Configuration

Generated from packages/envoy/cmd/dispatch/settings.go by docs/site/generators/dispatch-config.ts. Edit the source, not this page.

Dispatch’s server, envoy-dispatch, and its subcommands take the 83 Dispatch settings below from the environment. envoy-dispatch settings prints the same table from the binary you run.

The libraries Dispatch is built on read a few more variables for themselves, outside this table: HOME (where the data directory, ~/.local/share/dispatch, is, and the user envoy.json when XDG_CONFIG_HOME is unset or empty), libpq’s PG* variables (connection parameters DATABASE_URL leaves out), HTTP_PROXY, HTTPS_PROXY and NO_PROXY (outbound HTTP), SSL_CERT_FILE and SSL_CERT_DIR (the certificates Dispatch trusts), and the Go runtime’s GO* variables and TZ.

A setting with a file form can name a file that holds its value instead. When Dispatch reads that setting, the file’s trimmed contents win over the variable, and a file that cannot be read, or holds nothing, refuses startup.

envoy.json is read from two files: the user file, legion/envoy.json under XDG_CONFIG_HOME (~/.config when that is unset or empty; a path that is not absolute refuses startup), and the checkout’s file, .envoy/envoy.json in the directory Dispatch starts in, whose dispatch section is the only one Dispatch reads there: an envoy section in it refuses startup, naming it and the user file it belongs in (the agents’ clients ignore it with a notice instead), an askgate section in it is read by nothing, which the agents’ clients say in their start notice, and a .envoy that is a plain file counts as no checkout file. Where both set a dispatch key, the checkout’s file wins, and DISPATCH_SERVER_URL and NATS_URLS win over both. Dispatch reads envoy.natsUrls whatever envoy.enabled says, since enabled switches a session’s Envoy, not the server’s. The OpenCode-era files are not read. A user file still at ~/.config/opencode/envoy.json, with none at ~/.config/legion/envoy.json and XDG_CONFIG_HOME unset, empty or ~/.config, refuses startup, naming both paths and the move, whatever DISPATCH_SERVER_URL and NATS_URLS say; a checkout’s .opencode/envoy.json, while the checkout has no .envoy/envoy.json, is one WARN at start naming the rename. A file that carries a top-level natsUrls is refused, naming envoy.natsUrls; a JSON null at the top level, as a section or as any key’s value is refused, naming the key; and JSON that does not parse is refused naming the file, the line and the column, never the text it stopped at. These refusals stop every start, DISPATCH_NATS_DISABLED set or not.

The file’s three top-level sections are each a different reader’s. dispatch (enabled, serverUrl, token) configures Dispatch itself and every agent’s dispatch command. envoy (enabled, url, natsUrls, token, natsSeed) configures the Envoy listener an agent’s session connects to, and Dispatch reads envoy.natsUrls alone. askgate (enabled) switches AskGate, which reviews each Dispatch write of an agent’s main session before it posts: no section, or {"askgate":{"enabled":true}}, leaves it on, and {"askgate":{"enabled":false}} turns it off for that session. Only the session’s own user file switches AskGate: an askgate section in a checkout’s file is read by nothing, and the session says so at start. Dispatch’s server reads no askgate key in either file.

`DATABASE_URL`

Postgres connection string. The server migrates the database before serving; census, backfill-block-ids, backfill-anchor-blocks, backfill-files, rebuild-refs and stored-order read it too. A pool_max_conns parameter is refused.

Required: Yes

`DISPATCH_FILE_STORE_BUCKET`

Bucket uploaded files (images, attachments) are stored in, keyed by their SHA-256. gs://<bucket> is a Google Cloud Storage bucket, reached with Application Default Credentials (on GKE the pod’s Workload Identity principal), which needs storage.objects.create and storage.objects.get on it and nothing more; any other value is an S3 bucket’s name, and the AWS SDK finds its region and credentials itself (AWS_*, the shared config files, the task role). backfill-files reads it too and opens the same store. Unset, every upload’s bytes stay in Postgres, as before the bucket existed.

Required: No

`DISPATCH_AGENT_TOKEN`

Shared bearer token an agent may authenticate with: one value, or several separated by whitespace while it rotates, the first the current one, all accepted. Personal tokens minted in Settings are the usual agent credential.

