Configuration reference

This page is generated from configured source reads and flag registrations. The gate compares generated text with the checked-in page, so drift fails until regeneration.

Configuration policy: DSN values, credential files, secret references and API key paths are bootstrap-only inputs. Runtime operational settings, telemetry, feedback, jobs, audit and metrics rollups belong in Postgres suite through versioned migrations and audited edits, not in env vars, files or ad-hoc local state.

Sources: acumen:cmd/acumen/main.go, acumen:cmd/acumen/custody.go, cli:internal/cli/app.go, cli:internal/cli/cmds_auth.go, cli:internal/cli/cmds_studio.go, cli:internal/cli/cmds_misc.go, cli:internal/config/config.go, cli:cmd/tcp-mcp/main.go.

Bootstrap-only inputs

Pass these only for process bootstrap, credential references or local client setup. Do not treat them as a runtime configuration system.

Flags

Flag	Class	Read at
-auth-oidc-client-secret-file	bootstrap-only	acumen:cmd/acumen/main.go:144
-dsn	bootstrap-only	acumen:cmd/acumen/main.go:138
-kek-env	bootstrap-only	acumen:cmd/acumen/custody.go:30
-kek-file	bootstrap-only	acumen:cmd/acumen/custody.go:29
--acumen-key-file	bootstrap-only	cli:internal/cli/app.go:112
--acumen-url	bootstrap-only	cli:internal/cli/app.go:106
--config	bootstrap-only	cli:internal/cli/app.go:104
--eve-key-file	bootstrap-only	cli:internal/cli/app.go:113
--eve-url	bootstrap-only	cli:internal/cli/app.go:108
--issuer	bootstrap-only	cli:internal/cli/app.go:109
--status-url	bootstrap-only	cli:internal/cli/app.go:107
--studio-url	bootstrap-only	cli:internal/cli/app.go:105
--timeout	bootstrap-only	cli:internal/cli/app.go:111
--transport	bootstrap-only	cli:internal/cli/app.go:110
--token-file	bootstrap-only	cli:internal/cli/cmds_auth.go:100

Environment / file bootstrap inputs

Input	Class	Read at
TCP_ACUMEN_URL	bootstrap-only	cli:internal/config/config.go:134
TCP_AUDIENCE	bootstrap-only	cli:internal/config/config.go:140
TCP_CLIENT_ID	bootstrap-only	cli:internal/config/config.go:139
TCP_CONFIG	bootstrap-only	cli:internal/config/config.go:86
TCP_CONSOLE_URL	bootstrap-only	cli:internal/config/config.go:137
TCP_ISSUER	bootstrap-only	cli:internal/config/config.go:138
TCP_SCOPES	bootstrap-only	cli:internal/config/config.go:143
TCP_SEARCH_URL	bootstrap-only	cli:internal/config/config.go:136
TCP_STATUS_URL	bootstrap-only	cli:internal/config/config.go:135
TCP_STUDIO_KEY_FILE	bootstrap-only	cli:internal/config/config.go:142
TCP_STUDIO_URL	bootstrap-only	cli:internal/config/config.go:133
TCP_TOKEN_FILE	bootstrap-only	cli:internal/config/config.go:141
XDG_CONFIG_HOME	bootstrap-only	cli:internal/config/config.go:62
XDG_STATE_HOME	bootstrap-only	cli:internal/config/config.go:74
TCP_ACUMEN_KEY_FILE	bootstrap-only	cli:internal/cli/app.go:178
TCP_EVE_KEY_FILE	bootstrap-only	cli:internal/cli/app.go:181
TCP_EVE_URL	bootstrap-only	cli:internal/cli/app.go:168
TCP_JSON	bootstrap-only	cli:internal/cli/app.go:186
TCP_NON_INTERACTIVE	bootstrap-only	cli:internal/cli/app.go:172
TCP_MCP_ADDR	bootstrap-only	cli:cmd/tcp-mcp/main.go:45
TCP_MCP_ALLOW_ANONYMOUS	bootstrap-only	cli:cmd/tcp-mcp/main.go:48
TCP_MCP_AUDIENCE	bootstrap-only	cli:cmd/tcp-mcp/main.go:47
TCP_MCP_AUDIT_DIR	bootstrap-only	cli:cmd/tcp-mcp/main.go:114
TCP_MCP_BURST	bootstrap-only	cli:cmd/tcp-mcp/main.go:127
TCP_MCP_ISSUER	bootstrap-only	cli:cmd/tcp-mcp/main.go:46
TCP_MCP_JWKS_URL	bootstrap-only	cli:cmd/tcp-mcp/main.go:57
TCP_MCP_LOG_LEVEL	bootstrap-only	cli:cmd/tcp-mcp/main.go:194
TCP_MCP_RATE_PER_MINUTE	bootstrap-only	cli:cmd/tcp-mcp/main.go:127
TCP_TRANSPORT	bootstrap-only	cli:cmd/tcp-mcp/main.go:79

Other extracted process inputs

Inputs below are extracted from source for reference. If a non-bootstrap runtime behavior is discovered here, record it as a DB-first follow-up and do not document it as recommended operational state.

Flags

Flag	Read at
-addr	acumen:cmd/acumen/main.go:137
-auth-oidc-client-id	acumen:cmd/acumen/main.go:143
-auth-oidc-enabled	acumen:cmd/acumen/main.go:141
-auth-oidc-issuer	acumen:cmd/acumen/main.go:142
-auth-oidc-redirect-url	acumen:cmd/acumen/main.go:145
-auth-vkey-login	acumen:cmd/acumen/main.go:146
-console	acumen:cmd/acumen/main.go:139
-ide-root	acumen:cmd/acumen/main.go:140
-studio-runner	acumen:cmd/acumen/main.go:147
-studio-workers	acumen:cmd/acumen/main.go:148
-version	acumen:cmd/acumen/main.go:149
--json	cli:internal/cli/app.go:101
--no-tty	cli:internal/cli/app.go:102
--non-interactive	cli:internal/cli/app.go:103
--api-key	cli:internal/cli/cmds_auth.go:101
--check	cli:internal/cli/cmds_auth.go:244
--no-browser	cli:internal/cli/cmds_auth.go:99
--pkce	cli:internal/cli/cmds_auth.go:98
--scopes	cli:internal/cli/cmds_auth.go:102
--name	cli:internal/cli/cmds_studio.go:825
--project	cli:internal/cli/cmds_studio.go:132
--run	cli:internal/cli/cmds_studio.go:244
--task	cli:internal/cli/cmds_studio.go:190
--limit	cli:internal/cli/cmds_misc.go:265
--strict	cli:internal/cli/cmds_misc.go:362

DB-first follow-up notes

• acumen -dsn and -kek-file/-kek-env are bootstrap-only process inputs for database and credential custody. They are not runtime settings.
• tcp/tcp-mcp environment reads are local client/bootstrap and credential-reference inputs in the configured CLI sources. Do not add new env/file/JSON/SQLite operational state in touched areas; prefer Postgres suite with audited runtime configuration where services need mutable state.