet 5, Fable 5, Mythos 5, Mythos Preview	Built-in policy omits temperature, top_p, and top_k; Haiku 4.5 pins retain sampling
Azure OpenAI v1 reasoning families	Uses max_completion_tokens, top-level reasoning_effort, and reasoning-restricted sampling
Azure OpenAI classic	Ordinary max_tokens profile only; reasoning-family requests are rejected because no classic reasoning contract is verified
Stock OpenAI reasoning families	Uses max_completion_tokens; multiplier 3 for active effective effort or reviewed model-default reasoning (exact IDs below)
Native OpenAI GPT-6 family, including GPT-6.1 Sol	Efforts low, medium, high, xhigh, max; none only for original GPT-6 Sol and GPT-6 Luna, not GPT-6.1 Sol. Active/default reasoning rejects sampling/logprob and native Chat Completions tool controls after policy
Exact OpenRouter openai/gpt-6-luna	Built-in temperature removal; Compatible reports adaptation, Strict requires acknowledgement for explicit values. Exact model row declares JSON object/schema and OpenAI-style reasoning
Exact OpenRouter openai/gpt-6.1-sol	JSON object/schema and OpenAI-style reasoning; scoped temperature removal with the same Compatible/Strict semantics. Final validation accepts low, medium, high, xhigh, max or omitted effort; rejects none, noncanonical keys and remaining sampling/logprob controls. Supported active effort uses the configured multiplier; native tool restrictions are not copied to this routed contract
Exact OpenRouter DeepSeek v4.1 Flash / GLM 5.3 Flash	JSON object supported by adapter capability rows; schema and reasoning style not declared
openai.ollama non-reasoning models	Retains max_tokens and ordinary sampling; nested reasoning effort is emitted only when effort is set

Compatible policy mode reports built-in adjustments. Strict mode rejects a built-in adjustment to explicit request-aware intent unless application policy acknowledges the affected path.

Anthropic fast now selects Haiku 5.5, and smart/code/vision select Opus 5.5. Their configured max_tokens remains exact and includes thinking, not just final text; small budgets can end before an answer. The alias migration does not raise budgets or impose effort. See the Anthropic migration note for native-extra requirements, tokenizer changes and override/rollback options.

GPT-6.1 Sol native matching also includes all hyphen-suffixed variants/snapshots; this includes -pro but does not certify its endpoint contract. Routed support is declared only for the exact OpenRouter ID above. Shared codec validation precedes policy, so explicit sampling with active effort can fail before the removal rule. Explicit effort omission suppresses inherited effort; merely switching models does not clear an incompatible chain default of none. The routed openrouter-sol-6.1-v3 guard accepts non-null JSON-native reasoning objects without changing their values and versions this contract for caches. enabled/exclude require booleans; enabled:false fails, but exclude:true is allowed. Standalone reasoning.max_tokens requires a positive integer and is passed to OpenRouter for budget-to-effort mapping, not enforced as a local reasoning-token ceiling. Final effort plus max_tokens is rejected, including conflicts involving inherited effort. Application policy may remove a conflict.

The token multiplier defaults to 3×; explicit 1× keeps output caps exact. TRUVAG3_AI_REASONING_TOKEN_MULTIPLIER supplies the default unless a positive code option overrides it. Invalid explicit environment values or negative code values fail construction. Explicit scaling applies only to a scaling reasoning profile with effective nonempty effort other than none, including client/chain defaults inherited by calls that supply no effort. Reviewed exact native GPT-6 Astra/Sol/Luna/GPT-6.1 Sol and routed Luna/Sol defaults also scale with absent effort, without adding a wire effort. Unknown defaults and none remain exact. Explicit request-aware OmitAIParameter[string]() also suppresses inherited effort and its multiplier; it leaves upstream default reasoning in control rather than requesting none. The OpenAI-compatible adapter uses a reviewed 128000 output-token capacity for exact native GPT-5.6 Sol/GPT-6 Astra/Sol/Luna/GPT-6.1 Sol and routed GPT-5.6 Luna/ GPT-6 Luna/GPT-6.1 Sol IDs. GPT-5.6 rows add capacity only, not default reasoning. Added headroom for an in-capacity base is bounded in both policy modes: 50000 × 3 → 128000, including Strict. Over-cap caller bases are clamped with a built-in report adjustment in Compatible mode; Strict rejects an unacknowledged explicit change. Final capacity validation also applies after application patches. This is provider capability data, not an operator-adjustable budget. Other models/variants remain unknown; no universal cap or remaining-context estimate is imposed. Supported OpenRouter portable effort and the reviewed defaults activate scaling; native-extra-only reasoning and unknown model/snapshot defaults remain exact. Azure default reasoning is not inferred.

The provider timeout is a total deadline, not an idle timeout or a promise that the output cap can be exhausted. Positive code overrides the timeout environment; invalid present environment values fail construction. Raising it does not extend earlier phase, caller, auxiliary-stage or injected HTTP-client deadlines. Provider deadline errors remain terminal to chain failover; no automatic timeout scaling or new retry behavior is introduced. Configure longer bounded deadlines explicitly when measured latency warrants them.

Changing an active multiplier changes the AI-output cache fingerprint, including preflight calls without a token count. A reviewed headroom limit also participates in active-scaling identity. Draft construction rejects multiplication overflow unless a reviewed limit safely bounds added headroom; legacy openaiwire.BuildRequestBody saturates at math.MaxInt, which is an integer safety boundary, not a provider limit. Numeric token patches must be positive integral values fitting Go int; JSON decimal/exponent notation is checked exactly and reported consistently without wire rewriting.

Final/reasoning separation defaults on for compatible codecs. The legacy opt-in is code-only: ai.WithReasoningContentFallback(true) or ai.WithChainReasoningContentFallback(true) (direct codec: Config.ReasoningContentFallback). It changes response projection/cache identity, not token, retry or timeout budgets. Empty final content or finish_reason=length does not by itself create another attempt.

Decoded-provider errors share the existing provider MaxRetries budget with HTTP/transport errors; there is no separate in-body retry budget. Standalone clients and ProviderEntry default to three retries, legacy NewChainClient entries to zero; explicit options/positive retry env overrides apply as documented. Delivered answer or reasoning output prevents stream replay. OpenRouter allows status-only same-provider retries for 429/500/502/503/504, not 501/505; unknown typed errors are conservative. This is separate from outer-chain failover and from orchestration's tool-step retry policy.

Provider contract sources: Anthropic Sonnet 5 sampling changes, Anthropic model deprecations and migration behavior, and the Azure OpenAI v1 chat-completions reference.

Conversation History Preparation

What	Default	Env Var	Programmatic Override
Prepared conversation-history budget	48000	TRUVAG3_CONVERSATION_TOKEN_BUDGET	OrchestratorConfig.ConversationTokenBudget or ConversationHistoryProcessorConfig.TokenBudget
Recent turns preserved verbatim	4	TRUVAG3_CONVERSATION_RECENT_TURNS_PRESERVED	OrchestratorConfig.ConversationRecentTurnsPreserved or ConversationHistoryProcessorConfig.RecentTurnsPreserved
Summary cache size (Tier 2 only)	256	TRUVAG3_CONVERSATION_SUMMARY_CACHE_SIZE	OrchestratorConfig.ConversationSummaryCacheSize and NewSummaryCache(n)

Tier 1 conversation-history protection is default-on for metadata and hook ingress paths. Tier 2 recursive compaction is opt-in and only active when the application injects a preparer configured with both a SummaryCache and a ConversationCompactor.