Required: Yes

`DISPATCH_IDENTITY`

How a browser request names its person: cookie (a signed session cookie, issued by Google sign-in through a Cognito sign-in pool or with Google directly where the DISPATCH_SIGNIN_* settings configure one, and issued by nothing where they are unset, so no person signs in and the server serves its agent-token API alone) or header:<Header-Name> (tests and local harnesses only: the header names the person by email).

Required: No
When unset: cookie

`DISPATCH_SIGNIN_ISSUER`

OpenID Connect issuer people sign in through: a Cognito sign-in pool, with DISPATCH_SIGNIN_GROUP, or Google itself (https://accounts.google.com), with DISPATCH_SIGNIN_DOMAIN; Dispatch reads its endpoints from the issuer’s discovery document in the background from startup, and until then answers a sign-in 503 SIGNIN_UNAVAILABLE. Google sign-in takes the issuer, client ID, client secret and exactly one of the group or the domain, or none of them, and header identity and dev sign-in refuse every one of them.

Required: When another DISPATCH_SIGNIN_* setting is set; with none of them set the server boots and runs no browser sign-in

`DISPATCH_SIGNIN_CLIENT_ID`

Client ID of Dispatch’s confidential client at the issuer: the sign-in pool’s app client, or a Google OAuth web client.

Required: When another DISPATCH_SIGNIN_* setting is set; with none of them set the server boots and runs no browser sign-in

`DISPATCH_SIGNIN_CLIENT_SECRET`

Client secret of that client.

Required: When another DISPATCH_SIGNIN_* setting is set; with none of them set the server boots and runs no browser sign-in

`DISPATCH_SIGNIN_GROUP`

The pool group (cognito:groups) a person must be in to sign in through a Cognito sign-in pool; refused with Google’s issuer. Dispatch confirms the membership at least hourly, and a person no longer in it loses every browser session.

Required: When another DISPATCH_SIGNIN_* setting is set and DISPATCH_SIGNIN_DOMAIN is unset; with none of them set the server boots and runs no browser sign-in

`DISPATCH_SIGNIN_DOMAIN`

The Google Workspace domain whose people may sign in with Google, a lowercase domain name such as example.com; it needs DISPATCH_SIGNIN_ISSUER https://accounts.google.com, and a Google web client whose OAuth consent screen is Internal. Name the organization’s primary domain, which Google puts in hd for every account of the organization: a secondary domain admits nobody, and a member whose address is on a secondary domain signs in under that address. A person signs in when their Google ID token’s hd is this domain and Google has verified their email; Dispatch confirms that at least hourly, and a person no longer in it loses every browser session.

Required: When another DISPATCH_SIGNIN_* setting is set and DISPATCH_SIGNIN_GROUP is unset; with none of them set the server boots and runs no browser sign-in

`DISPATCH_IDENTITY_HEADER_TRUSTED`

Set to 1 to acknowledge header identity, which is for tests and local harnesses only; without it a header-identity server refuses to start.

Required: When DISPATCH_IDENTITY is a header

`DISPATCH_LISTEN_HOST`

Host the server binds; an IPv6 host may be written with or without brackets. With DISPATCH_LISTEN_FD set the server binds nothing, and a set host must be the IP address of the socket that names; an empty one is unset.

Required: No
When unset: Every interface

`DISPATCH_PORT`

Port the server binds. With DISPATCH_LISTEN_FD set the server binds nothing, and a set port must be the port of the socket that names; an empty one is unset.

Required: No
When unset: 8766

`DISPATCH_LISTEN_FD`

An inherited listening TCP socket (descriptor number) the server serves on instead of binding; for test harnesses that hold the port. DISPATCH_PORT and DISPATCH_LISTEN_HOST, when set and not empty, must name the socket’s address; DISPATCH_SERVER_URL is not derived from it. A descriptor that is not a listening TCP socket refuses startup, and the server binds nothing in its place.

Required: No

`DISPATCH_PPROF_PORT`

Port on 127.0.0.1 the Go profiler (net/http/pprof, under /debug/pprof/) and the process’s expvar variables (/debug/vars, the document rooms’ figures as dispatch_rooms) listen on, reachable only from inside the pod or through kubectl port-forward; unset or empty, nothing listens. A value that is not a port 1-65535 refuses startup.

