Reference
Environment variables
Every environment variable DefenseClaw reads, grouped by category, with defaults, accepted values, and the file:line that consumes each one.
This is the canonical list of every environment variable DefenseClaw reads. The list is generated from internal/envvars/registry.json; CI fails if any callsite references a DEFENSECLAW_* var not declared in the registry.
Config v8 observability policy lives in YAML
V8 does not use ambient DEFENSECLAW_OTEL_*, standard
OTEL_EXPORTER_OTLP_*, or DEFENSECLAW_DISABLE_REDACTION values as live
collection/routing/redaction policy. Destinations refer to credential environment
variables explicitly through fields such as token_env, bearer_env, or
{env: NAME}. Entries below described as legacy observability inputs are read
only by the automatic v7-to-v8 upgrade converter and are retired after their
effective value is materialized. The generated table names that compatibility
scope at each such row.
See live what's active
defenseclaw doctor surfaces any active security override in real time. Operators with no overrides set see a single "none active" pass row; if you've left a debug toggle on, doctor flags it loudly.
Security opt-outs
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_ALLOW_CGNAT | HIGH | unset (CGNAT blocked) | 1, unset | Allow RFC 6598 carrier-grade NAT addresses (100.64.0.0/10, used by Tailscale and similar overlays) through the SSRF / private-IP guards. | CGNAT egress guard — prevents SSRF into shared carrier-grade NAT / overlay-network address space (e.g. another tenant's Tailscale node). | internal/netguard/netguard.go — cgnatAllowed() omits 100.64.0.0/10 from the reserved-CIDR list when setcli/defenseclaw/webhooks/writer.py — _cgnat_allowed() gates webhook URL validation for CGNAT IPscli/defenseclaw/registries/ssrf.py — _cgnat_allowed() gates registry/manifest SSRF resolution for CGNAT |
DEFENSECLAW_ALLOW_HOOK_CONTRACT_DRIFT | HIGH | unset (fail-closed in action mode) | 1, unset | Bypass the action-mode fail-closed checks for unverified hook contracts and hook-contract lock drift during connector setup, allowing enforcing hooks to be installed against agent versions outside the verified contract matrix. | Hook contract verification — prevents installing an enforcing hook whose request/response contract has drifted from the verified matrix (a silent guardrail bypass). | internal/gateway/sidecar.go — Blocks connector setup on an unverified hook contract in action mode unless setinternal/gateway/sidecar.go — Blocks connector setup on hook-contract lock drift in action mode unless setcli/defenseclaw/commands/cmd_setup.py — Python setup path mirrors the gateway drift/contract enforcement |
DEFENSECLAW_ALLOW_LOCAL_MCP_TARGETS | HIGH | unset (SSRF guard enforced) | 1, unset | Skip SSRF validation for MCP scan target URLs, permitting loopback, private, link-local, and cloud-metadata destinations. | MCP scan-target SSRF guard — prevents a scan request from reaching IMDS / loopback / private hosts. | internal/scanner/mcp.go — validateMCPScanTargetURL() returns early without SSRF checks when set |
DEFENSECLAW_ALLOW_PRIVATE_UPSTREAMS | HIGH | unset (all private IPs blocked) | comma-separated IPs (e.g. 10.50.2.100,172.16.0.5), unset | Comma-separated list of specific IP addresses exempt from the SSRF private-address block for LLM upstream forwarding. | Private-upstream SSRF guard exemption — allows operator-specified on-prem LLM gateways on RFC 1918 addresses to bypass the private-IP block. Each IP must be explicitly listed (no CIDR). | internal/netguard/allowlist.go — ParseAllowedPrivateUpstreams() reads this env var and merges with config.yaml entriescli/defenseclaw/registries/ssrf.py — _allowed_private_ips() reads this env var for Python-side SSRF guard exemption |
DEFENSECLAW_CODEX_LOOPBACK_TRUST | HIGH | unset (fail-closed) | 1, unset | Restore legacy loopback-trusts-any-bearer behavior for the Codex connector. | Per-bearer Codex authentication on loopback — prevents same-host user-to-user impersonation when multiple users share an OS account. | internal/gateway/connector/codex.go — Authenticate() falls back to legacy behavior when set; emits a [SECURITY] log line |
DEFENSECLAW_DEV | low | unset | 1, true, unset | Mark the process as a developer build. | — | internal/redaction/credentials.go — isCredentialScrubDevMode reads this var |
DEFENSECLAW_DISABLE_AWS_HTTP1_SHIM | medium | unset (shim active for Bedrock) | 1, unset | Disable the AWS Bedrock HTTP/1 monkey-patch the OpenClaw plugin installs to make Bedrock traffic visible to the guardrail proxy. | — | extensions/defenseclaw/src/aws-sdk-http1-for-guardrail.ts — JS shim bails out when set |
DEFENSECLAW_DISABLE_REDACTION | HIGH | unset (ignored by the v8 runtime) | 1, true, unset | Upgrade-only v7 migration input. Fix: Configure observability.defaults, bucket, or destination redaction_profile in config v8. | — | cli/defenseclaw/observability/v8_migration.py — Reads the captured v7 upgrade environment and materializes the equivalent v8 redaction profile |
DEFENSECLAW_DUMP_RAW_SECRETS | HIGH | unset | 1, unset | E2E test toggle ONLY. | — | scripts/test-e2e-full-stack.sh — Dumps raw secrets in diagnostic output for test debugging |
DEFENSECLAW_FAIL_MODE | medium | (value from guardrail.hook_fail_mode in config.yaml) | open, closed, unset | Per-process override of guardrail.hook_fail_mode for hook delivery, missing-token/authentication, and invalid-response failures. | — | internal/gateway/connector/hooks/inspect-tool.sh — Representative shared template; every generated hook reads the same override |
DEFENSECLAW_FORCE_AWS_HTTP1_SHIM | low | unset (shim only on Bedrock) | 1, unset | Force the AWS HTTP/1 shim to install even on non-Bedrock setups. | — | extensions/defenseclaw/src/aws-sdk-http1-for-guardrail.ts — JS shim forces install when set |
DEFENSECLAW_JSONL_DISABLE | low | unset (ignored by the v8 runtime) | 1, true, unset | Upgrade-only v7 migration input. Fix: Add, disable, or remove an explicit kind: jsonl destination in config v8. | — | cli/defenseclaw/observability/v8_migration.py — Reads the captured v7 upgrade environment when converting implicit JSONL behavior |
DEFENSECLAW_OPENSHELL_ALLOW_UNPINNED | medium | unset (fail-closed) | 1, unset | Accept a mutable OCI tag (e.g. 'latest') when installing openshell-sandbox instead of requiring a content-addressed digest or sha256 pin. Fix: Pin via DEFENSECLAW_OPENSHELL_ARCH_DIGEST or DEFENSECLAW_OPENSHELL_BINARY_SHA256. | Pinned-digest sandbox install — prevents tag-mutation supply-chain attacks where an upstream tag is silently re-pointed at a malicious image. | scripts/install-openshell-sandbox.sh — Skips integrity verification when set |
DEFENSECLAW_OPENSHELL_ARCH_DIGEST | — | unset | sha256:<hex>, unset | Pin the openshell-sandbox install to a specific platform manifest digest (sha256:...). | Pinned-digest sandbox install — content-addressed verification of the OCI manifest before extraction. | scripts/install-openshell-sandbox.sh — Verifies OCI manifest digest against this pin |
DEFENSECLAW_OPENSHELL_BINARY_SHA256 | — | unset | 64-char hex sha256, unset | Pin the final extracted openshell-sandbox binary to a specific sha256. | Pinned-digest sandbox install — sha256 verification of the extracted binary. | scripts/install-openshell-sandbox.sh — Marker check (presence enables sha256 verification path)scripts/install-openshell-sandbox.sh — Verifies extracted binary sha256 against this pin |
DEFENSECLAW_OTEL_TLS_INSECURE | HIGH | unset | true, false, 1, 0, unset | Upgrade-only v7 migration input for the former flat OTLP TLS-insecure toggle. Fix: Configure observability.destinations[].tls in config v8. | Enabling this variable disables OTLP server-certificate verification after legacy configuration is migrated into a named destination. | cli/defenseclaw/observability/v8_migration.py — Converts the captured v7 TLS policy into a canonical v8 destinationinternal/config/config.go — Reads the TLS decision only inside the legacy configuration loader |
DEFENSECLAW_POLICY_VALIDATE_ALLOW_NO_OPA | medium | unset (validation requires OPA) | 1, unset | Accept a policy file as 'validated' even when OPA / Rego is not installed. | — | cli/defenseclaw/commands/cmd_policy.py — Policy validate command bypass |
DEFENSECLAW_PREPAIR_TRUST_DEVICE_KEY | HIGH | unset (fail-closed) | 1, unset | Bypass the provenance-sentinel check during 'defenseclaw sandbox setup' pre-pairing. Fix: Restart the gateway once after upgrading; LoadOrCreateIdentity auto-writes the .provenance sentinel and the env var is no longer needed. | Provenance-sentinel verification — prevents acceptance of an unauthenticated device.key file (e.g. a copy left on disk by a prior install or attacker). | cli/defenseclaw/commands/cmd_setup_sandbox.py — _pre_pair_device gates the provenance fail-closed branch on this var |
DEFENSECLAW_REVEAL_PII | medium | unset (PII redacted everywhere) | 1, true, unset | Reveal PII in operator-facing logs only (CLI stdout, TUI). | — | internal/redaction/redaction.go — Reveal() reads this env var |
DEFENSECLAW_SANDBOX_FORCE_REGEX_CLEANUP | medium | 0 (no regex sweep) | 1, 0, unset | Opt into the legacy broad regex cleanup of sandbox/openshell network namespaces when no saved namespace file exists. | Namespace cleanup scope — a broad regex sweep can delete unrelated network namespaces on a shared host. | cli/defenseclaw/commands/cmd_setup_sandbox.py — Embedded pre-sandbox script reads it before namespace cleanupcli/defenseclaw/commands/cmd_setup_sandbox.py — Embedded cleanup-sandbox script reads it |