Iterative Planning (Multi-Phase DAG)

What	Default	Env Var	With* Option
Enabled	true	TRUVAG3_ITERATIVE_PLANNING_ENABLED	—
Max phases per request	20	TRUVAG3_ITERATIVE_MAX_PHASES	—
Max total steps (all phases)	200	TRUVAG3_ITERATIVE_MAX_TOTAL_STEPS	—
Configured phase budget (may be enlarged; see Execution Limits)	25m	TRUVAG3_ITERATIVE_PHASE_TIMEOUT	—
Max validation rounds	4	TRUVAG3_ITERATIVE_MAX_VALIDATION_ROUNDS	Regen attempts after first validation failure; phase fails if exceeded
Regeneration feedback	16384 bytes	TRUVAG3_ITERATIVE_REGENERATION_FEEDBACK_MAX_BYTES	IterativePlanning.RegenerationFeedbackMaxBytes; effective value must be > 0 when validated. Encoded added correction context, not the full prompt
Distinct prior validation errors retained per phase	8	—	Internal bounded history; the encoded feedback limit can omit entries earlier

At most 1 + MaxValidationRounds candidates reach validation: malformed regenerated JSON spends a regeneration attempt without another validation. Provider, boundary and cancellation errors can stop earlier. A continuation regeneration that still reuses executed step IDs returns an error immediately; it need not consume every validation round. Correction context keeps the latest feedback and bounded prior evidence; omitted history is marked. If even required feedback cannot fit the configured byte limit, preparation fails before another model call. Standard orchestration configuration-resolution rules apply to invalid explicit values; see the environment guide.

Dependency-only fixed point: consecutive all-skipped phases with identical failed ancestors stop non-terminal continuation after one opportunity to adapt; this is a structural invariant, not a tunable retry budget. Actual work resets it.

Execution Limits

What	Default	Env Var	With* Option
Max parallel steps	25	TRUVAG3_EXECUTION_MAX_CONCURRENCY	WithMaxConcurrency(n)
Delegation execution allowance	15m	TRUVAG3_EXECUTION_STEP_TIMEOUT	WithStepTimeout(d)
Base outbound HTTP timeout	20m	TRUVAG3_ORCHESTRATION_TIMEOUT	WithTotalTimeout(d)
Execution-debug store write timeout	5s	TRUVAG3_EXECUTION_STORE_WRITE_TIMEOUT	WithExecutionStoreWriteTimeout(d)
Request resource cleanup	5s	TRUVAG3_EXECUTION_CLEANUP_TIMEOUT	WithExecutionCleanupTimeout(d); explicit non-positive/invalid values fail resolution in both config modes. Factories return errors; legacy errorless constructors reject Start/execution. Unset direct values default to 5s. Cancellation-independent, joined optional cleanup; providers honor context

The cleanup budget bounds optional activity removal/investigation release after a managed request segment; it does not extend task, phase or provider timeouts. Provider calls must honor cancellation. Investigation leases are not renewed; activity signals are renewed at max(TTL/3, 1ns) while their request is active. That renewal cadence is derived, not a separate setting; each submission uses at most min(cleanup timeout, renewal interval), subject to its parent context.

For SmartExecutor, StepTimeout is not a direct deadline on ordinary tool calls. The shared HTTP client uses TotalTimeout, enlarged when HITL.DefaultTimeout + StepTimeout is greater. Delegated orchestrator calls also receive a context deadline of HITL.DefaultTimeout + StepTimeout. With resolved positive settings, the iterative phase budget is the greater of its configured timeout and this delegation allowance, even when the plan contains no delegated call. Parent cancellation, the effective phase deadline, and the target server's write timeout remain independent limits. TotalTimeout does not impose an end-to-end workflow deadline; the caller/task context must supply that bound.

The default hierarchy is AI request 5m, delegation 15m + 5m HITL = 20m, outbound HTTP 20m, phase 25m, and server write 35m. The task worker's existing default is 30m; direct orchestration calls use their caller's context, not an automatic 30m task deadline. These are nested ceilings, not additive time reservations. A late phase gets only the remaining parent time. Retries and chain failover also consume that remaining time; optional summarization/compaction keep their own shorter limits. A server write deadline bounds socket writes, not a durable workflow or a guaranteed cancellation of handler work. Ingress, callers, and delegated agents may impose shorter limits and must be configured separately.

Scheduled Executor

The scheduled executor configures a separate dispatch path:

What	Default	Env Var	With* Option
Worker count	5	TRUVAG3_EXECUTOR_WORKER_COUNT	—
Max dispatch retries	3	TRUVAG3_EXECUTOR_MAX_RETRIES	—
Retry base delay	5s	TRUVAG3_EXECUTOR_RETRY_BASE_DELAY	—
Retry max delay	60s	TRUVAG3_EXECUTOR_RETRY_MAX_DELAY	—
Dispatch timeout	15m	TRUVAG3_EXECUTOR_DISPATCH_TIMEOUT	—

The dispatch timeout bounds the synchronous POST to the target agent. Size it for the target's entire request, including planning, all phases, retries, synthesis and any blocking HITL wait. Matching only TRUVAG3_ORCHESTRATION_TIMEOUT is insufficient: that setting is a per-call HTTP timeout, not the target's whole workflow budget. Earlier parent or server deadlines still apply.

Redis and Valkey Connection Limits

What	Default / Limit	Environment	Programmatic Override
Deployment key namespace	default; 1–128 ASCII letters, digits, ., _, or -	TRUVAG3_REDIS_NAMESPACE	core.NewRedisKeyspace / redisprovider.WithDeployment
Connection topology	standalone; closed set: standalone, sentinel, cluster	TRUVAG3_REDIS_MODE in the structured form	core.RedisConnectionConfig.Mode / redisprovider.WithConnectionMode
Addresses	One standalone address; Sentinel/cluster require at least one	TRUVAG3_REDIS_ADDRS (comma-separated)	RedisConnectionConfig.Addrs / redisprovider.WithAddresses
Logical database	0 in standalone, Sentinel, and cluster mode	TRUVAG3_REDIS_DB	RedisConnectionConfig.DB / redisprovider.WithDatabase
Pool size	10; 1–10000	TRUVAG3_REDIS_POOL_SIZE	RedisConnectionConfig.PoolSize
Minimum idle connections	5; when non-zero, at most pool size	TRUVAG3_REDIS_MIN_IDLE_CONNS	RedisConnectionConfig.MinIdle
Dial timeout	5s; positive and at most 10m	TRUVAG3_REDIS_DIAL_TIMEOUT	RedisConnectionConfig.DialTimeout
Read timeout	3s; positive and at most 10m, or go-redis sentinel -1ns / -2ns	TRUVAG3_REDIS_READ_TIMEOUT	RedisConnectionConfig.ReadTimeout
Write timeout	3s; positive and at most 10m, or go-redis sentinel -1ns / -2ns	TRUVAG3_REDIS_WRITE_TIMEOUT	RedisConnectionConfig.WriteTimeout
Command retries	3; -1 disables, maximum 100; zero resolves to the default	TRUVAG3_REDIS_MAX_RETRIES	RedisConnectionConfig.MaxRetries
TLS minimum	TLS 1.2 when enabled	TRUVAG3_REDIS_TLS_ENABLED, TRUVAG3_REDIS_TLS_SERVER_NAME, TRUVAG3_REDIS_CA_FILE	RedisConnectionConfig.TLSConfig

Pool limits are per node in cluster mode. Approximate data-node connection capacity is therefore PoolSize × connected shard nodes, not one global pool of PoolSize. REDIS_URL is a DB-0 standalone shorthand; use the structured form for Sentinel or cluster. Connection forms are mutually exclusive and conflicts fail validation.