Required: No

`DISPATCH_MAX_LIVE_ROOMS`

Most document rooms the server holds in memory at once; a document socket that would open one more is refused (503) until a room goes. A positive integer.

Required: No
When unset: 1000

`DISPATCH_MAX_DOC_CONNECTIONS`

Most browser connections to document rooms the server holds at once; one more document socket is refused (503) until one leaves. A positive integer.

Required: No
When unset: 1000

`XDG_CONFIG_HOME`

Directory whose legion/envoy.json is the user envoy.json, which DISPATCH_SERVER_URL and NATS_URLS fall back to; set but empty, it is ~/.config too, and a path that is not absolute refuses startup.

Required: No
When unset: ~/.config

`DISPATCH_SERVER_URL`

The origin people open in a browser, and, where the DISPATCH_SIGNIN_* settings configure browser sign-in, the sign-in callback origin (<origin>/auth/callback): an absolute http(s) URL with no path. Set, it overrides envoy.json; set but empty, it refuses startup.

Required: No
When unset: dispatch.serverUrl from envoy.json

`NATS_URLS`

Comma-separated NATS server URLs. Set, it overrides envoy.json; set but empty, it refuses startup.

Required: No
When unset: envoy.natsUrls from envoy.json

`ENVOY_ALLOW_REMOTE_NATS`

Set to 1 to let Dispatch reach a NATS server that is not on this machine; without it Dispatch refuses one, and every deployment sets it.

Required: No

`NATS_NKEY_SEED`

Nkey seed of the NATS user Dispatch connects as; unset, it connects with no credential. A set but unusable seed refuses startup.

Required: No
File form: NATS_NKEY_SEED_FILE

`ENVOY_NATS_SOCKS5_PROXY`

SOCKS5 proxy, as host:port, that every NATS connection Dispatch makes goes through, each server’s host name handed to the proxy unresolved; unset, Dispatch dials NATS directly. A set proxy needs ENVOY_ALLOW_REMOTE_NATS=1, since the proxy chooses the server. A deployment that reaches NATS through a tailnet sidecar’s SOCKS5 server (tailscaled’s TS_SOCKS5_SERVER) sets it.

Required: No

`ENVOY_NATS_REPLICAS`

The deployment’s NATS replica count, a whole number from 1 to 5: the ENVOY_NOTIFICATIONS stream and the webhook redelivery bucket are created with this many copies, and one found with fewer is raised to it at start and again every 30 seconds while Dispatch runs. More than 1 needs a clustered NATS. Every Envoy program of a deployment carries the same value, so a clustered deployment sets it in every envoy-listener and in Dispatch: a start with a lower or unset value can lower the stream’s copies until a program with the higher one raises them back. Lowering copies needs every program’s value lowered first. redeliver-webhooks reads it too. Any other value refuses startup; a server’s refusal of the copies does not, since Dispatch connects in the background and reconciles the stream on its first connection, retrying until that reconcile succeeds, and is logged with ENVOY_NATS_REPLICAS=<n> as the warning envoy nats reconnect hook failed; it is retried while that reconcile has been due for less than a minute, and as the error envoy nats reconnect hooks have not succeeded from a minute on; the minute runs from Dispatch’s first connection to NATS, not from the first retry, and stall_ms on both lines is how long the reconcile has been due; a refused redelivery bucket logs webhook redelivery sweep failed.

Required: No
When unset: 1

`ENVOY_STREAM_MAX_BYTES`

Byte limit of the ENVOY_NOTIFICATIONS stream, a positive whole number of bytes: once the stream holds that much it refuses every new publish, and the sender gets an error it can retry (stream ENVOY_NOTIFICATIONS is full: the outbox retries the event with its backoff, and the listener answers a GitHub webhook 503), while a stored message leaves only by age, after 72 hours. Size it above what the stream takes in 72 hours at its busiest. Set, Dispatch raises a smaller limit, or none, to it at start and again every 30 seconds, and never lowers a deployed limit, so an operator’s raise of a full stream stands. Unset, Dispatch creates the stream with no byte limit and keeps the one a deployed stream has. Programs with different values do not fight: the largest stands, so a clustered deployment sets the same value in every envoy-listener and in Dispatch. A concurrent start can put back a smaller limit it read until a program with the larger one raises it back. Lowering or removing the limit needs every program’s value lowered or removed first. Any other value refuses startup; a limit the NATS server cannot reserve does not, since Dispatch connects in the background and reconciles the stream on its first connection, retrying until that reconcile succeeds, and is logged with ENVOY_STREAM_MAX_BYTES=<n> as the warning envoy nats reconnect hook failed; it is retried while that reconcile has been due for less than a minute, and as the error envoy nats reconnect hooks have not succeeded from a minute on; the minute runs from Dispatch’s first connection to NATS, not from the first retry, and stall_ms on both lines is how long the reconcile has been due.