DEFENSECLAW_STRICT_AVAILABILITY | — | unset (no additional force-closed override) | 1, true, TRUE, yes, YES, unset | Force transport and missing-token hook failures closed even when the effective fail mode is open. | — | internal/gateway/connector/hooks/_hardening.sh — Hook hardening sourced by every *-hook.sh |
DEFENSECLAW_TEST | low | unset | 1, true, unset | Mark the process as running under tests. | — | internal/redaction/credentials.go — isCredentialScrubDevMode reads this var |
DEFENSECLAW_TOOL_INSPECT_FAIL_OPEN | HIGH | unset (fail-closed) | 1, true, unset | Make the plugin-side tool-inspect hook fail-open (allow tool) when the gateway is unreachable. | — | extensions/defenseclaw/src/index.ts — OpenClaw plugin tool-inspect handler |
DEFENSECLAW_TRUSTED_PROXY_CIDRS | medium | unset (X-Forwarded-For ignored) | comma-separated CIDRs or IPs, unset | Comma-separated CIDRs (or bare IPs) of reverse-proxy peers whose X-Forwarded-For header is trusted for client-IP attribution in logs. | Client-IP attribution — trusting forwarded headers from an untrusted peer lets a caller spoof the source IP recorded in auth-failure and audit logs. | internal/gateway/requestctx.go — isTrustedProxyPeer() trusts X-Forwarded-For only from these peers |
DEFENSECLAW_UNGUARDED_CHATGPT_CODEX_RESPONSES | HIGH | unset (guardrail proxy enforced) | 1, unset | Allow ChatGPT Codex response-backend requests to bypass the guardrail proxy. Fix: Leave unset for normal guarded operation; use only while diagnosing proxy incompatibility. | Codex response guardrail enforcement — prevents model prompt/response traffic from silently bypassing observe/action policies unless the operator explicitly opts into an unguarded fallback. | extensions/defenseclaw/src/fetch-interceptor.ts — Env-var name exported for the OpenClaw interceptor and testsextensions/defenseclaw/src/fetch-interceptor.ts — isCodexResponsesPassthroughEnabled gates the explicit unguarded passthrough pathextensions/defenseclaw/src/fetch-interceptor.ts — Interceptor warning names the active unguarded bypass |
DEFENSECLAW_UPGRADE_ALLOW_UNVERIFIED | HIGH | unset (fail-closed) | 1, unset | Skip checksum / signature verification during 'defenseclaw upgrade' or scripts/upgrade.sh. | Upgrade-artifact integrity — prevents installing a tampered tarball/wheel pulled from a hijacked release CDN or MITM. | cli/defenseclaw/commands/cmd_upgrade.py — Python upgrade path checks this before downloading without a checksumscripts/upgrade.sh — Shell upgrade path checks this before proceeding without verification |
DEFENSECLAW_UPGRADE_TARBALL_SHA256 | — | unset | 64-char hex sha256, unset | Operator-provided sha256 pin for the gateway tarball downloaded by defenseclaw upgrade. | Operator-supplied checksum pin for upgrade artifacts — defense-in-depth alongside the sidecar .sha256 file. | cli/defenseclaw/commands/cmd_upgrade.py — Python upgrade verifierscripts/upgrade.sh — Shell upgrade verifier |
DEFENSECLAW_UPGRADE_WHL_SHA256 | — | unset | 64-char hex sha256, unset | Operator-provided sha256 pin for the Python CLI wheel downloaded by defenseclaw upgrade. | Operator-supplied checksum pin for upgrade artifacts — defense-in-depth alongside the sidecar .sha256 file. | cli/defenseclaw/commands/cmd_upgrade.py — Python upgrade verifierscripts/upgrade.sh — Shell upgrade verifier |
DEFENSECLAW_WEBHOOK_ALLOW_LOCALHOST | medium | unset (SSRF guard blocks private IPs) | 1, unset | Relax the webhook SSRF guard to permit RFC1918 / loopback / link-local destinations. | — | internal/gateway/webhook.go — Webhook sender SSRF gateinternal/gateway/webhook.go — Webhook validate-on-add SSRF gatecli/defenseclaw/webhooks/writer.py — Python writer validate-on-add |
Credentials & secrets
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_GATEWAY_TOKEN | HIGH | unset | bearer-token, unset | Bearer token hooks present to the gateway API. | — | internal/gateway/connector/hooks/inspect-tool.sh — Hooks present this headerinternal/cli/sidecar.go — Sidecar references in setup messages |
DEFENSECLAW_LLM_KEY | HIGH | unset | LLM API key string, unset | Canonical env-var name for the unified LLM key. | — | cli/defenseclaw/credentials.py — Credentials registry default for llm.api_key_env |
DEFENSECLAW_LLM_KEY_ENV | low | DEFENSECLAW_LLM_KEY | any env-var name | Indirection: name of the env var to read the LLM key from. | — | cli/defenseclaw/credentials.py — Credentials registry indirection |
DEFENSECLAW_LLM_MODEL | low | (value from llm.model in config.yaml) | provider/model-id, unset | Override the configured LLM model id at runtime. | — | cli/tests/test_config.py — Tested override path |
DEFENSECLAW_LLM_MODEL_ENV | low | DEFENSECLAW_LLM_MODEL | any env-var name | Indirection: name of the env var to read the LLM model from. | — | cli/defenseclaw/credentials.py — Credentials registry indirection |
DEFENSECLAW_LOCAL_PASSWORD | HIGH | unset | any-string, unset | Password for the local Splunk daemon basic-auth surface. | — | internal/cli/daemon.go — Daemon reads from .env |
DEFENSECLAW_LOCAL_SPLUNK_HEC_TOKEN | HIGH | unset | cryptographically random HEC token, unset | Generated HEC token for the owned bundled Local Splunk sink. | — | cli/defenseclaw/observability/local_splunk.py — Native Local Splunk credential contractcli/defenseclaw/commands/cmd_setup.py — Owned local-splunk audit sink wiring |
DEFENSECLAW_LOCAL_USERNAME | medium | unset | any-string, unset | Username for the local Splunk daemon basic-auth surface. | — | internal/cli/daemon.go — Daemon reads from .env |
DEFENSECLAW_MASTER_KEY | HIGH | (derived at boot from device.key) | sk-dc-<hex> | Bearer derived from device.key (PBKDF2). | — | internal/gateway/proxy.go — deriveMasterKey |
DEFENSECLAW_PD_KEY | medium | unset | pagerduty-key, unset | Alias for DEFENSECLAW_PD_ROUTING_KEY. | — | cli/defenseclaw/commands/cmd_setup_webhook.py — Alternative PD key var |
DEFENSECLAW_PD_ROUTING_KEY | medium | unset | pagerduty-routing-key, unset | PagerDuty routing key default for webhook entries. | — | cli/defenseclaw/commands/cmd_setup_webhook.py — Webhook setup default |
DEFENSECLAW_PROXY_TOKEN | low | unset | any-string, unset | Test-harness proxy bearer. | — | scripts/test-proxy-sandbox.py — Test proxy bearer |
DEFENSECLAW_REGISTRY_TOKEN | medium | unset | registry-token, unset | Default registry auth env var (e.g. | — | cli/defenseclaw/commands/cmd_registry.py — Registry default auth_env |
DEFENSECLAW_SETUP_OBSERVABILITY_TOKEN | HIGH | unset | provider-token, unset | Short-lived secret transport for 'defenseclaw setup observability add'. | — | cli/defenseclaw/commands/cmd_setup_observability.py — Click reads the setup token from the child process environment instead of argv |
DEFENSECLAW_SIEM_SECRET | medium | unset | any-string, unset | SIEM webhook secret default. | — | cli/defenseclaw/commands/cmd_setup_webhook.py — Webhook setup default |
DEFENSECLAW_SKILLSSH_TOKEN | medium | unset | registry-token, unset | Example registry-specific token env var. | — | cli/defenseclaw/commands/cmd_registry.py — Registry example token |
DEFENSECLAW_SKILL_SCANNER_LLM_KEY | HIGH | unset | LLM API key string, unset | Override the LLM key used by the skill scanner only. | — | cli/defenseclaw/credentials.py — Credentials registry |
DEFENSECLAW_SPLUNK_HEC_TOKEN | HIGH | unset | HEC token, unset | Alternative HEC token consulted by the Python sink wiring when the canonical splunk_hec.token_env points to a different var. | — | cli/defenseclaw/commands/cmd_setup.py — Python Splunk wiring fallback |
DEFENSECLAW_WEBEX_TOKEN | medium | unset | webex-bot-token, unset | Webex bot token default for webhook entries. | — | cli/defenseclaw/commands/cmd_setup_webhook.py — Webhook setup default |
DEFENSECLAW_WEBHOOK_SECRET | medium | unset | any-string, unset | Generic webhook HMAC secret default. | — | cli/defenseclaw/commands/cmd_setup_webhook.py — Webhook setup default |
Paths & runtime layout
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_API_ADDR | low | (templated value from gateway.api_port at hook install time) | host:port, unset | Sidecar API address that hooks dial. | — | internal/gateway/connector/hooks/inspect-tool.sh — Hooks dial this |
DEFENSECLAW_BIN | low | (discovered via PATH lookup) | any-absolute-path | Override path to the defenseclaw CLI binary. | — | internal/scanner/plugin_test.go — Plugin test harnessscripts/setup-llm.sh — LLM setup script |
DEFENSECLAW_CONFIG | medium | ${DEFENSECLAW_HOME}/config.yaml | any-absolute-path, unset | Override the config.yaml path independently from DEFENSECLAW_HOME. | Managed config path separation — lets system services read admin-owned policy without making the runtime data directory admin-writable. | internal/config/defaults.go — Go config path resolvercli/defenseclaw/config.py — Python config path resolvercli/defenseclaw/migrations.py — Migration config path resolver |
DEFENSECLAW_CUSTOM_PROVIDERS_PATH | low | unset | any-absolute-path, unset | Path to a custom providers YAML file consulted before the embedded catalog. | — | internal/configs/embed.go — Go embedded-providers loader |