Default Redis Orchestration Preset

What	Default	Env Var	Code Override
Execution debug TTL	72h (3 days)	TRUVAG3_EXECUTION_DEBUG_TTL	redisprovider.WithExecutionStoreConfig(config)
Execution debug error TTL	72h (3 days)	TRUVAG3_EXECUTION_DEBUG_ERROR_TTL	redisprovider.WithExecutionStoreConfig(config)
LLM debug TTL	72h (3 days)	TRUVAG3_LLM_DEBUG_TTL	redisprovider.WithLLMDebugRetention(ttl, errorTTL)
LLM debug error TTL	72h (3 days)	TRUVAG3_LLM_DEBUG_ERROR_TTL	redisprovider.WithLLMDebugRetention(ttl, errorTTL)
HITL checkpoint TTL	24h	TRUVAG3_HITL_CHECKPOINT_TTL	redisprovider.WithCheckpointTTL(d)
Workflow state TTL	24h	TRUVAG3_WORKFLOW_STATE_TTL	redisprovider.WithWorkflowStateTTL(d)
Task queue retry attempts	3	TRUVAG3_TASK_QUEUE_RETRY_ATTEMPTS	redisprovider.WithTaskQueueRetryPolicy(n, d)
Task queue retry delay	100ms	TRUVAG3_TASK_QUEUE_RETRY_DELAY	redisprovider.WithTaskQueueRetryPolicy(n, d)
Task-index repair interval	1m; positive	TRUVAG3_TASK_INDEX_RECONCILE_INTERVAL	redisprovider.WithTaskIndexReconciliation(d, n)
Task IDs per repair pass	1000; positive	TRUVAG3_TASK_INDEX_RECONCILE_MAX_IDS	redisprovider.WithTaskIndexReconciliation(d, n)
Schedules per deployment	10000; positive	TRUVAG3_SCHEDULER_MAX_SCHEDULES	redisprovider.WithMaxSchedules(n)

The preset remains environment-free under NewOptions. Deployment values are loaded through redisprovider.LoadOptionsFromEnvironment (automatically by NewDefaultBackends for selected roles). Later ConfigureOptions calls retain code-over-environment precedence for valid values. Invalid present durations fail loading; unselected roles' settings are ignored by NewDefaultBackends.

Continuation Prompt Limits

Phase 14: completed-step results in continuation planning prompts are rendered as structure-complete JSON digests (skeletons) under a per-section aggregate budget. Non-JSON blobs get a floor preview; a few may escalate to a fast-model summary. All knobs are top-level OrchestratorConfig fields (no With* option), env-tunable.

What	Default	Env Var	With* Option
Non-JSON floor preview (per-step)	10000 (~2500 tokens)	TRUVAG3_CONTINUATION_RESULT_MAX_CHARS	—
Aggregate digest budget (whole <completed_steps>)	196608 (192 KiB)	TRUVAG3_CONTINUATION_RESULT_MAX_TOTAL_CHARS	—
Max non-JSON → distiller escalations / phase	8 (0 disables)	TRUVAG3_CONTINUATION_MAX_ESCALATIONS	—
Digest array head-sample size	3	TRUVAG3_CONTINUATION_DIGEST_ARRAY_SAMPLE	—
Digest inline-string cap (elision threshold)	200	TRUVAG3_CONTINUATION_DIGEST_SCALAR_MAX	—
Digest per-object key cap	50	TRUVAG3_CONTINUATION_DIGEST_MAX_KEYS	—

Despite legacy CHARS names, continuation size accounting uses UTF-8 bytes before final prompt encoding. Failed steps and the newest success are retained under a soft aggregate target; escaping and later framing can increase sent size.

…_RESULT_MAX_CHARS now sizes only the non-JSON floor preview (logs/markdown/CSV) — JSON results are digested, and orchestrator JSON delegation responses are additionally child-summary-extracted, so child sub-steps stay visible regardless. …_MAX_TOTAL_CHARS is a soft target for the whole section (not a hard cap — failed steps and the newest successful step are always kept, and notes are appended after the budget decision): digests fill newest-first; older successful steps evict with a "showing N of M" note. How many fit depends on the actual digest sizes; the current default aggregate target is 192 KiB. …_MAX_ESCALATIONS calls are newest-first, sequential fast-model calls and fire ~never on all-JSON workloads. Raise …_DIGEST_SCALAR_MAX so the planner sees longer salient values inline at plan time.

Migration (upgrading from pre-Phase-14): TRUVAG3_CONTINUATION_RESULT_MAX_CHARS previously truncated every completed-step result (raw, per-step). It now governs only the non-JSON floor preview — valid-JSON steps are digested and no longer honor it. The env var name and its default (10000) are unchanged, so no action is required; JSON steps simply render as structure-complete digests instead of raw 10 KB truncations. If a deployment relied on the old raw-truncation behavior for JSON results, there is no equivalent toggle — the digest path supersedes it.

Failed-operation prompt views

Environment setting	Default	Meaning
TRUVAG3_FAILED_OPERATION_VIEW_DISABLED	false	Disable the derived view; retain legacy failure rendering
TRUVAG3_FAILED_OPERATION_MAX_VALUE_BYTES	4096	Final encoded bytes per complete attempted input value
TRUVAG3_FAILED_OPERATION_MAX_STEP_BYTES	16384	Combined error/attempt/input view per failed step
TRUVAG3_FAILED_OPERATION_MAX_PROMPT_BYTES	32768	Combined failure views per continuation or built-in synthesis prompt

All numeric env settings are positive. Code zero means unset, negatives fail validation. Canonical orchestration strict/compatible env modes apply. WithFailedOperationView replaces the entire environment-resolved view config; omitted code fields resolve to defaults, not retained environment values. Continuation child ceilings cannot exceed the existing failure share; raising a child alone cannot bypass its parent. Final encoded child bytes and legacy pre-encoding parent bytes are reported separately. No new LLM calls are introduced. The per-error quarter-share is an internal allocation heuristic, not another operator limit: it reserves room for dispatch metadata and inputs.

The continuation failure share is min(ContinuationResultMaxChars, ContinuationResultMaxTotalChars / (failedCount + 1)) in legacy pre-encoding bytes (defaults 10,000 and 32,768). Each encoded view also has to fit its value/step/prompt ceilings; whole values or attempts are omitted with markers rather than cut into invalid JSON. Built-in synthesis has the child limits but no equivalent continuation parent share. Raw dispatch records are unchanged; these limits do not cap their storage size or retention.

Remediation Failure-Pattern Analyzer

Controls when and how a shared-error summary is embedded into the remediation continuation prompt that fires after template-induced skips.

What	Default	Env Var	With* Option
Min causal failures to emit pattern	2	TRUVAG3_FAILURE_PATTERN_MIN_FAILURES	—
Error-signature length (classification)	120	TRUVAG3_FAILURE_PATTERN_SIGNATURE_LEN	—
Error-signature length (display in prompt)	80	TRUVAG3_FAILURE_PATTERN_DISPLAY_LEN	—

The summary is emitted only when at least MIN_FAILURES distinct failed upstream steps share the same error signature. Classification length is intentionally wider than display length so two genuinely-different errors that share a common prefix are less likely to collide into the same bucket. The display length applies after classification — the rendered error is truncated with a trailing ….

Result Trimming (Large Data)

Note: All env vars below expect values in bytes (integers), not KB/MB strings. For example, 16 KB = 16384, 32 KB = 32768, 128 KB = 131072.