Required: No

`DISPATCH_NATS_DISABLED`

Set to 1 to run without NATS: no event is published, and the agent conversation relay and webhook redelivery are off.

Required: No

`ENVOY_URL`

Base URL of the Envoy listener Dispatch delivers mentions and messages through and reads live sessions from.

Required: No
When unset: http://127.0.0.1:9020

`ENVOY_TOKEN`

Bearer token Dispatch sends on every Envoy listener call; unset, it sends none.

Required: No

`ENVOY_SESSION_LIVE_WINDOW`

How long after its last registration a session counts as live, as a positive Go duration. Dispatch judges a role route’s holder by it, as the Envoy listener judges every session: within it the holder is live and the event is forwarded. Give the listeners of a deployment and Dispatch the same value, or Dispatch calls a holder the listener still serves lapsed, and the other way round. A value that is not a positive duration refuses startup; one no Go duration can be read from is a warning and the default.

Required: No
When unset: 5m

`ENVOY_SESSION_GONE_HORIZON`

How long after its last registration a session reads unresponsive before it reads gone, as a positive Go duration. Dispatch holds a role-routed event pending for an unresponsive holder, with its claim untouched, and counts the route reached with nothing sent only for a gone one. Give the listeners of a deployment and Dispatch the same value: with a horizon only the listener carries, Dispatch marks an event sent to nobody while the listener still calls that holder unresponsive and keeps its role, so the event reaches it never. A value that is not a positive duration refuses startup; one no Go duration can be read from is a warning and the default.

Required: No
When unset: 1h

`DISPATCH_REPO_PROJECTS`

Comma-separated owner/repo=KEY mappings seeded at startup; a mapping saved in the dashboard wins.

Required: No

`DISPATCH_DEFAULT_PROJECT`

Project an external issue from an unmapped repository is created in; it must already exist.

Required: No

`DISPATCH_NEW_ISSUE_LABEL`

Label an issue carries that the search bar files from the words a person typed, when those words match nothing the bar found; it is added to that issue alone.

Required: No
When unset: The issue carries no label

`DISPATCH_NEW_ISSUE_SESSION`

Envoy session an issue the search bar files from a person’s typed words is routed to, written as the session’s own id: the bar sets the issue’s route to it and posts the person’s words to it as the issue’s first message.

Required: No
When unset: The issue is made and no conversation is started on it

`DISPATCH_APP_CLIENT_ID`

GitHub App client ID, which names the App in the JWT its private key signs. Set, the App comes from the DISPATCH_APP_* variables instead of ~/.local/share/dispatch/app.json.

Required: No

`DISPATCH_APP_PEM_B64`

GitHub App private key, as a PEM or the base64 of a PEM, which signs every App call: the web app’s GitHub reads, the architecture import, webhook redelivery and the CI reconcile pass are off without one.

Required: No

`DISPATCH_APP_ID`

The GitHub App’s numeric ID.

Required: No

`DISPATCH_REVIEWER_APP_ID`

The review App’s numeric ID, the App that posts the tester and architect verdict check runs, which the CI reconcile pass compares a check run’s app.id against; unset, the pass records no verdict check run.

Required: No

`DISPATCH_APP_SLUG`

The GitHub App’s slug.

Required: No

`DISPATCH_APP_NAME`

The GitHub App’s display name.

Required: No

`DISPATCH_GITHUB_API_BASE`

GitHub API origin the App calls; tests point it at a fake. redeliver-webhooks reads it too.