DEFENSECLAW_DEPLOYMENT_MODE | HIGH | unset (use config.yaml deployment_mode) | managed_enterprise, unmanaged_byod, unset | Pin the process deployment mode independently from config.yaml. | Immutable managed-mode boundary — prevents config replacement from disabling administrator-owned path and ownership checks. | internal/config/config.go — Pins deployment mode before parsing or trusting config.yamlpackaging/systemd/defenseclaw-gateway.service — Managed Linux service pinpackaging/launchd/com.cisco.secureclient.defenseclaw.plist — Managed macOS service pin |
DEFENSECLAW_DIR | low | (templated at install time) | any-absolute-path | Used in generated openshell-sandbox shell wrappers to locate the DefenseClaw install dir from inside the sandbox. | — | cli/defenseclaw/commands/cmd_setup_sandbox.py — Sandbox shell wrappers reference this |
DEFENSECLAW_GATEWAY_BIN | low | (discovered via PATH lookup) | any-absolute-path | Override path to the defenseclaw-gateway binary. | — | cli/defenseclaw/gateway.py — Python gateway-process spawner |
DEFENSECLAW_GUARDIAN_AGENT_VERSION | medium | unset (falls back to cached discovery version when available) | agent version string, unset | Systemd template override supplying the local agent version used for enterprise hook-contract validation. | Action-mode hook contract validation — lets managed deployments pin the agent version the guardian validates before writing blocking hooks. | docs-site/content/docs/setup/enterprise-deployment.mdx — Documented systemd template override for action-mode hook contract validation |
DEFENSECLAW_GUARDIAN_CONNECTOR | low | unset | registered hook-native connector name | Systemd template override naming the connector reconciled by an enterprise hook guardian instance. | Template-scoped connector selection — avoids broad home scanning by keeping each privileged guardian instance bound to an explicit connector target. | docs-site/content/docs/setup/enterprise-deployment.mdx — Documented systemd template override for per-user hook guardian instances |
DEFENSECLAW_HOME | — | ~/.defenseclaw | any-absolute-path | Override the canonical data dir (default ~/.defenseclaw). | — | internal/config/defaults.go — Go default-resolvercli/defenseclaw/config.py — Python config loadercli/defenseclaw/connector_paths.py — Connector path resolverscripts/install.sh — Installer reads thisscripts/upgrade.sh — Upgrader reads thisinternal/gateway/connector/hooks/inspect-tool.sh — Hooks read this |
DEFENSECLAW_HOOK_GUARDIAN_AUTH_DIR | HIGH | ${DEFENSECLAW_HOME}-hook-guardian | any-absolute-admin-owned-path, unset | Select the administrator-owned directory containing the hook guardian protected-target authorization ledger. | Privileged repair authorization — must remain root/admin-owned and non-writable by the DefenseClaw service account. | internal/managed/managed.go — Resolves the protected-target authorization pathinternal/cli/enterprise_hooks.go — Privileged guardian writes successful protected targetsinternal/gateway/sidecar.go — Managed health verifies connector coverage before advertising enforcement |
DEFENSECLAW_INSTALL_DIR | low | $HOME/.local/bin | any-absolute-path | Directory where CLI symlinks are placed by install.sh / setup-llm.sh. | — | scripts/setup-llm.sh — Install location for setup-llm |
DEFENSECLAW_INSTALL_ROOT | medium | unset (set by DefenseClawSetup-x64.exe launcher) | any-absolute-path, unset | Native Windows installer root injected by the stable defenseclaw.exe launcher so the managed Python CLI can locate the owning packaged install for installer-based upgrade handoff. | Installer root selection — upgrade code must treat this inherited value as untrusted and verify it is a canonical, product-owned Windows install before handing off to the setup executable. | cmd/defenseclaw-launcher/main.go — Launcher appends the verified install root to the managed Python process environmentcli/tests/test_cmd_upgrade.py — Windows native-upgrade tests cover rejection of an untrusted injected install root |
DEFENSECLAW_IPC_SOCKET | low | unset (resolver picks per-mode default: <dirname(data_dir)>/ipc/defenseclaw_ipc.sock for managed_enterprise, otherwise <data_dir>/ipc/defenseclaw_ipc.sock) | any-absolute-path, unset | Override the local UDS gRPC socket path used by the internal/ipc server in unmanaged and test deployments. | Local-only socket path override — managed_enterprise ignores the environment override, creates the resolved socket with a 0660 ceiling (0600 otherwise), and authenticates peers against the effective code-signing team, signing, and bundle-ID allowlists. | internal/ipc/paths.go — ResolveSocketPath consults this before falling back to the deployment-mode default |
DEFENSECLAW_OBSERVABILITY_BIN | low | defenseclaw-observability (resolved via PATH) | executable name or absolute path, unset | Override the executable used by the backward-compatible POSIX local-observability bridge. | Executable selection — a non-default value changes which local program the compatibility bridge launches. | bundles/local_observability_stack/bin/openclaw-observability-bridge — POSIX compatibility bridge selects the lifecycle-controller executable |
DEFENSECLAW_OVERLAY_ROOT | low | unset | any-absolute-path, unset | Extra provider-catalog overlay dir merged on top of the built-in catalog. | — | cli/defenseclaw/commands/cmd_setup_provider.py — Provider setup overlay loader |
DEFENSECLAW_PLIST_SRC | low | unset (installer picks plist alongside install.sh) | any-absolute-path-to-plist, unset | Override the LaunchDaemon plist source file the macOS installer copies to /Library/LaunchDaemons. | Installer-only override — treated as untrusted operator input, so the referenced plist must be root-owned and never group/world-writable. The bundled default plist next to install.sh is accepted regardless of extraction owner (content originates from the trusted bundle) but group/world-writable is still refused. | packaging/macos/install.sh — macOS bundle installer plist resolution |
DEFENSECLAW_SCRUB_BIN | low | unset (auto-discover in order: /opt/cisco/secureclient/defenseclaw/bin/defenseclaw-gateway, then a defenseclaw or defenseclaw-gateway executable next to uninstall.sh) | any-absolute-path-to-executable, unset | Override the DefenseClaw gateway binary used by the macOS uninstaller for the per-user agent-config scrub step (defenseclaw-gateway enterprise hooks scrub). | Uninstaller-only executable override — uninstall.sh runs under sudo, so the referenced binary is exec'd as root. _scrub_bin() validates every override before use via the shared _scrub_bin_trusted helper: must be an absolute path, must be a regular file (not a symlink or directory), must be executable, must be root-owned, must not be group/other writable. Any check failing prints a WARN and falls through to auto-discovery. Intended for bundle-fixture and dev-tree tests; production installs should never set this. First shipped in the macOS 26.7.3 Cisco Secure Client bundle (DefenseClaw 0.8.5). | packaging/macos/uninstall.sh — _scrub_bin() prefers this override before falling back to the managed install path |
DEFENSECLAW_SIDECAR_URL | low | http://127.0.0.1:18790 | any-http-url | Target URL for the bundled CodeGuard skill (skills/codeguard/main.py) to call into the sidecar. | — | skills/codeguard/main.py — Skill sidecar URL |
DEFENSECLAW_VENV | — | ${DEFENSECLAW_HOME}/.venv | any-absolute-path | Path to the DefenseClaw uv venv. | — | scripts/install.sh — Installer venv pathscripts/upgrade.sh — Upgrader venv path |
MIGRATION_DEFENSECLAW_HOME | — | (set by upgrade.sh) | any-absolute-path | Passed by scripts/upgrade.sh to the migration step. | — | scripts/upgrade.sh — Upgrade-time migration runner |
Telemetry (OTel)
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_JUDGE_PERSIST_QUEUE_SIZE | — | unset (config guardrail.judge_persist_queue_depth, default 1024) | positive integer, unset | Emergency boot-time override for the async judge-persistence queue depth. | — | internal/gateway/sidecar.go — Overrides cfg.Guardrail.JudgePersistQueueDepth at sidecar boot |
DEFENSECLAW_OTEL_ENABLED | — | unset (ignored by the v8 runtime) | true, false, 1, 0, unset | Upgrade-only v7 migration input for the former otel.enabled master toggle. Fix: Enable or disable named observability.destinations entries in config v8. | — | cli/defenseclaw/observability/v8_migration.py — Preserves the effective v7 OTel master-toggle decision during upgradeinternal/config/config.go — Binds the variable only inside the legacy configuration loader used before v8 activation |
DEFENSECLAW_OTEL_ENDPOINT | — | unset | any-otlp-endpoint, unset | Upgrade-only v7 migration input for the former flat OTLP exporter endpoint. Fix: Configure observability.destinations[].endpoint in config v8. | — | cli/defenseclaw/observability/v8_migration.py — Converts the captured v7 endpoint into a canonical v8 destinationinternal/config/config.go — Reads the endpoint only inside the legacy configuration loader |
DEFENSECLAW_OTEL_LOGS_ENDPOINT | — | unset | any-otlp-endpoint, unset | Upgrade-only v7 migration input for the former log-specific OTLP endpoint. Fix: Configure a v8 destination endpoint or signal_overrides.logs.endpoint. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific endpoints into canonical v8 destinationsinternal/config/config.go — Reads signal-specific endpoints only inside the legacy configuration loader |