What	Default	Env Var	With* Option
Enabled	true	TRUVAG3_RESULT_TRIM_ENABLED	WithResultTrimming(bool, n)
Per-result max	65536 (64 KiB)	TRUVAG3_RESULT_TRIM_MAX_BYTES	WithResultTrimming(bool, n)
Total synthesis results	196608 (192 KiB)	TRUVAG3_RESULT_TRIM_MAX_TOTAL_BYTES	—
Micro-resolution source	65536 (64 KB)	TRUVAG3_RESULT_TRIM_MAX_MICRO_BYTES	—
Agent input per-param	0 (disabled)	TRUVAG3_RESULT_TRIM_MAX_AGENT_INPUT_BYTES	—
Schema mapping threshold	16384 (16 KB)	TRUVAG3_RESULT_TRIM_SCHEMA_MAPPING_THRESHOLD	—
Preserve keys	—	—	WithResultPreserveKeys(keys)
Degenerate-trim floor ([severely reduced] disclosure)	0.05 (5%)	— (degenerateKeptRatio, hardcoded const)	—
Array inventory cap	500 items	— (maxArrayInventoryItems, hardcoded const)	—

Agent input per-param defaults to 0 (no cap) — tool→tool data flows raw so downstream steps receive the full upstream output (fidelity-first). Set it > 0 to cap each parameter value, or supply deps.AgentInputProcessor for custom input shaping.

Hardcoded structural-trim floors (not env knobs, cf. maxWrapperShare under Distillation). degenerateKeptRatio (0.05): when a deterministic structural trim keeps under 5% of the source bytes, the result is treated as non-representative — it carries a [severely reduced … treat anything NOT shown as UNKNOWN] disclosure and sets degenerate/content_lost in the trim metadata, so the synthesizer can't misread a near-empty trim as "nothing there." LLM distillation output is exempt — a low kept-ratio there is deliberate selection, not loss. maxArrayInventoryItems (500): a nested array is inventoried to its first 500 items before whole-unit selection (an O(n·log n) guard for 10K+-item paginated results); items past 500 aren't candidates for keeping.

Result Distillation (Default-On LLM Summarization)

What	Default	Env Var	With* Option
Enabled	true	TRUVAG3_RESULT_DISTILL_ENABLED	WithResultDistill(bool, n)
Min size to trigger	16384 (16 KB)	TRUVAG3_RESULT_DISTILL_THRESHOLD	WithResultDistill(bool, n)
Pre-filter budget	131072 (128 KB)	TRUVAG3_RESULT_DISTILL_PREFILTER	—
Target output size	4096 (4 KB)	TRUVAG3_RESULT_DISTILL_TARGET	—
Model override	fast	TRUVAG3_RESULT_DISTILL_MODEL	WithResultDistillModel(m)
Cache TTL	5m	TRUVAG3_RESULT_DISTILL_CACHE_TTL	—
Compaction deadline	45s	TRUVAG3_RESULT_DISTILL_DEADLINE	—
Map-reduce trigger (model context)	150000 tokens	TRUVAG3_RESULT_DISTILL_CONTEXT_TOKENS	—
Map-reduce trigger (bytes)	0 = disabled	TRUVAG3_RESULT_DISTILL_MAPREDUCE_THRESHOLD	—
Map-reduce concurrency	8	TRUVAG3_RESULT_DISTILL_MAP_CONCURRENCY	—
Max wrapper share (hardcoded const)	0.5	— (maxWrapperShare, not an env knob)	—

Default-on (opt-out): distillation is the primary compaction path for oversized results when the orchestrator has an AIClient and Result Trimming is enabled (both true by default). Without an AIClient it falls back to the structural floor. Opt out with TRUVAG3_RESULT_DISTILL_ENABLED=false. Caching is opt-in: distillation results are cached only when a DigestCache is supplied via deps.DistillCache (no cache by default); CacheTTL=0 does not reliably disable it (a Redis-backed cache treats 0 as "no expiration") — to disable, don't supply a cache.

Migration (upgrading from pre-default-on): result distillation was previously off by default (Enabled: false, threshold 32768, pre-filter 32768). It is now on by default (threshold 16384, pre-filter 131072), so a deployment with an AIClient configured will begin making fast-model distillation calls for oversized results — added cost/latency on the cheap (fast) tier; the structural-trim floor was the prior behavior. No code change is required; set TRUVAG3_RESULT_DISTILL_ENABLED=false to restore the structural-only path.

Units are mixed in this section: byte budgets (THRESHOLD, PREFILTER, TARGET) are integers in bytes; CACHE_TTL / DEADLINE are Go durations (e.g. 5m, 45s) and accept only positive values via env — disable the deadline with the programmatic CompactionDeadline: 0; CONTEXT_TOKENS is in tokens (results estimated above it — ~525 KB at the default 150000, using the framework's ≈3.5 bytes/token counter — are chunked → map-reduced); MAPREDUCE_THRESHOLD is in bytes and routes results larger than it to map-reduce independently of CONTEXT_TOKENS, with 0 meaning disabled and a value below PREFILTER ignored (a result that small is one chunk — no fan-out benefit); MAP_CONCURRENCY is a count. maxWrapperShare (0.5) is a hardcoded internal ratio (not an env knob, cf. degenerateKeptRatio): when a map-reduce object's non-array wrapper exceeds half a chunk, the chunker byte-splits the raw serialization (lossless byte-wise) instead of replicating the heavy wrapper into every chunk.

Tiered Capability Resolution

What	Default	Env Var	With* Option
Enabled	true	TRUVAG3_TIERED_RESOLUTION_ENABLED	WithTieredResolution(bool)
Min tools to trigger	20	TRUVAG3_TIERED_MIN_TOOLS	—
Selection max tokens	2000	TRUVAG3_TIERED_SELECTION_MAX_TOKENS	WithTieredSelectionMaxTokens(n)

Retry Budgets

Layer	Default	Env Var	With* Option
Plan parse retry	2	TRUVAG3_PLAN_RETRY_MAX	WithPlanParseRetry(bool, n)
Hallucination retry	1	TRUVAG3_HALLUCINATION_MAX_RETRIES	WithHallucinationRetry(bool, n)
Semantic retry (Layer 4)	2	TRUVAG3_SEMANTIC_RETRY_MAX_ATTEMPTS	—
Analyzer / legacy parameter-correction budget	2	None	ExecutionOptions.MaxValidationRetries; direct SetValidationFeedback(enabled, n). Analyzer and Layer 4 share the step's validationRetries counter, with their respective ceilings; these are not independent additive retry allowances.
Step execution attempts	3 total (1 initial + 2 retries)	TRUVAG3_STEP_RETRY_MAX_ATTEMPTS	ExecutionOptions.RetryAttempts; direct SmartExecutor.SetMaxAttempts(n)
AI provider retry (NewClient / NewRequestClient)	3	TRUVAG3_AI_RETRY_ATTEMPTS (only positive values apply)	ai.WithMaxRetries(n); explicit 0 disables
AI provider retry (legacy NewChainClient)	0 per provider (avoids multiplying provider retries and ordered failover attempts)	TRUVAG3_AI_RETRY_ATTEMPTS (only positive values apply)	ai.WithChainMaxRetries(n); explicit 0 disables
AI provider retry (heterogeneous NewChain ProviderEntry)	3 per independently constructed entry	TRUVAG3_AI_RETRY_ATTEMPTS (only positive values apply)	ai.WithMaxRetries(n) on each entry; explicit 0 disables
AI provider retry (heterogeneous NewChain ClientEntry)	Caller-owned client behavior	Caller-owned	Configure the injected client
AI provider initial retry delay	1s, then exponential backoff	TRUVAG3_AI_RETRY_DELAY (positive Go duration)	AIConfig.RetryDelay; HTTP 429/503, or eligible decoded semantic 429/503 in ai/providers/openai and its registered aliases, may increase it with Retry-After. One shared budget covers HTTP and decoded retries in adopting adapters; direct Azure remains transport-only. Each wait ends at the earlier caller deadline or absolute wait cap (positive HTTP-client timeout, otherwise the 180s framework fallback); this cap does not cancel a successful streaming response's transport context