Required: No
When unset: https://api.github.com

`DISPATCH_SIGNING_KEY`

One or more HMAC keys separated by whitespace, which sign session cookies and seal the refresh tokens Dispatch stores: the first signs and seals, and every one verifies a cookie and opens a seal. Every server process takes the same keys, and one whose keys a live server process does not share refuses to start. Dropping the key a cookie or seal was made under signs its person out; to rotate, add the new key second, then move it first, then remove the old key no sooner than 30 days later.

Required: No
When unset: A key kept in ~/.local/share/dispatch/signing-key, created on first start

`DISPATCH_INSECURE_COOKIE`

Any value drops the Secure attribute from Dispatch’s cookies, for browsers that reach it over plain http.

Required: No

`DISPATCH_OIDC_ISSUER`

OIDC issuer whose projected service-account tokens authenticate as agents.

Required: When DISPATCH_OIDC_AUDIENCE is set

`DISPATCH_OIDC_AUDIENCE`

Audience those service-account tokens must carry.

Required: When DISPATCH_OIDC_ISSUER is set

`DISPATCH_AGENT_SECRETS_URL`

Base URL of the secrets broker’s API, an absolute http(s) URL with no path; set, the credential-request pages are on.

Required: No

`DISPATCH_AGENT_SECRETS_ACCOUNT_TOKEN_FILE`

File holding Dispatch’s own projected Kubernetes service-account token, which every call to the secrets broker presents; the broker verifies it and reads the caller from BROKER_API_ACCOUNTS. In the cluster it is the projected-token volume’s path (/var/run/secrets/…/token), which the kubelet rewrites in place; the file is read at call time, so a rotation needs no restart, and a local run writes a token into a file of its own and names that.

Required: When DISPATCH_AGENT_SECRETS_URL is set

`DISPATCH_EMBEDDER`

Where meaning search reaches Cohere Embed v4: bedrock (AWS Bedrock, on the AWS SDK’s own region and credentials; with no region, search is keyword-only) or azure (Azure AI Foundry, configured by the DISPATCH_AZURE_EMBED_* settings, each of which bedrock refuses, and by the shared Azure sign-in, which DISPATCH_ANSWERER=azure reads too).

Required: No
When unset: bedrock

`DISPATCH_AZURE_EMBED_ENDPOINT`

The base URL the embeddings route is appended to, such as https://<resource>.services.ai.azure.com/models: an absolute https URL with a host and no query or fragment.

Required: When DISPATCH_EMBEDDER is azure

`DISPATCH_AZURE_EMBED_DEPLOYMENT`

Name of the Cohere Embed v4 deployment the endpoint serves, sent as each request’s model.

Required: No
When unset: embed-v-4-0

`DISPATCH_AZURE_EMBED_TOKENS_PER_MINUTE`

The deployment’s tokens-per-minute quota, a positive integer; background embedding takes two thirds of it, leaving the rest to search queries.

Required: When DISPATCH_EMBEDDER is azure

`DISPATCH_AZURE_EMBED_KEY`

The deployment’s API key, the key form of credential; refused alongside the keyless sign-in (DISPATCH_AZURE_TENANT_ID, DISPATCH_AZURE_CLIENT_ID, DISPATCH_AZURE_FEDERATED_TOKEN_FILE).

Required: When DISPATCH_EMBEDDER is azure and the keyless sign-in is unset
File form: DISPATCH_AZURE_EMBED_KEY_FILE

`DISPATCH_AZURE_TENANT_ID`

Microsoft Entra tenant of the identity Dispatch signs in to Azure as, the keyless form of credential: it, DISPATCH_AZURE_CLIENT_ID and DISPATCH_AZURE_FEDERATED_TOKEN_FILE are set together or not at all. The embedder and the answerer share the three, read by whichever of them is azure, so a deployment that embeds on Bedrock and answers on Azure sets them for the answerer.

Required: When DISPATCH_EMBEDDER or DISPATCH_ANSWERER is azure, except with DISPATCH_AZURE_EMBED_KEY set for the embedder alone

`DISPATCH_AZURE_CLIENT_ID`

Client ID of that identity, whose federated credential trusts the token DISPATCH_AZURE_FEDERATED_TOKEN_FILE holds.

Required: When DISPATCH_EMBEDDER or DISPATCH_ANSWERER is azure, except with DISPATCH_AZURE_EMBED_KEY set for the embedder alone

`DISPATCH_AZURE_FEDERATED_TOKEN_FILE`

Path of the federated token (a Kubernetes projected service-account token) Dispatch exchanges with Entra for an Azure access token; re-read on every exchange, since the token rotates.