DEFENSECLAW_OTEL_LOGS_PROTOCOL | — | unset | grpc, grpc/protobuf, http, http/protobuf, http/json, unset | Upgrade-only v7 migration input for the former log-specific OTLP protocol. Fix: Configure the protocol on the canonical v8 destination. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific protocols into canonical v8 destinationsinternal/config/config.go — Reads signal-specific protocols only inside the legacy configuration loader |
DEFENSECLAW_OTEL_METRICS_ENDPOINT | — | unset | any-otlp-endpoint, unset | Upgrade-only v7 migration input for the former metric-specific OTLP endpoint. Fix: Configure a v8 destination endpoint or signal_overrides.metrics.endpoint. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific endpoints into canonical v8 destinationsinternal/config/config.go — Reads signal-specific endpoints only inside the legacy configuration loader |
DEFENSECLAW_OTEL_METRICS_PROTOCOL | — | unset | grpc, grpc/protobuf, http, http/protobuf, http/json, unset | Upgrade-only v7 migration input for the former metric-specific OTLP protocol. Fix: Configure the protocol on the canonical v8 destination. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific protocols into canonical v8 destinationsinternal/config/config.go — Reads signal-specific protocols only inside the legacy configuration loader |
DEFENSECLAW_OTEL_PROTOCOL | — | unset | grpc, grpc/protobuf, http, http/protobuf, http/json, unset | Upgrade-only v7 migration input for the former flat OTLP exporter protocol. Fix: Configure observability.destinations[].protocol in config v8. | — | cli/defenseclaw/observability/v8_migration.py — Converts the captured v7 protocol into a canonical v8 destinationinternal/config/config.go — Reads the protocol only inside the legacy configuration loader |
DEFENSECLAW_OTEL_TRACES_ENDPOINT | — | unset | any-otlp-endpoint, unset | Upgrade-only v7 migration input for the former trace-specific OTLP endpoint. Fix: Configure a v8 destination endpoint or signal_overrides.traces.endpoint. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific endpoints into canonical v8 destinationsinternal/config/config.go — Reads signal-specific endpoints only inside the legacy configuration loader |
DEFENSECLAW_OTEL_TRACES_PROTOCOL | — | unset | grpc, grpc/protobuf, http, http/protobuf, http/json, unset | Upgrade-only v7 migration input for the former trace-specific OTLP protocol. Fix: Configure the protocol on the canonical v8 destination. | — | cli/defenseclaw/observability/v8_migration.py — Converts captured v7 signal-specific protocols into canonical v8 destinationsinternal/config/config.go — Reads signal-specific protocols only inside the legacy configuration loader |
DEFENSECLAW_RUN_ID | — | auto-generated UUID at gateway boot | any-string, unset | Correlation ID stamped on every event for cross-sink joins. | — | internal/gatewaylog/runid.go — Go readerinternal/audit/store.go — Audit store readerinternal/gateway/sidecar.go — Sidecar bootcli/defenseclaw/logger.py — Python logger readercli/defenseclaw/db.py — Python DB readerscripts/test-e2e-full-stack.sh — E2E test runner default |
DEFENSECLAW_TELEMETRY_ENABLED | — | unset | 1, 0, unset | Local-observability-stack-only toggle. | — | bundles/local_observability_stack/docker-compose.yml — Compose-file env reference |
DEFENSECLAW_TRACEPARENT | — | unset (no traceparent forwarded) | W3C traceparent string, unset | W3C traceparent header value propagated from the agent/hook environment into outbound hook HTTP requests and the Codex telemetry bridge, enabling distributed-trace correlation. | — | internal/cli/hook.go — Native hook reads it (precedence over TRACEPARENT / OTEL_TRACEPARENT)internal/gateway/connector/hooks/_hardening.sh — Bash hook trace-context extractioninternal/gateway/connector/codex.go — Codex telemetry bridge forwards it on outbound curls |
DEFENSECLAW_TRACESTATE | — | unset (no tracestate forwarded) | W3C tracestate string, unset | W3C tracestate header value propagated alongside traceparent for vendor-specific trace baggage on hook and Codex telemetry outbound requests. | — | internal/cli/hook.go — Native hook reads it alongside traceparentinternal/gateway/connector/hooks/_hardening.sh — Bash hook trace-context extractioninternal/gateway/connector/codex.go — Codex telemetry bridge forwards it on outbound curls |
Debug / verbose logging
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_DEBUG | low | unset | 1, unset | Gateway client logs every request/response frame to stderr. | — | internal/gateway/client.go — Client struct gates verbose logging on this var |
DEFENSECLAW_JUDGE_TRACE | medium | unset | 1, true, unset | LLM judge logs every prompt + response. | — | internal/gateway/llm_judge.go — Judge debug toggle |
DEFENSECLAW_LLM_DEBUG | medium | unset | 1, true, unset | Python LLM bridge logs per-request prompt + response bodies. | — | cli/defenseclaw/llm.py — LLM bridge _DEBUG flag |
DEFENSECLAW_PERSIST_JUDGE | medium | unset | 1, true, unset | Persist every judge prompt + response to disk under data_dir. | — | internal/gateway/sidecar.go — Gateway boot enables judge persistence |
DEFENSECLAW_SIDECAR_DIAG | low | unset | 1, true, unset | Extra sidecar boot-time diagnostics (config dump, env presence). | — | internal/cli/sidecar.go — sidecarDiagEnabled helper |
DEFENSECLAW_TUI_SKIP_FIRST_RUN_PROMPT | — | unset (prompt shown on a TTY) | 1, true, yes, unset | Skip the interactive first-run setup wizard prompt when launching the TUI, proceeding directly without asking whether to run setup. | — | cli/defenseclaw/tui/__init__.py — Gates the interactive first-run setup prompt |
DEFENSECLAW_WEBHOOK_DEBUG | medium | unset | 1, unset | Webhook dispatcher dumps full request bodies (including secrets) to stderr. | — | internal/gateway/webhook.go — Webhook sender debug field |
Discovery & probes
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_ANTHROPIC_PROBE_MODEL | — | claude-3-5-haiku-latest | any-anthropic-model-id | Override the model used by 'defenseclaw doctor' to probe Anthropic API key validity. | — | cli/defenseclaw/commands/cmd_doctor.py — Doctor's Anthropic probe |
DEFENSECLAW_TRUSTED_BIN_PREFIXES | medium | unset (built-in defaults only) | os.pathsep-separated absolute paths (':' POSIX, ';' Windows), unset | Extra trusted binary prefixes for AI Discovery's binary probing, separated by os.pathsep (':' on POSIX, ';' on Windows). | Tight binary-discovery trust list — prevents PATH-shadow elevation where a malicious binary in a user-writable dir gets probed and treated as a real agent runtime. 'trusted-paths add' refuses world-writable and non-absolute directories unless --force. | cli/defenseclaw/inventory/agent_discovery.py — Agent discovery binary probecli/defenseclaw/commands/cmd_setup.py — setup trusted-paths CLI and inline trust prompt persistence |
Hook-internal (do not override)
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_AGENT_ID | — | (set by plugin / hooks) | any-string | Agent identity propagated through correlation headers and OTel attributes. | — | internal/cli/scan_v7.go — Go readerextensions/defenseclaw/src/__tests__/agent_identity.test.ts — JS plugin reader (tested) |
DEFENSECLAW_AGENT_INSTANCE_ID | — | (set by plugin / hooks) | any-string | Per-instance agent identifier; used to disambiguate concurrent runs of the same agent. | — | internal/cli/scan_v7.go — Go reader |
DEFENSECLAW_AGENT_NAME | — | (set by plugin / hooks) | any-string | Human-readable agent name propagated via correlation headers. | — | extensions/defenseclaw/src/index.ts — JS plugin header emit |
DEFENSECLAW_BAKED_HOOK_PATH | medium | empty (default PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin) | colon-separated absolute paths, unset | Baked into the installed _hardening.sh helper at hook-generation time. | Hook PATH lockdown — a mis-baked value that widens PATH could re-admit attacker-writable directories to hook execution. | internal/gateway/connector/hooks/_hardening.sh — defenseclaw_harden_env() uses it to set the locked-down hook PATH |
DEFENSECLAW_CLAWHUB_CWD | — | unset (set by the ClawHub launcher adapter on Windows) | absolute directory path | Working directory used by the temporary Windows ClawHub command adapter. | — | cli/defenseclaw/commands/cmd_skill.py — Windows ClawHub command adapter publishes the selected launch directory to its generated batch file |
DEFENSECLAW_CLAWHUB_LAUNCHER | — | unset (set by the ClawHub launcher adapter on Windows) | absolute path to a .cmd or .bat launcher | Absolute path to the trusted ClawHub .cmd or .bat launcher passed to the temporary Windows command adapter. | — | cli/defenseclaw/commands/cmd_skill.py — Windows ClawHub command adapter publishes the selected trusted launcher to its generated batch file |
DEFENSECLAW_CLEANUP_ACK | — | unset (set and overwritten by native Setup) | absolute installer-cache acknowledgement path, unset | Canonical InstallerCache cleanup acknowledgement path used by the bounded post-exit finalizer. | — | cmd/defenseclaw-setup/deferred_uninstall_cleanup_windows.go — Post-exit finalizer locks and validates the exact cleanup acknowledgement before removing authenticated installer residue |
DEFENSECLAW_CLEANUP_JOURNAL | — | unset (set and overwritten by native Setup) | absolute setup-journal path, unset | Protected native Setup transaction journal used to bind delayed directory cleanup to the uninstall transaction that scheduled it. | — | cmd/defenseclaw-setup/platform_windows.go — Delayed cleanup helper re-reads and locks the journal before deleting its owned target |