Credible OpenRouter HTTP/in-body 408 timeouts use the same existing provider attempt budget and remain normalized as 408. They can fail over if another chain entry exists. Zero local retries, caller cancellation, caller/provider-call deadline expiration, stream no-replay and conservative terminal/unknown-type policies still apply. Other compatible aliases' 408 behavior is unchanged; no new operational limit is added. The chain treats a returned context.DeadlineExceeded as terminal even when it comes from the provider's own call timeout and the outer caller remains active. This differs from an eligible provider-returned 408 with an active attempt context.

Tool-step refusal wins over budgets: explicit retryable:false stops every same-step resend. Transport/408/429/5xx retry unchanged; only eligible non-transient 4xx reaches parameter correction, with no unchanged 4xx resend. HITL/exact-bound inputs remain protected from correction. Ordinary approved steps can still be resent unchanged on eligible transient failures; approval does not guarantee exactly-once side effects. Delegated orchestrator capabilities remain one physical dispatch regardless of the ordinary step budget. Read DispatchCount/Dispatches for physical calls, not the legacy Attempts counter.

Malformed replacements within initial unknown-agent recovery share the hallucination retry budget above. Their next correction reuses the selected catalog and receives the latest parse/intent error; it does not start the plan-parse budget or a new tier selection. The existing phase-level fallback regeneration can still follow a generation failure. These per-layer limits are not a single whole-request model-call cap. Continuation unknown-agent recovery makes one regeneration attempt; failure returns the original unknown-agent error. Outer phase fallback regeneration may still follow, subject to context and preparation gates. Parse or intent failures inside validation regeneration consume validation rounds, not a separate parse-retry allowance.

Circuit Breaker

These are core.Config declaration defaults. The env names below are struct tags only, not runtime overrides read by core or the standalone resilience module. They do not configure an orchestration executor or an AI chain breaker; use the owning component's programmatic configuration.

What	Default	Env Var	With* Option
Enabled	false	TRUVAG3_CB_ENABLED	—
Failure threshold	5	TRUVAG3_CB_THRESHOLD	—
Recovery timeout	30s	TRUVAG3_CB_TIMEOUT	—
Half-open requests	3	TRUVAG3_CB_HALF_OPEN	—

Resilience

Likewise, these core-config env declarations are not parsed runtime controls. They are distinct from the implemented retry budgets above.

What	Default	Env Var	With* Option
Retry max attempts	3	TRUVAG3_RETRY_MAX_ATTEMPTS	—
Retry initial interval	1s	TRUVAG3_RETRY_INITIAL_INTERVAL	—
Retry max interval	30s	TRUVAG3_RETRY_MAX_INTERVAL	—
Retry multiplier	2.0	TRUVAG3_RETRY_MULTIPLIER	—
Default timeout	30s	TRUVAG3_TIMEOUT_DEFAULT	—
Max timeout	5m	TRUVAG3_TIMEOUT_MAX	—

HTTP Server

What	Default	Env Var	With* Option
Read timeout	300s	TRUVAG3_HTTP_READ_TIMEOUT	—
Write timeout	35m	TRUVAG3_HTTP_WRITE_TIMEOUT	—
Idle timeout	120s	TRUVAG3_HTTP_IDLE_TIMEOUT	—
Max header bytes	1 MB	TRUVAG3_HTTP_MAX_HEADER_BYTES	—
Shutdown timeout	10s	TRUVAG3_HTTP_SHUTDOWN_TIMEOUT	Built-in agents/tools join one HTTP drain using its configured budget independently of caller deadlines/cancellation. Each caller can cancel its own wait; Start still joins the drain. Positive env duration required; zero typed config selects default, negative fails. Timeout is returned, not forced handler termination.

Framework Runnable Lifecycle

What	Default	Env Var	With* Option
Runnable drain timeout	10s	TRUVAG3_FRAMEWORK_RUNNABLE_DRAIN_TIMEOUT	—

Maximum time Framework.Run waits for registered core.Runnable instances to honour ctx.Done() and exit after ctx is cancelled. After this, the framework logs a warning, returns, and the OS reaps any remaining goroutines on process exit. Go duration format; only positive values are honored.

Memory (in-process *core.MemoryStore)

What	Default	Env Var	With* Option
Sweeper interval	10m	TRUVAG3_MEMORY_CLEANUP_INTERVAL	—

Sweep interval for the in-process eviction sweeper used by Framework.AutoRegisterMemorySweeper() (agents) and core.NewMemoryStoreSweeper(...) (tools). Bounds memory at (active entries) + (entries that expired since the last sweep tick). Go duration format; only positive values are honored. The framework only ships one Memory implementation today (*core.MemoryStore); TRUVAG3_MEMORY_PROVIDER and TRUVAG3_MEMORY_REDIS_URL are no longer parsed.

Discovery

What	Default	Env Var	With* Option
Cache TTL	5m	TRUVAG3_DISCOVERY_CACHE_TTL	—
Heartbeat interval	10s	TRUVAG3_DISCOVERY_HEARTBEAT	—
Registration TTL	30s	TRUVAG3_DISCOVERY_TTL	—

Shared Memory

What	Default	Env Var	With* Option
Domain stream max length	100000	TRUVAG3_SHARED_MEMORY_STREAM_MAXLEN	—
Investigation claim TTL	30m	TRUVAG3_SHARED_MEMORY_INVESTIGATION_TTL	—
Event lookback window	24h	None	WithMemoryLookback(d) (builder) / WithEnrichmentLookback(d) (direct); positive duration
Enrichment view budget (4 encoded bytes/token)	2000 (8000 bytes)	TRUVAG3_SHARED_MEMORY_ENRICHMENT_MAX_TOKENS	WithEnrichmentMaxTokens(n) (direct hook)
Recent events limit	20	TRUVAG3_SHARED_MEMORY_RECENT_EVENTS_LIMIT	WithEnrichmentRecentEventsLimit(n)
Summarizer model override	—	TRUVAG3_SHARED_MEMORY_SUMMARIZER_MODEL	WithSummarizerModel(m)
Event summary output tokens per call	10000	TRUVAG3_SHARED_MEMORY_EVENT_SUMMARIZER_MAX_TOKENS	WithSummarizerMaxTokens(n)
Stored event-summary prose per entry	1024 bytes	TRUVAG3_SHARED_MEMORY_EVENT_SUMMARIZER_SUMMARY_MAX_BYTES	WithSummarizerSummaryMaxBytes(n); minimum 32; rune-safe explicit shortening; exact entities/raw debug preserved
Event summary tokens per admitted step	150, with 300-token call floor	None	WithSummarizerTokensPerStep(n); positive; a fixed max-tokens override wins
Event summary admitted steps per call	20	None	WithSummarizerMaxStepsPerBatch(n); positive; excess steps use heuristic fallback, not extra batches
Event summary invocation timeout	2m	TRUVAG3_SHARED_MEMORY_EVENT_SUMMARIZER_TIMEOUT	WithSummarizerTimeout(d); positive; earlier parent deadline wins
Event summary input payload per step (encoded failure facts + response)	4000 bytes	TRUVAG3_SHARED_MEMORY_EVENT_SUMMARIZER_MAX_RESPONSE_BYTES	WithSummarizerMaxResponseChars(n) (legacy name; bytes)
Stored heuristic failure cause (code or error text; UTF-8 safe)	256 bytes, plus framing and explicit shortening marker	TRUVAG3_SHARED_MEMORY_RECORD_FAILURE_CAUSE_MAX_BYTES	WithRecordFailureCauseMaxBytes(n); positive only; source errors and model/custom summaries unchanged
Compaction digest requested output length	500 tokens	TRUVAG3_SHARED_MEMORY_ENRICHMENT_SUMMARY_MAX_TOKENS	WithCompactionMaxTokens(n)
Built-in compactor generation allowance (AIOptions.MaxTokens)	2500 tokens (5 × digest target)	Derived from the preceding setting	No independent control
Compaction raw event limit	200	TRUVAG3_SHARED_MEMORY_COMPACTION_RAW_LIMIT	WithCompactionRawLimit(n)
Compaction recent detail	15	TRUVAG3_SHARED_MEMORY_COMPACTION_RECENT_DETAIL	WithCompactionRecentDetail(n)
Digest cache TTL	5m	TRUVAG3_SHARED_MEMORY_DIGEST_CACHE_TTL	WithDigestCacheTTL(d)
Digest incremental threshold	20	TRUVAG3_SHARED_MEMORY_DIGEST_INCREMENTAL_THRESHOLD	WithIncrementalThreshold(n)