Required: When DISPATCH_EMBEDDER or DISPATCH_ANSWERER is azure, except with DISPATCH_AZURE_EMBED_KEY set for the embedder alone

`DISPATCH_ANSWERER`

Where Dispatch’s server generates text: azure (a chat deployment of an Azure AI Foundry resource, configured by the DISPATCH_AZURE_CHAT_* settings and the shared Azure sign-in) or endpoint (any OpenAI-shaped chat completions service, configured by the DISPATCH_CHAT_* settings). Unset, no model is configured and the server starts and says so; each group is refused by the place that does not read it.

Required: No

`DISPATCH_AZURE_CHAT_ENDPOINT`

The base URL /chat/completions is appended to, such as https://<resource>.services.ai.azure.com/models: an absolute https URL with a host and no query or fragment.

Required: When DISPATCH_ANSWERER is azure

`DISPATCH_AZURE_CHAT_DEPLOYMENT`

Name of the chat deployment the endpoint serves, sent as each request’s model.

Required: When DISPATCH_ANSWERER is azure

`DISPATCH_AZURE_CHAT_API_VERSION`

The api-version query value each request carries, such as 2024-05-01-preview; unset, a request sends no api-version, which is what the Azure OpenAI endpoint takes.

Required: No

`DISPATCH_AZURE_CHAT_SCOPE`

The token scope the federated sign-in asks for. It is configuration because one Azure AI Foundry resource serves two inference families: the models inference endpoint (https://<resource>.services.ai.azure.com/models, an api-version, scope https://cognitiveservices.azure.com/.default) and the Azure OpenAI endpoint (https://<resource>.services.ai.azure.com/openai/v1, no api-version, scope https://ai.azure.com/.default), and which of the two a deployment serves is named by that deployment rather than here.

Required: No
When unset: https://cognitiveservices.azure.com/.default, the scope the embedder asks for

`DISPATCH_AZURE_CHAT_TOKENS_PER_MINUTE`

The deployment’s tokens-per-minute quota, a positive integer, which paces the answerer’s calls.

Required: When DISPATCH_ANSWERER is azure

`DISPATCH_CHAT_ENDPOINT`

The base URL /chat/completions is appended to: an absolute https URL with a host and no query or fragment.

Required: When DISPATCH_ANSWERER is endpoint

`DISPATCH_CHAT_TOKEN_FILE`

Path of the file holding the bearer token every call to that endpoint presents, re-read on each call, as DISPATCH_AZURE_FEDERATED_TOKEN_FILE is, so a rotation needs no restart. It names a file rather than being the _FILE form of a value: there is no DISPATCH_CHAT_TOKEN.

Required: When DISPATCH_ANSWERER is endpoint

`DISPATCH_CHAT_MODEL`

The model each request names.

Required: When DISPATCH_ANSWERER is endpoint

`DISPATCH_WEB_DIST`

Directory of the built dashboard the server serves.

Required: No
When unset: The packages/dispatch/web/dist directory found from the binary’s location

`DISPATCH_DEV_SIGNIN`

Set to 1 on a loopback-only local server to sign anyone in by email at /auth/_dev/signin without the sign-in issuer; refused alongside any DISPATCH_SIGNIN_* setting, DISPATCH_SIGNIN_DOMAIN included.

Required: No

`DISPATCH_DEV_SIGNIN_SHARED_KEY`

With DISPATCH_DEV_SIGNIN=1, a secret every process of one local harness is given, so a session cookie one of them mints is accepted by the others; each signs with HMAC-SHA256 of it under a dev-only label, never with the value itself, so no value placed here signs a cookie a production server accepts. Refused without DISPATCH_DEV_SIGNIN=1.

Required: No
When unset: A key generated for each process

`DISPATCH_DEV_EMBEDDER`

Set to 1 on a local harness to embed meaning search’s text by hashing its words, in the process and calling no model service, so searching by meaning works with no AWS or Azure account. Its vectors say only how many words two texts share, and the identity it records (dev:…) keeps them apart from a model’s. Refused without DISPATCH_DEV_SIGNIN=1, and refused alongside DISPATCH_EMBEDDER and the DISPATCH_AZURE_* settings.