DEFENSECLAW_CLEANUP_PARENT_PID | — | unset (set and overwritten by native Setup) | decimal process id, unset | Parent process identifier awaited by the bounded delayed InstallerCache cleanup helper. | — | cmd/defenseclaw-setup/platform_windows.go — Delayed cleanup helper waits for the originating Setup process before acquiring the setup mutex |
DEFENSECLAW_CLEANUP_TARGET | — | unset (set and overwritten by native Setup) | absolute installer-cache path, unset | Canonical InstallerCache directory considered for delayed removal. | — | cmd/defenseclaw-setup/platform_windows.go — Delayed cleanup helper receives the exact cache target |
DEFENSECLAW_CLEANUP_TRANSACTION_ID | — | unset (set and overwritten by native Setup) | setup transaction identifier, unset | Exact native Setup uninstall transaction identifier expected by the delayed directory cleanup helper. | — | cmd/defenseclaw-setup/platform_windows.go — Delayed cleanup helper refuses deletion when the protected journal belongs to another transaction |
DEFENSECLAW_CLEANUP_WAIT_MS | — | unset (set and overwritten by native Setup) | non-negative decimal milliseconds, unset | Bounded parent-process wait duration for the native Setup delayed directory cleanup helper. | — | cmd/defenseclaw-setup/platform_windows.go — Delayed cleanup helper exits without deletion if the originating Setup process does not stop within this bound |
DEFENSECLAW_CLIENT | — | (set by plugin) | any-string | Client name (e.g. openclaw-plugin) stamped on the X-DefenseClaw-Client correlation header. | — | extensions/defenseclaw/src/policy/enforcer.ts — Enforcer header |
DEFENSECLAW_CONNECTOR | — | unset | normalized connector identifier, unset | Runtime selector for the connector that owns an invocation of the shared hook scripts. | — | internal/gateway/connector/hooks/_hardening.sh — Selects one unambiguous connector runtime record for shared hooksinternal/gateway/connector/subprocess.go — Writes and validates the connector-scoped runtime sidecar |
DEFENSECLAW_DAEMON | — | (set by daemon launcher; child only) | 1 | Sentinel set by the daemon launcher in the child process so it knows it's the daemon. | — | internal/daemon/daemon.go — EnvDaemon constant |
DEFENSECLAW_DATA_DIR | — | unset (set by the daemon on child processes) | absolute data-directory path | Marker injected by the daemon launcher into the spawned gateway child process environment, recording which data directory that child belongs to. | — | internal/daemon/daemon.go — Written into the gateway child env to tag the owning data directory |
DEFENSECLAW_GATEWAY_ADDR | — | 127.0.0.1:<api_port> | loopback host:port, unset | Gateway API address for the Windows native Go hook entrypoint. | Loopback-only enforcement — a non-loopback gateway address is rejected so a hook cannot be redirected to an off-box collector. | internal/cli/hook.go — Primary env resolution of the hook's gateway API addressinternal/cli/hook.go — Sidecar .hookcfg fallback for the same key |
DEFENSECLAW_HOOK_CONNECTOR | — | (set by hooks) | claudecode, codex, openclaw, zeptoclaw, inspect, ... | Internal label identifying which connector's hook is executing. | — | internal/gateway/connector/hooks/inspect-tool.sh — Each hook exports this |
DEFENSECLAW_HOOK_CWD | — | (set by hooks) | absolute-path | Resolved CWD exported by hooks; used by sanitizeHookCWD to bound git operations. | — | internal/gateway/connector/hooks/_hardening.sh — Hook hardening |
DEFENSECLAW_HOOK_HOME | — | (set by hooks) | absolute-path | Hardened HOME exported by hooks to insulate them from operator HOME. | — | internal/gateway/connector/hooks/_hardening.sh — Hook hardening |
DEFENSECLAW_HOOK_MAX_BODY | low | 1048576 | positive integer | Request-body cap (in bytes) for hooks. | — | internal/gateway/connector/hooks/_hardening.sh — Body-cap enforcement |
DEFENSECLAW_HOOK_NAME | — | (set by hooks) | inspect-tool, inspect-request, ... | Internal label identifying which hook is executing. | — | internal/gateway/connector/hooks/inspect-tool.sh — Each hook exports this |
DEFENSECLAW_HOOK_PATH | — | (set by hooks) | colon-separated paths | Hardened PATH exported by hooks (system-only) so a hostile workspace can't shadow git/curl/etc. | — | internal/gateway/connector/hooks/_hardening.sh — Hook hardening |
DEFENSECLAW_HOOK_PATH_TRUSTED | — | unset (always stripped before PATH lockdown) | unset | Companion name to DEFENSECLAW_HOOK_PATH that an agent process might set. | Hook PATH lockdown — stripped so an agent-supplied 'trusted' flag cannot re-enable an attacker-controlled PATH. | internal/gateway/connector/hooks/_hardening.sh — unset DEFENSECLAW_HOOK_PATH_TRUSTED during env hardening (anti-consumed) |
DEFENSECLAW_MANAGED_HOOK | HIGH | unset (set to 1 only by generated managed hooks) | 1, unset | Immutable sentinel baked into managed-enterprise hook scripts so missing authentication material and unavailable enforcement fail closed even when an inherited environment requests permissive availability behavior. | Managed enforcement fail-closed boundary — the value is generated by the privileged hook installer and is not an operator security opt-out. | internal/gateway/connector/hooks/_hardening.sh — Managed shell-hook wrappers set and export the sentinel before sourcing this shared runtime, whose missing-token and transport-failure branches then force fail-closed behavior |
DEFENSECLAW_OPENCLAW_MAIN | low | (set by plugin bootstrap) | absolute-path | Sentinel read by the OpenClaw plugin bootstrapper to locate its main module. | — | extensions/defenseclaw/src/aws-sdk-http1-for-guardrail.ts — Plugin bootstrap sentinel |
DEFENSECLAW_PLUGIN_AGENT_ID | — | (set by plugin) | any-string | Plugin-side agent ID. | — | extensions/defenseclaw/src/__tests__/agent_identity.test.ts — JS plugin reader (tested) |
DEFENSECLAW_SIDECAR_INSTANCE_ID | — | (auto-generated by gateway) | uuid-or-similar | Sidecar instance ID; auto-generated by the gateway at boot, propagated via headers. | — | internal/cli/scan_v7.go — Go reader |
Upgrade-internal (do not override)
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_OBSERVABILITY_V8_PREFLIGHT_BINDING | — | unset | JSON object no larger than 4096 bytes, unset | Carries the controller-authenticated observability-v8 preflight snapshot into the fresh target migration child. | — | cli/defenseclaw/commands/cmd_upgrade.py — Passes the verified binding only to the isolated phase-two migration childcli/defenseclaw/migrations.py — Requires and validates the binding before the v7-to-v8 hard-cut mutation |
DEFENSECLAW_PHASE_TWO_MUTATOR_CHILD | — | unset | 1, unset | Marks the trusted phase-two mutation child so upgrade recovery can distinguish the lease-holding subprocess from its controller. | — | cli/defenseclaw/phase_two_mutator.py — Marks the private mutation subprocess while it inherits the authenticated upgrade lease |
DEFENSECLAW_RESCUE_COSIGN_CANDIDATE | — | unset (the rescue payload downloads the pinned Cosign release) | absolute path discovered by command -v cosign, unset | Carries the absolute Cosign path discovered by the POSIX rescue trampoline as inert positional data through an empty environment into the trusted system Bash payload. | Optimization hint only — the ambient executable is never run in place, and its copied bytes receive the same pinned-digest verification as a downloaded Cosign binary. | scripts/defenseclaw-rescue.sh — The POSIX trampoline passes the discovered path through the clean-environment handoff; the Bash payload unsets the variable and uses only a private digest-verified copy |
DEFENSECLAW_STAGED_BRIDGE_ARTIFACT_DIR | — | unset | absolute owner-only directory (0700 on POSIX; protected owner-only DACL on Windows), unset | Carries the private directory of authenticated bridge rollback artifacts into the fresh hard-cut controller. | — | cli/defenseclaw/commands/cmd_upgrade.py — Revalidates and retains resolver-supplied rollback artifacts before installed state changesscripts/upgrade.sh — Unix release resolver supplies the retained artifact directoryscripts/upgrade.ps1 — Windows release resolver supplies the retained artifact directory |
DEFENSECLAW_STAGED_BRIDGE_VERSION | — | unset | canonical X.Y.Z version, unset | Carries the authenticated bridge version across a staged hard-cut handoff; the fresh controller requires it to equal the installed source version. | — | cli/defenseclaw/commands/cmd_upgrade.py — Matches staged rollback artifacts to the installed bridge versionscripts/upgrade.sh — Unix release resolver supplies the verified bridge versionscripts/upgrade.ps1 — Windows release resolver supplies the verified bridge version |
DEFENSECLAW_STAGED_TARGET_CONTROLLER_VERSION | — | unset | canonical X.Y.Z version, unset | Binds a staged hard-cut handoff to the authenticated target-controller version that the resolver installed out of place. | — | cli/defenseclaw/commands/cmd_upgrade.py — Requires the fresh target controller to match the resolver-authenticated target version before accepting bridge rollback custodyscripts/upgrade.sh — Unix release resolver supplies the authenticated target version to the fresh out-of-place controller |