The digest target is a prompt instruction, not a tokenizer-enforced length. Both full and incremental built-in compaction request five times that target as their generation allowance; provider reasoning-budget translation may further change the wire value. The final enrichment view has its own encoded byte budget. The internal activityCompactionGenerationMultiplier is fixed at 5 and pinned by regression tests. Built-in compaction accepts positive targets through math.MaxInt / 5 (the platform's Go int range), rejecting larger values instead of wrapping or clamping. A hook selecting the built-in compactor checks this at construction; direct non-empty calls check before AI invocation. Custom compactors retain their own generation-budget rules. This arithmetic bound is not a provider output-capacity guarantee.

Episodic Redis retrieval uses internal batches of 256 references/GETs. This is transport chunking, not an event-count cap: all retained candidates are examined before selecting the newest visible EventFilter.Limit events. Retention remains controlled by TRUVAG3_SHARED_MEMORY_STREAM_MAXLEN; changing the batch size does not change query eligibility or ordering.

Digest reuse covers the bounded returned window, not unlimited history. The raw event limit also bounds stored event fingerprints. Lookback, raw limit and digest output-token target invalidate incompatible cached windows. An unchanged limited window needs zero compaction calls; edits, expiry or displacement rebaseline it. The digest TTL alone does not extend the event lookback. Observed-read failures leave the cache untouched; readers without read-health observation and external custom compactors without the built-in private fingerprint contract bypass reuse. There is no public custom-compactor fingerprint option. No new cursor-size or query scan cap is introduced.

At the core.Config boundary, numeric shared-memory/activity settings now fail startup on invalid explicit values, even with the optional feature disabled. Absent settings retain documented defaults; compaction recent detail permits zero. File/typed configuration is validated too. The hook builder also validates all hook-owned numeric environment settings before checking optional dependencies. Backend wiring and deployment preflight remain separate from configuration validation. Convenience construction validates backend-owned settings before I/O; direct constructors use their explicit options instead of reading env.

Investigation TTL is advisory expiry, not a requirement to cover HITL waiting: managed requests release claims on suspension and resume acquires fresh claims. A zero per-acquisition TTL selects the provider default; negative is invalid. Lookback, stream retention, digest TTL, claim TTL and activity TTL are independent. Finite knowledge-retrieval weights may be signed or zero and need not sum to 1; non-finite values fail validation. These weights have programmatic options, not new environment variables.

The enrichment-view setting is read at startup by BuildMemoryHooks, with or without an AI client. Unset uses 2000; invalid, empty, non-positive or overflowing values fail construction. Direct hook construction rejects invalid values. The byte budget includes scope, headings, JSON escaping and count markers; it excludes other hooks' existing RAG context. Complete records are admitted in existing section order, with explicit shortening/omission rather than cutting JSON mid-record. This is an approximate prompt-view limit, not a model output budget; compactor inputs and generation allowance remain separate.

The event-summary override is a positive, fixed per-call allowance, not a per-step multiplier or an input/context limit. BuildMemoryHooks reads it at startup; unset preserves the calculated default. Invalid explicit values fail construction, including without an AI client. Direct construction uses WithSummarizerMaxTokens(n) and rejects non-positive values. This setting is separate from synthesis and enrichment/compaction budgets.

User Memory

What	Default	Env Var	With* Option
Max facts in prompt	15	TRUVAG3_USER_MEMORY_MAX_FACTS_IN_PROMPT	—
Max identity facts	5	TRUVAG3_USER_MEMORY_MAX_IDENTITY_FACTS	—
Max durable facts in prompt	8	TRUVAG3_USER_MEMORY_MAX_DURABLE_FACTS_IN_PROMPT	—
Max transient facts in prompt	4	TRUVAG3_USER_MEMORY_MAX_TRANSIENT_FACTS_IN_PROMPT	—
Max summary facts in prompt	3	TRUVAG3_USER_MEMORY_MAX_SUMMARY_FACTS_IN_PROMPT	—
Max stable facts per category	2	TRUVAG3_USER_MEMORY_MAX_STABLE_FACTS_PER_CATEGORY	—
Max universal facts	5	TRUVAG3_USER_MEMORY_MAX_UNIVERSAL_FACTS	—
Min confidence threshold	0.3	TRUVAG3_USER_MEMORY_MIN_CONFIDENCE	—
Reconciliation similarity	0.75	TRUVAG3_USER_MEMORY_RECONCILIATION_THRESHOLD	—
Extraction model	agent default	TRUVAG3_USER_MEMORY_EXTRACTION_MODEL	—
Reconciliation model	extraction model	TRUVAG3_USER_MEMORY_RECONCILIATION_MODEL	—
Summary response truncation	500 chars	TRUVAG3_USER_MEMORY_SUMMARY_MAX_RESPONSE_LEN	—
Batched reconciliation tokens per candidate	400 (floor 500)	TRUVAG3_USER_MEMORY_BATCH_TOKENS_PER_CANDIDATE	—
Recall over-fetch multiplier	3	TRUVAG3_USER_MEMORY_RECALL_OVERFETCH_MULTIPLIER	—
Transient max age	168h	TRUVAG3_USER_MEMORY_TRANSIENT_MAX_AGE_HOURS	—
Max split clauses	3	TRUVAG3_USER_MEMORY_MAX_SPLIT_CLAUSES	—
Vector DB collection	truvag3_user_memory	TRUVAG3_USER_MEMORY_COLLECTION	WithUserMemoryVectorOption(WithCollectionName(s))
Extraction logic	LLM-based	—	WithUserFactExtractor(e)
Reconciliation logic	LLM-based (batched when reconciler implements BatchUserFactReconciler)	—	WithUserFactReconciler(r)
Persistence policy	framework default	—	WithUserFactPersistencePolicy(p)
Retrieval weights	0.20/0.50/0.30	—	WithUserMemoryRetrievalWeights(w)
Extraction mode	async at Layer 1 preset	—	WithSynchronousExtraction()