Required: No

`DISPATCH_TEST_HOOKS`

Set to 1 to mount the end-to-end tests’ hook routes; never in a real deployment.

Required: No

`DISPATCH_TEST_SETTLE_DELAY`

Document settlement delay for an end-to-end test process; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 2s

`DISPATCH_TEST_MARK_WAIT`

How long a mark a browser says it wrote is waited for before the server answers that the document does not hold it, for an end-to-end test process; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 1s

`DISPATCH_TEST_UNRECORDED_MARK_TTL`

How long a mark no comment, ask or suggestion records is kept before the settlement sweep expires it, for an end-to-end test process; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 1m0s

`DISPATCH_TEST_ROUTE_ROSTER_TTL`

How long a test process’s stored listener answer serves issue reads’ route_status and GET /api/v1/agents; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 5s

`DISPATCH_TEST_LISTENER_TAKEOVER_WINDOW`

How long a test process’s sender keeps trying a listener that is being replaced before a send to a session that is gone settles failed; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 12s

`DISPATCH_TEST_HORIZON_STALL_AFTER`

How long a test process’s pending event-horizon observation waits before the process logs its stall warning, in place of the five seconds a deployment waits; a positive Go duration, for an end-to-end test whose own wait keys on that warning. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 5s

`DISPATCH_TEST_HORIZON_WARN_EVERY`

How often a test process repeats each of its three event-horizon warnings (the stall warning while the stall stands, the failed-observation warning and the failed-persist warning), in place of the thirty seconds a deployment repeats them at; a positive Go duration, for an end-to-end test whose own wait keys on the stall warning. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 30s

`DISPATCH_TEST_EDIT_NOTICE_QUIET`

How long a document stays quiet after a person’s last settled version before its artifact.human_edited notice goes, for an end-to-end test process; a positive Go duration. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 30s

`DISPATCH_TEST_ROSTER_UNCACHED`

Set to 1 so every read of the listener’s session list (an issue’s route_status, GET /api/v1/agents) asks the listener rather than Dispatch’s five-second copy, for an end-to-end test process whose fake listener changes between reads. Set only with DISPATCH_TEST_HOOKS=1.

Required: No

`DISPATCH_TEST_EMBEDDER_OFF`

Set to 1 so the server builds no embedder whatever DISPATCH_EMBEDDER and the AWS SDK’s own variables would have built: meaning search answers keyword-only and says so, and the embedding queue does nothing, for an end-to-end test process whose AWS variables address a file store rather than a model service. Set only with DISPATCH_TEST_HOOKS=1.

Required: No

`DISPATCH_TEST_RECONCILE_AT_START`

Set to 1 so a test process runs the delivery reconcile’s first pass as it starts, rather than at a random moment within its first 5 minutes, for an end-to-end test that must see a pass inside its window. Set only with DISPATCH_TEST_HOOKS=1.

Required: No

`DISPATCH_TEST_CI_RECONCILE_INTERVAL`

How often a test process’s CI reconcile pass runs, in place of the five minutes a deployment runs it at; a positive Go duration, for an end-to-end test only and never a real deployment. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 5m

`DISPATCH_TEST_DELIVERY_RECONCILE_INTERVAL`

How often a test process’s delivery reconcile pass runs, in place of the five minutes a deployment runs it at; a positive Go duration, for an end-to-end test only and never a real deployment. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 5m

`DISPATCH_TEST_MAINTENANCE_SWEEP_INTERVAL`

How often a test process’s maintenance sweep runs - the Idempotency-Keys and spent DPoP proofs past their windows, and the deliveries a process that died left owed - in place of the minute a deployment runs it at; a positive Go duration, for an end-to-end test only and never a real deployment. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 1m

`DISPATCH_TEST_PROCESS_HEARTBEAT`

How often a test process stamps its row in the registry of live server processes, in place of the five seconds a deployment runs it at; the live window a heartbeat is judged by stays three of it, so no run can set a window shorter than its own heartbeat, and a process refused at boot waits that window and one heartbeat for its refuser to lapse. A positive Go duration, for an end-to-end test only and never a real deployment. Set only with DISPATCH_TEST_HOOKS=1.

Required: No
When unset: 5s