DEFENSECLAW_STAGED_UPGRADE | — | unset | 1, unset | Marks a trusted resolver-to-controller staged hard-cut handoff before rollback artifacts are accepted. | — | cli/defenseclaw/commands/cmd_upgrade.py — Requires the staged handoff marker before consuming resolver-supplied rollback artifactsscripts/upgrade.sh — Unix release resolver sets the marker for the fresh installed controllerscripts/upgrade.ps1 — Windows release resolver sets the marker for the fresh installed controller |
DEFENSECLAW_UPGRADE_FRESH_PROCESS | — | unset | 1, unset | Marks the isolated installed-CLI child used for an upgrade handoff so the child cannot recursively hand off again and a newly installed gateway can delegate its readiness wait to that supervising controller. | — | cli/defenseclaw/commands/cmd_upgrade.py — Rejects recursive fresh-process upgrade handoffs and marks the isolated child processinternal/cli/daemon.go — Delegates gateway readiness to the supervising upgrade controller while retaining safe launch and immediate-exit checksscripts/upgrade.sh — Scopes the marker to the immutable post-hard-cut controller continuation |
DEFENSECLAW_UPGRADE_MUTATION_TOKEN | — | unset (writers use their ordinary temporary-file names) | 32-character lowercase hexadecimal attempt identifier, unset | Carries the authenticated 32-character lowercase-hex upgrade attempt identifier into migration writers so attempt-owned temporary files can be named and cleaned without touching unrelated files. | — | scripts/upgrade.sh — Passes the phase-one recovery plan identifier to the isolated migration processcli/defenseclaw/config.py — Tags atomic config-write temporary files as owned by the current upgrade attemptcli/defenseclaw/migrations.py — Tags atomic migration-write temporary files as owned by the current upgrade attemptcli/defenseclaw/migration_state.py — Tags atomic migration-state temporary files as owned by the current upgrade attempt |
Splunk-bridge bundle
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_HEC_TOKEN | HIGH | (set in .env.example) | hec-token | Splunk-bridge HEC token. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_HEC_URL | — | (set in .env.example) | any-hec-url | Splunk-bridge bundle: HEC endpoint URL. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_INDEX | — | defenseclaw_local | splunk-index-name | Splunk-bridge target index. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_INTEGRATION_ENABLED | — | false | true, false | Splunk-bridge integration toggle. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_O11Y_DASHBOARD_NAME_PREFIX | — | empty (no prefix) | string, unset | Prefix label applied to the Splunk Observability dashboard groups, dashboards, and detectors created by the Terraform setup command. | — | cli/defenseclaw/commands/cmd_setup_splunk_o11y_dashboards.py — --name-prefix Click option bound to this env var |
DEFENSECLAW_REF | — | unknown | any-string | Splunk-bridge bundle git ref label. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_SOURCE | — | defenseclaw | any-source-string | Splunk-bridge source label. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_SOURCETYPE | — | defenseclaw:json | splunk-sourcetype | Splunk-bridge sourcetype. | — | bundles/splunk_local_bridge/env/.env.example — Bridge .env |
DEFENSECLAW_SPLUNK_O11Y_DASHBOARDS_WORK_DIR | — | <data_dir>/splunk_o11y_dashboards/terraform | absolute directory path, unset | Terraform working directory for Splunk Observability dashboard provisioning. | — | cli/defenseclaw/commands/cmd_setup_splunk_o11y_dashboards.py — --work-dir Click option bound to this env var |
DEFENSECLAW_TERRAFORM_PLUGIN_DIR | — | unset (no -plugin-dir passed to terraform init) | absolute directory path, unset | Optional Terraform provider plugin directory for offline / cached provider installs when running 'defenseclaw setup splunk-o11y-dashboards'. | — | cli/defenseclaw/commands/cmd_setup_splunk_o11y_dashboards.py — --plugin-dir Click option bound to this env var |
Test fixtures (test-only)
| Env var | Impact | Default | Accepted values | Purpose | Security concern | Consumers |
|---|---|---|---|---|---|---|
DEFENSECLAW_AUDIT_DB_LOCK_HELPER_PATH | — | unset | absolute temporary database path, unset | Passes the temporary audit database path to isolated subprocesses that verify SQLite kernel-lock and WAL lifecycle behavior. | — | internal/audit/audit_db_lock_unix_test.go — Peer-process lock and SQLite-close fixtures; never read by production runtime paths |
DEFENSECLAW_AUTHENTICODE_HELPER | — | unset | test-defined absolute path, unset | Carries the Authenticode PowerShell helper path to the native unsigned-PE regression fixture. | — | cli/tests/test_windows_installer_artifacts.py — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_CODEX_POLICY_ENTRY_PATH | — | unset | absolute test marker path, unset | Test-only marker path used by the Codex effective-policy subprocess fixture to record helper entry. | — | internal/gateway/connector/codex_policy_test.go — Codex policy timeout/process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_CODEX_POLICY_GRANDCHILD_HELPER | — | unset | 1, unset | Selects the Codex policy grandchild fixture used to verify process-tree containment. | — | internal/gateway/connector/codex_policy_test.go — Test-only Codex policy grandchild helper |
DEFENSECLAW_CODEX_POLICY_HANG_HELPER | — | unset | 1, unset | Selects the Codex policy subprocess fixture that deliberately blocks for timeout coverage. | — | internal/gateway/connector/codex_policy_test.go — Test-only Codex policy timeout helper |
DEFENSECLAW_CODEX_POLICY_HELPER | — | unset | test-defined value, unset | Selects the isolated Codex effective-policy helper subprocess. | — | internal/gateway/connector/codex_policy_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_CODEX_POLICY_MARKER_PATH | — | unset | absolute test marker path, unset | Test-only descendant marker path used by the Codex policy process-tree fixture. | — | internal/gateway/connector/codex_policy_test.go — Codex policy descendant-cleanup fixture |
DEFENSECLAW_CODEX_POLICY_READY_PATH | — | unset | absolute test marker path, unset | Test-only ready-signal path shared with the Codex policy process-tree fixture. | — | internal/gateway/connector/codex_policy_test.go — Codex policy process-tree readiness fixture |
DEFENSECLAW_CODEX_POLICY_TREE_HELPER | — | unset | 1, unset | Selects the Codex policy subprocess-tree fixture used to verify descendant cleanup. | — | internal/gateway/connector/codex_policy_test.go — Test-only Codex policy process-tree helper |
DEFENSECLAW_DEFERRED_RUN_HELPER_ACK | — | unset | test-defined absolute path, unset | Carries the acknowledgement path for the isolated deferred-cleanup Run launch fixture. | — | cmd/defenseclaw-setup/deferred_uninstall_cleanup_windows_test.go — Native Windows deferred-cleanup Run launch fixture; never read by production runtime paths |
DEFENSECLAW_DEFERRED_RUN_HELPER_TRANSACTION | — | unset | test-defined lowercase 32-hex transaction identifier, unset | Carries the expected transaction identifier for the isolated deferred-cleanup Run launch fixture. | — | cmd/defenseclaw-setup/deferred_uninstall_cleanup_windows_test.go — Native Windows deferred-cleanup Run launch fixture; never read by production runtime paths |
DEFENSECLAW_DEFERRED_RUN_ROOT | — | unset | test-defined absolute path, unset | Supplies the isolated cache root used to reproduce the former environment-based Run registration. | — | cmd/defenseclaw-setup/deferred_uninstall_cleanup_windows_test.go — Native Windows deferred-cleanup Run launch fixture; never read by production runtime paths |
DEFENSECLAW_DELEGATION_ENV_SENTINEL | — | unset | test-defined value, unset | Carries an inherited environment sentinel through the isolated stable-hook delegation fixture. | — | internal/hookruntime/delegation_windows_test.go — Native Windows hook-delegation test fixture; never read by production runtime paths |
DEFENSECLAW_E2E_CODEX_POLICY_HELPER | — | unset | 1, unset | Selects the bounded Codex app-server fixture used by native connector lifecycle E2E tests. | — | test/e2e/codex_policy_fixture_windows_test.go — Native Windows E2E Codex policy fixture |
DEFENSECLAW_ENV_CONFIG_SKIP_TRUST | medium | unset (trust check enforced) | 1, unset | Skip the uid==0 + not-group/world-writable trust check that LoadEnvConfigEndpoint enforces on the AVC-authored env_config.json. | Bypassing the env_config file trust check lets a group-writable file at the canonical path retarget bearer-authenticated inspection POSTs. Test-only. | internal/config/env_config.go — trustEnvConfigFile short-circuits when set — production installs must leave this unset so a non-root-authored / group-writable env_config.json is refused |
DEFENSECLAW_FAKE_CLAUDE_LIST | — | unset | comma-separated mock responses, unset | Test-only stub: comma-separated list of responses the fake claude CLI returns. | — | internal/gateway/connector/codeguard_native_test.go — Test stub |
DEFENSECLAW_FAKE_CLAUDE_LOG | — | unset | absolute-path, unset | Test-only stub: path the fake claude CLI logs invocations to. | — | internal/gateway/connector/codeguard_native_test.go — Test stub |
DEFENSECLAW_GATEWAY_CODEX_APP_SERVER_HELPER | — | unset | 1, unset | Selects the bounded Codex app-server fixture used by gateway package tests. | — | internal/gateway/codex_setup_fixture_windows_test.go — Native Windows gateway Codex policy fixture |