Reflection Job (Tier 2 → Tier 3 Bridge)

What	Default	Env Var	With* Option
Pass interval	24h	TRUVAG3_REFLECTION_INTERVAL	—
Event age threshold	168h (7d)	TRUVAG3_REFLECTION_AGE_THRESHOLD	—
Min events per entity	5	TRUVAG3_REFLECTION_MIN_EVENTS	WithReflectorMinEvents(n)
LLM model override	agent default	TRUVAG3_REFLECTION_MODEL	WithReflectorModel(m)
Distributed lock	from deps.Lock	—	WithReflectionLock(l)
Telemetry provider	nil	—	WithReflectionTelemetry(t)

Activity Coordination

What	Default	Env Var	With* Option
Enabled	true	TRUVAG3_ACTIVITY_COORDINATION_ENABLED	—
Signal TTL	5m	TRUVAG3_ACTIVITY_SIGNAL_TTL	WithAnnouncementSignalTTL(d)
Max signals in prompt	10	TRUVAG3_ACTIVITY_SIGNAL_MAX_IN_PROMPT	—
Query prefix length	200 bytes, plus ... if shortened	TRUVAG3_ACTIVITY_SIGNAL_QUERY_MAX_LEN	WithAnnouncementQueryMaxLen(n); legacy byte slicing, not a rune count

Managed requests renew activity at one-third of the effective signal TTL. Each submission is bounded by min(TTL/3, execution cleanup timeout); activity removal and investigation cleanup share the execution-cleanup budget. This does not extend request/step/model timeouts or renew investigation claims.

Built-in Telemetry Provider Defaults

Behavior	Current value	Configuration boundary
Trace sampler	AlwaysSample (100% in every profile)	Explicit provider choice; profile selection and OTEL_TRACES_SAMPLER / OTEL_TRACES_SAMPLER_ARG do not change it
Metric export interval	30 seconds	Fixed in NewOTelProvider's periodic reader
Empty provider endpoint	localhost:4318	Initialize(Config) / direct constructor use the supplied endpoint; application bootstrap resolves its endpoint environment values
Emitting-instance identity	UUID v4 per provider lifetime	Non-empty Config.ServiceInstanceID / WithServiceInstanceID > TRUVAG3_TELEMETRY_SERVICE_INSTANCE_ID > generated UUID; explicit identities must differ across concurrent emitters

TRUVAG3_TELEMETRY_SAMPLING_RATE has no current reader or field. Metric emission sampling through WithSampleRate is separate from trace sampling. Profiles do not install payload sanitization; legacy redaction fields are not consumed by the metric/trace emission path. See the telemetry configuration contract.

Correlation and W3C Baggage

What	Limit	Configuration
Conversation ID	512 bytes, non-empty visible-ASCII W3C-safe subset	Protocol invariant: core.MaxConversationIDLength
Baggage members	64	telemetry.MaxBaggageItems
Baggage key	128 bytes	telemetry.MaxBaggageKeyLength
Baggage value	512 bytes	telemetry.MaxBaggageValueLength
Complete serialized baggage header	8192 bytes	telemetry.MaxBaggageTotalSize

The 8192-byte limit covers the complete serialized W3C baggage value, including separators, encoding, and member properties. WithBaggage applies member limits per candidate and keeps its truncation/silent-drop contract. WithBaggageExact never truncates and rejects the candidate atomically with a typed bounded reason.

Debug Stores

What	Default	Env Var	With* Option
LLM debug enabled	false	TRUVAG3_LLM_DEBUG_ENABLED	WithLLMDebug(bool)
LLM debug TTL	72h (3 days)	TRUVAG3_LLM_DEBUG_TTL	WithLLMDebugTTL(d)
LLM debug error TTL	72h (3 days)	TRUVAG3_LLM_DEBUG_ERROR_TTL	WithLLMDebugErrorTTL(d)
Execution store enabled	false	TRUVAG3_EXECUTION_DEBUG_STORE_ENABLED	—
Execution store TTL	72h (3 days)	TRUVAG3_EXECUTION_DEBUG_TTL	WithExecutionStoreTTL(d)
Execution store error TTL	72h (3 days)	TRUVAG3_EXECUTION_DEBUG_ERROR_TTL	WithExecutionStoreErrorTTL(d)
Conversation execution query limit	1000	TRUVAG3_EXECUTION_DEBUG_CONVERSATION_QUERY_LIMIT	ExecutionStoreConfig.ConversationQueryLimit
Conversation index scan limit	5000	TRUVAG3_EXECUTION_DEBUG_INDEX_SCAN_LIMIT	ExecutionStoreConfig.ConversationIndexScanLimit

Both conversation store limits accept positive integers. A request-level lookup limit is additionally clamped to ConversationQueryLimit; stale-member work never exceeds ConversationIndexScanLimit.

Agent Skills

See the Agent Skills Guide for how these authoring and runtime limits affect progressive disclosure in practice.

Runtime disclosure

The global precedence statement at the top has one deliberate skills exception: when present, TRUVAG3_SKILLS_ENABLED and TRUVAG3_SKILL_BINDINGS_JSON override code options and define deployment-wide eligibility. Other skill environment values fill only code fields left unset.

What	Default / Limit	Environment	Programmatic Override
Skills enabled	false	TRUVAG3_SKILLS_ENABLED	WithSkills(SkillConfig{Enabled: ...})
Complete binding list	empty; max 32	TRUVAG3_SKILL_BINDINGS_JSON (complete replacement)	WithSkills / SkillConfig.Bindings
Domain compatibility	warn	TRUVAG3_SKILL_DOMAIN_COMPATIBILITY_MODE	SkillConfig.DomainCompatibilityMode
Auto candidates	16	TRUVAG3_SKILL_MAX_AUTO_CANDIDATES	SkillConfig.Limits.MaxAutoCandidates
Activation catalog	2000 tokens	TRUVAG3_SKILL_CATALOG_TOKEN_BUDGET	SkillConfig.Limits.CatalogTokenBudget
Active skills	6	TRUVAG3_SKILL_MAX_ACTIVE_SKILLS	SkillConfig.Limits.MaxActiveSkills
Main / resource / total tokens	6144 / 4096 / 8192	TRUVAG3_SKILL_MAIN_TOKEN_BUDGET, TRUVAG3_SKILL_RESOURCE_TOKEN_BUDGET, TRUVAG3_SKILL_TOTAL_TOKEN_BUDGET	SkillConfig.Limits
Resource candidates	32	TRUVAG3_SKILL_MAX_RESOURCE_CANDIDATES	SkillConfig.Limits.MaxResourceCandidates
Resource catalog	2000 tokens	TRUVAG3_SKILL_RESOURCE_CATALOG_TOKEN_BUDGET	SkillConfig.Limits.ResourceCatalogTokenBudget
Resources per phase / execution	2 / 8	TRUVAG3_SKILL_MAX_RESOURCES_PER_PHASE, TRUVAG3_SKILL_MAX_RESOURCES_PER_EXECUTION	SkillConfig.Limits
Selector output	512 tokens	TRUVAG3_SKILL_RESOLUTION_MAX_TOKENS	SkillConfig.Limits.ResolutionMaxTokens
Synthesis skill projection	6000 tokens	TRUVAG3_SKILL_SYNTHESIS_TOKEN_BUDGET	SkillConfig.Limits.SynthesisTokenBudget
Effective-input allowance	disabled (0); skills use at most 10% when set	TRUVAG3_SKILL_EFFECTIVE_INPUT_TOKEN_BUDGET	SkillConfig.Limits.EffectiveInputTokenBudget
Registry operation timeout	5s	TRUVAG3_SKILL_REGISTRY_READ_TIMEOUT	SkillConfig.Limits.RegistryReadTimeout
Resource AI attempt timeout	0s (inherit parent)	TRUVAG3_SKILL_RESOURCE_SELECTION_ATTEMPT_TIMEOUT	SkillConfig.Limits.ResourceSelectionAttemptTimeout; resource v2 only, two attempts total
Immutable content cache	local, 16 MiB	TRUVAG3_SKILL_CACHE_MODE, TRUVAG3_SKILL_CACHE_MAX_BYTES	SkillConfig.Cache / WithSkillContentCache
Selector guidance	4096 bytes and 512 estimated tokens	TRUVAG3_SKILL_ACTIVATION_GUIDANCE_FILE, TRUVAG3_SKILL_RESOURCE_GUIDANCE_FILE	WithSkillPromptGuidance
Runtime policy ID	128 bytes	none (code-only)	SkillConfig.RuntimePolicyID
Trusted explicit activations / resource requests	32 / 32	none	WithTrustedSkillActivations / WithTrustedSkillResourceRequests
Expected capability hints	32 values, 128 bytes each	none	WithSkillExpectedCapabilities