DEFENSECLAW_GATEWAY_URL | — | unset (in-process e2e server) | http(s) base URL e.g. http://127.0.0.1:18970, unset | Base URL of an external gateway for the security-suite e2e tier (TestSecuritySuiteE2E). | — | internal/gateway/security_suite_test.go — TestSecuritySuiteE2E reads this to locate the gateway; uses an in-process server when unset |
DEFENSECLAW_HOOK_DELEGATION_TEST_HELPER | — | unset | 1, unset | Selects the isolated stable-hook delegation helper subprocess. | — | internal/hookruntime/delegation_windows_test.go — Native Windows hook-delegation test fixture; never read by production runtime paths |
DEFENSECLAW_HOOK_TOKEN_LOCK_HELPER | — | unset | 1, unset | Selects the connector hook-token cross-process lock fixture. | — | internal/gateway/connector/hook_api_token_test.go — Connector hook-token lock fixture |
DEFENSECLAW_HOOK_TOKEN_LOCK_PATH | — | unset | absolute test lock path, unset | Lock path passed to the connector hook-token cross-process fixture. | — | internal/gateway/connector/hook_api_token_test.go — Connector hook-token lock target |
DEFENSECLAW_HOOK_TOKEN_LOCK_READY | — | unset | absolute test marker path, unset | Ready-signal path shared with the connector hook-token cross-process fixture. | — | internal/gateway/connector/hook_api_token_test.go — Connector hook-token lock readiness fixture |
DEFENSECLAW_HOOK_TOKEN_LOCK_RELEASE | — | unset | absolute test marker path, unset | Release-signal path shared with the connector hook-token cross-process fixture. | — | internal/gateway/connector/hook_api_token_test.go — Connector hook-token lock release fixture |
DEFENSECLAW_INTEL_REFUSAL_COMMAND_LOG | — | unset | absolute path inside the isolated refusal-test root, unset | Records any dependency, network, service, or mutation command reached by the native Intel macOS exact-candidate refusal harness. | — | scripts/test-upgrade-macos-intel-refusal.sh — Fails the native Intel release gate if a blocked command executes before architecture refusal |
DEFENSECLAW_LAUNCHER_LOGICAL_CWD | — | unset | test-defined value, unset | Carries the expected logical working directory to the long-CWD launcher fixture. | — | cmd/defenseclaw-launcher/long_cwd_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_LAUNCHER_LONG_CWD_HELPER | — | unset | test-defined value, unset | Selects the isolated long-CWD launcher helper subprocess. | — | cmd/defenseclaw-launcher/long_cwd_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_LONG_PATH_HELPER | — | unset | test-defined value, unset | Selects the isolated native Setup long-path helper subprocess. | — | cmd/defenseclaw-setup/long_path_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_MANAGED_BREAKAWAY_CHILD | — | unset | 1, unset | Selects the detached managed-breakaway child subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_MANAGED_BREAKAWAY_HELPER | — | unset | 1, unset | Selects the managed-breakaway parent subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESSUTIL_INHERITED_OUTPUT_CHILD | — | unset | 1, unset | Selects the inherited-output descendant subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows inherited-output test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESSUTIL_INHERITED_OUTPUT_HELPER | — | unset | 1, unset | Selects the inherited-output parent subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows inherited-output test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESS_TREE_GRANDCHILD | — | unset | 1, unset | Selects the process-tree grandchild subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESS_TREE_HELPER | — | unset | 1, unset | Selects the process-tree parent subprocess fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESS_TREE_MARKER | — | unset | absolute test marker path, unset | Marker path written by the managed-breakaway process-tree fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_PROCESS_TREE_PID_FILE | — | unset | absolute test PID path, unset | PID-record path shared with the process-tree cancellation fixture. | — | internal/processutil/command_windows_test.go — Native Windows process-tree test fixture; never read by production runtime paths |
DEFENSECLAW_SETUP_CANCEL_TEST_HELPER | — | unset | 1, unset | Selects the parent-cancellation native Setup helper subprocess. | — | cmd/defenseclaw-setup/main_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_SETUP_LOCK_TEST_HELPER | — | unset | test-defined value, unset | Selects the cross-process native Setup mutex fixture. | — | cmd/defenseclaw-setup/setup_lock_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_SETUP_MAINTENANCE_TEST_HELPER | — | unset | 1, unset | Selects the isolated native Setup maintenance-gateway helper subprocess. | — | cmd/defenseclaw-setup/maintenance_gateway_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_SETUP_SERVICE_CONTROL_TEST_HELPER | — | unset | 1, unset | Selects the isolated native Setup gateway and watchdog stop-command helper subprocess. | — | cmd/defenseclaw-setup/maintenance_gateway_windows_test.go — Native Windows service-control test fixture; never read by production runtime pathscmd/defenseclaw-setup/recovery_windows_test.go — Enables the delayed owned-process exit regression fixture |
DEFENSECLAW_SETUP_TEST_GATEWAY_STOP | — | unset | test-defined absolute path, unset | Carries the absolute stop-marker path for the delayed native Setup gateway-exit fixture. | — | cmd/defenseclaw-setup/maintenance_gateway_windows_test.go — Writes the gateway stop marker from the isolated control subprocesscmd/defenseclaw-setup/recovery_windows_test.go — Supplies the private gateway stop-marker path |
DEFENSECLAW_SETUP_TEST_WATCHDOG_STOP | — | unset | test-defined absolute path, unset | Carries the absolute stop-marker path for the delayed native Setup watchdog-exit fixture. | — | cmd/defenseclaw-setup/maintenance_gateway_windows_test.go — Writes the watchdog stop marker from the isolated control subprocesscmd/defenseclaw-setup/recovery_windows_test.go — Supplies the private watchdog stop-marker path |
DEFENSECLAW_SETUP_TIMEOUT_TEST_HELPER | — | unset | test-defined value, unset | Selects the bounded native Setup child-timeout helper. | — | cmd/defenseclaw-setup/main_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_SHIM_CAPTURE | — | unset | test-defined absolute path, unset | Carries the output path used by the isolated PATH-shim argv fidelity fixture. | — | internal/gateway/connector/connector_test.go — Captures the fake curl request body so the test can verify exact shim argv forwarding; never read by production runtime paths |
DEFENSECLAW_TEST_BASH | — | unset (auto-detect Bash, including Git Bash on Windows) | absolute path to a Bash executable, unset | Selects the Bash executable used by release-workflow tests so macOS CI can exercise wrappers with the system Bash runtime. | — | cli/tests/test_release_workflow_staged.py — Selects the Bash executable used to run POSIX release-workflow contract tests |
DEFENSECLAW_TEST_COMMAND | — | unset | start, status, restart, unset | Gateway subcommand selected by the native Windows daemon executable test harness. | — | internal/cli/daemon_executable_windows_test.go — PowerShell test harness passes the selected gateway lifecycle command |
DEFENSECLAW_TEST_EXE | — | unset | absolute temporary executable path, unset | Absolute path to the temporary gateway executable invoked by the native Windows daemon executable tests. | — | internal/cli/daemon_executable_windows_test.go — PowerShell test harness invokes the isolated gateway executable |
DEFENSECLAW_TEST_FAIL_AFTER_081_PLACEHOLDER_REPAIR | — | unset | 1, unset | Injects a failure after the clean 0.8.1 placeholder repair to verify phase-one rollback. | — | scripts/upgrade.sh — Authenticated resolver rollback fixture; never set by production upgrade paths |
DEFENSECLAW_TEST_GRACEFUL_STOP_MARKER | — | unset | test-defined value, unset | Carries the marker used by the authenticated graceful-stop daemon fixture. | — | internal/daemon/daemon_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_TEST_GRACEFUL_STOP_OBSERVED | — | unset | test-defined value, unset | Carries the observation marker used to prove the daemon graceful-stop fixture received its shutdown request. | — | internal/daemon/daemon_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_TEST_GRACEFUL_STOP_RELEASE | — | unset | test-defined value, unset | Carries the release marker used to let the daemon graceful-stop fixture finish after observing shutdown. | — | internal/daemon/daemon_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_TEST_KEY | — | unset | any-string, unset | Placeholder LLM key used in test fixtures only. | — | cli/tests/test_llm_env.py — Test fixture |
DEFENSECLAW_TEST_KEY_NOTSET_12345 | — | unset | unset | Placeholder env var name used to assert 'unset' behavior in tests. | — | cli/tests/test_llm_env.py — Test fixture for unset assertions |
DEFENSECLAW_TEST_LLM_KEY | — | unset | any-string, unset | Placeholder LLM key used in some test setups when DEFENSECLAW_LLM_KEY needs an alternate target. | — | cli/tests/test_llm_env.py — Test fixture |
DEFENSECLAW_TEST_MARKER | — | unset | absolute file path, unset | Test-only marker path used by the fake ClawHub launcher to record a single invocation. | — | cli/tests/test_cmd_skill.py — Fake Windows ClawHub launcher appends an invocation marker during command-adapter tests |