The selector temperature (0.01), deliberately unset provider-native response format, strict JSON body validation, two-attempt ceiling, framework prompts, and reserved prompt tags are fixed contracts. Resource v2 accepts a complete outer JSON/unlabelled fence and retries child-attempt timeout within that ceiling; activation retains malformed-answer-only retry. Parent cancellation is terminal. The resource attempt timeout is tunable; zero inherits the caller. Selectors leave response format unset because provider wire values differ; the prompt/parser/retry path supplies the portable structured-output contract. The legacy AI-client adapter cannot represent an explicitly set zero generation value, which is why V1 uses the non-zero low temperature. Request-aware clients remain the recommended path.

Authoring and management

What	Default / Limit	Host Override
Namespace/name/domain/tag/resource slugs / description	64 / 1024 characters	SkillAuthoringLimits
Manifest	5000 tokens and 24 KiB	SkillAuthoringLimits
One resource	8000 tokens and 32 KiB	SkillAuthoringLimits
Resources / package	32 / 1 MiB	SkillAuthoringLimits
Validation-rule diagnostics	64 maximum	Fixed framework contract
Diagnostic code / path / message	64 / 256 / 1024 bytes	Fixed framework contract
Advisor findings / patches / summary	16 / 16 / 2048 bytes	Fixed framework contract
Delete range	100 versions	SkillAdministrationLimits.MaxDeleteVersions
Idempotency key / audit reason / actor	256 / 1024 / 256 bytes	Fixed wire contract
Package change_reason	1024 UTF-8 bytes	Fixed audit contract
Resource content types	text/plain, text/markdown	Fixed V1 contract
Protected deletion set	published and published−1	Fixed safety contract

Authoring also emits quality warnings before the hard limits at 320 description characters, 2,500 manifest tokens, 4,000 tokens per resource, 12 resources, 256 KiB per package, or 3,000 combined instruction tokens. Warnings do not silently rewrite or reject a package; errors enforce the hard limits above.

The included Redis role uses the shared versioned DB-0 keyspace. TRUVAG3_SKILLS_REDIS_DB is removed and rejected for the selected skills role; canonical orchestration runtime depends only on the provider-neutral skill interfaces.

Capability Provider (Service Mode)

What	Default	Env Var	With* Option
Top-K results	20	TRUVAG3_CAPABILITY_TOP_K	—
Similarity threshold	0.7	TRUVAG3_CAPABILITY_THRESHOLD	—

Human-in-the-Loop (HITL)

What	Default	Env Var	With* Option
Enabled	false	TRUVAG3_HITL_ENABLED	—
Require plan approval	false	TRUVAG3_HITL_REQUIRE_PLAN_APPROVAL	—
Default timeout action	reject	TRUVAG3_HITL_DEFAULT_ACTION	—
Expiry claim lease	30s	TRUVAG3_HITL_EXPIRY_CLAIM_LEASE	WithCheckpointExpiryRuntimeConfig(config)
Expiry claim owner identifier	128 characters maximum	— (maxCheckpointClaimOwnerLen)	WithCheckpointExpiryOwner(owner)
Resume ownership lease	30s; accepts 3s–24h	TRUVAG3_HITL_RESUME_CLAIM_LEASE	ResumeCoordinatorRuntimeConfig.ClaimLease
Resume finalization/release timeout	5s; positive, at most 1m and lease/3	TRUVAG3_HITL_RESUME_CLEANUP_TIMEOUT	ResumeCoordinatorRuntimeConfig.CleanupTimeout
Resume owner identifier	Generated per process; 128 bytes maximum	—	WithResumeOwner(owner)

Resume environment settings are read by the explicit LoadResumeCoordinatorRuntimeConfigFromEnvironment loader. The coordinator constructor validates its supplied config without reading environment variables. The resume lease is separate from the human approval timeout and checkpoint retention. Renewing ownership does not extend storage TTL.

The expiry claim-owner cap is a coordination-protocol invariant: bounded owner values keep backend claim records and diagnostic dimensions predictable. It is validated at the 128/129-character boundary and is intentionally not an operator-tunable deployment limit.

---

Common Tuning Scenarios

Complex multi-tool requests (truncation issues):

export TRUVAG3_PLAN_MAX_TOKENS=60000
export TRUVAG3_TIERED_SELECTION_MAX_TOKENS=3000
export TRUVAG3_SYNTHESIS_MAX_TOKENS=40000

Event-summary invocation budget

Setting	Default	Owner and effect
TRUVAG3_SHARED_MEMORY_EVENT_SUMMARIZER_TIMEOUT	2m	BuildMemoryHooks → builtin summarizer; bounds AI invocation, not subsequent memory writes
WithSummarizerTimeout	2m	Direct constructor alternative; explicit duration must be positive
WithSummarizerMaxStepsPerBatch	20	Existing direct constructor option; excess steps use heuristic summaries

The earlier of the invocation and parent deadlines applies. Child timeout permits heuristic recording on the live parent; parent cancellation does not. The deadline does not increase output-token caps, phase limits or provider retry budgets.

Micro-resolution / semantic-retry truncation (unresolved templates in long text fields, or a semantic-retry correction whose parameters include a large text payload):

export TRUVAG3_MICRO_RESOLUTION_MAX_TOKENS=4000

Large API responses (data overflow):

export TRUVAG3_RESULT_TRIM_MAX_BYTES=131072
export TRUVAG3_RESULT_TRIM_MAX_TOTAL_BYTES=262144
export TRUVAG3_RESULT_TRIM_MAX_MICRO_BYTES=131072

Activity compaction too slow (high event volume):

# Reduce events sent to compactor
export TRUVAG3_SHARED_MEMORY_COMPACTION_RAW_LIMIT=100
# Cache digests longer to reduce LLM calls
export TRUVAG3_SHARED_MEMORY_DIGEST_CACHE_TTL=10m
# Lower threshold for incremental updates
export TRUVAG3_SHARED_MEMORY_DIGEST_INCREMENTAL_THRESHOLD=10

Disable shared memory LLM calls (cost control):

# Use raw events instead of compacted digest (no LLM call)
export TRUVAG3_SHARED_MEMORY_RECENT_EVENTS_LIMIT=15
# Agent code: omit WithActivityCompactor() from enrichment hook