DEFENSECLAW_TEST_PHASE1_ACTIVE_SEAL_CRASH | — | unset | after-active-manifest, unset | Injects a process kill after the authenticated POSIX phase-one active manifest is durable but before its digest is committed to the outer recovery journal. | — | scripts/upgrade.sh — Kills the seal helper and parent controller at the orphan-manifest recovery boundarycli/tests/test_upgrade_bridge_phase1_rollback.py — Proves an authenticated orphan active manifest remains usable for fresh-process rollback |
DEFENSECLAW_TEST_PHASE1_MIGRATION_CRASH | — | unset | after-config, unset | Injects a process kill after the POSIX bridge migration has changed canonical config but before an active-state manifest can be sealed. | — | cli/tests/test_upgrade_bridge_phase1_rollback.py — Kills the fixture migration between canonical mutationsscripts/upgrade.sh — The bridge journal arms state-mutation recovery before fixture-controlled migration execution |
DEFENSECLAW_TEST_PHASE1_POST_HEALTH_CRASH | — | unset | after-health, unset | Injects a process kill after the POSIX bridge gateway passes health but before phase-one journal closure. | — | scripts/upgrade.sh — Kills the bridge controller at the live-gateway post-health recovery boundarycli/tests/test_upgrade_bridge_phase1_rollback.py — Proves fresh recovery stops the live bridge using the bound split DataDir and config path |
DEFENSECLAW_TEST_PHASE1_RECOVERY_CRASH | — | unset | after-gateway-displace, after-gateway-publish, unset | Injects a process-kill cut point while replaying the POSIX phase-one gateway publication journal so crash recovery is tested at each ownership boundary. | — | scripts/upgrade.sh — Kills the isolated journal-recovery helper at the selected publication cut pointcli/tests/test_upgrade_bridge_phase1_rollback.py — Drives deterministic crash-and-replay coverage for both recovery cut points |
DEFENSECLAW_TEST_PHASE1_ROLLBACK_CRASH | — | unset | after-state-restore, unset | Injects a process-kill cut point after POSIX phase-one state restoration but before controller artifact restoration so durable mixed-progress recovery is tested. | — | scripts/upgrade.sh — Kills the same-session rollback controller after exact source state is durablecli/tests/test_upgrade_bridge_phase1_rollback.py — Proves the next fresh recovery process accepts source root metadata and completes artifact restoration |
DEFENSECLAW_TEST_WAIT_PROCESS_EXIT | — | unset | 1, unset | Activate the short-lived helper subprocess used to verify that native Windows daemon shutdown waits on the original process handle. | — | internal/daemon/proc_windows_flags_test.go — Native Windows daemon test binary enters its delayed-exit helper mode |
DEFENSECLAW_TEST_WATCHDOG_WAIT_EXIT | — | unset | test-defined value, unset | Selects the native watchdog original-handle wait fixture. | — | internal/cli/watchdog_pidfile_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_TEST_WATCHDOG_WAIT_READY | — | unset | test-defined value, unset | Carries the readiness marker used by the native watchdog original-handle wait fixture. | — | internal/cli/watchdog_pidfile_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_TEST_WINDOWS_NOTIFICATION | — | unset | 1, unset | Enables the attended native Windows notification delivery test. | — | internal/notify/notify_windows_test.go — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_UNSIGNED_PE | — | unset | test-defined absolute path, unset | Carries an unsigned portable-executable fixture path to the native Authenticode evidence regression. | — | cli/tests/test_windows_installer_artifacts.py — Native Windows test fixture; never read by production runtime paths |
DEFENSECLAW_UPGRADE_TEST_MODE | — | unset | 1, unset | Explicitly enables the loopback-only unpublished release endpoint used by upgrade protocol release-candidate tests. | — | cli/defenseclaw/commands/cmd_upgrade.py — Gates the fresh-controller candidate release endpoint override |
DEFENSECLAW_UPGRADE_TEST_RELEASE_BASE_URL | — | unset | http://<numeric-loopback>:<port>[/path], unset | Carries a numeric-loopback HTTP release asset base URL across the fresh-controller handoff for unpublished candidate testing. | — | cli/defenseclaw/commands/cmd_upgrade.py — Overrides the GitHub release download base only when upgrade test mode is explicitly enabled |
DEFENSECLAW_V2_1177_RECREATE_LIVE | — | unset | test payload, unset | Recreates a live target during the CAS V2 1177 hard-exit regression fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 recreated-live fixture |
DEFENSECLAW_V2_FORCE_SHORT_REPAIR | — | unset | 1, unset | Forces deterministic short-name repair paths in native CAS V2 tests. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 short-name repair fixture |
DEFENSECLAW_V2_HARD_EXIT_ABORT | — | unset | 1, unset | Injects an abort decision into the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 abort fixture |
DEFENSECLAW_V2_HARD_EXIT_HELPER | — | unset | 1, unset | Selects the native CAS V2 hard-exit subprocess fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hard-exit fixture |
DEFENSECLAW_V2_HARD_EXIT_OCCURRENCE | — | 1 | positive decimal integer, unset | One-based phase occurrence at which the native CAS V2 fixture terminates its subprocess. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hard-exit occurrence selector |
DEFENSECLAW_V2_HARD_EXIT_OPERATION | — | unset | test-defined operation, unset | Mutation operation selected for the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 operation selector |
DEFENSECLAW_V2_HARD_EXIT_PATH | — | unset | absolute test target path, unset | Target path passed to the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hard-exit target |
DEFENSECLAW_V2_HARD_EXIT_PHASE | — | unset | test-defined CAS phase, unset | Durability phase at which the native CAS V2 fixture terminates its subprocess. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hard-exit phase selector |
DEFENSECLAW_V2_HARD_EXIT_RECOVER | — | unset | 1, unset | Requests recovery instead of a new mutation in the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 recovery selector |
DEFENSECLAW_V2_HARD_EXIT_SAFE_ABORT | — | unset | 1, unset | Injects a pre-publication safe abort into the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 safe-abort fixture |
DEFENSECLAW_V2_HARD_EXIT_STATE | — | unset | absolute test state path, unset | Recovery-state directory passed to the native CAS V2 hard-exit fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hard-exit state fixture |
DEFENSECLAW_V2_LOCK_EXIT_HELD | — | unset | 1, unset | Terminates the native CAS V2 lock fixture while the transaction lock remains held. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock hard-exit fixture |
DEFENSECLAW_V2_LOCK_HELPER | — | unset | 1, unset | Selects the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock fixture |
DEFENSECLAW_V2_LOCK_HIDE_TARGET | — | unset | 1, unset | Temporarily hides the live target in the native CAS V2 lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 hidden-target fixture |
DEFENSECLAW_V2_LOCK_HOLD_PHASE | — | unset | test-defined CAS phase, unset | CAS phase at which the native cross-process fixture holds its transaction lock. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock hold-phase selector |
DEFENSECLAW_V2_LOCK_ONLY | — | unset | 1, unset | Requests lock-only behavior from the native CAS V2 cross-process fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock-only selector |
DEFENSECLAW_V2_LOCK_PATH | — | unset | absolute test target path, unset | Target path passed to the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock target |
DEFENSECLAW_V2_LOCK_PAYLOAD | — | unset | test payload, unset | Mutation payload passed to the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock payload fixture |
DEFENSECLAW_V2_LOCK_READY | — | unset | absolute test marker path, unset | Ready-signal path shared with the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock readiness fixture |
DEFENSECLAW_V2_LOCK_RELEASE | — | unset | absolute test marker path, unset | Release-signal path shared with the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock release fixture |
DEFENSECLAW_V2_LOCK_STATE | — | unset | absolute test state path, unset | Recovery-state directory passed to the native CAS V2 cross-process lock fixture. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 lock state fixture |
DEFENSECLAW_V2_POST_P_REPARSE_TARGET | — | unset | absolute test target path, unset | Replacement reparse target injected after the CAS V2 publication point for fail-closed topology tests. | — | internal/gateway/connector/atomic_transform_v2_exit_windows_test.go — Native CAS V2 post-publication reparse fixture |
DEFENSECLAW_WINDOWS_PROCESS_HELPER | — | unset | 1, unset | Activate the isolated subprocess entry point used by native Windows process-snapshot tests. | — | internal/inventory/process_snapshot_windows_test.go — Native Windows test binary enters its named-process helper mode |
When in doubt
Run defenseclaw doctor. The doctor walks the same env-var resolution code paths as the running gateway and surfaces effective values plus any active opt-outs.
defenseclaw doctor
defenseclaw keys listReference
internal/envvars/registry.json— single source of truth.cli/defenseclaw/envvars.py— Python loader.internal/envvars/registry.go— Go loader.- Reference → Keys — credential resolution order.
- Reference → Redaction — v8 profiles and the explicitly labeled v7 compatibility controls.
- Reference → Fail modes —
DEFENSECLAW_FAIL_MODE/DEFENSECLAW_STRICT_AVAILABILITY.