Configuration

Configuration Sources

Boot configuration comes from environment variables; everything else is managed through the settings control plane at runtime. This split keeps secrets out of the runtime store while keeping operational tuning auditable.

Environment Variables

KAVACH_DATABASE_URL=postgres://...
KAVACH_GRAPH_URL=bolt://...
KAVACH_OTEL_ENDPOINT=http://collector:4317
KAVACH_LOG_LEVEL=info

# Durable Replay Management
KAVACH_REPLAY_REPOSITORY=sqlite
KAVACH_REPLAY_SQLITE_PATH=/var/lib/kavach/kavach.db
KAVACH_REPLAY_EXECUTION_CATALOG_BACKEND=sqlite
KAVACH_REPLAY_EXECUTION_CATALOG_SQLITE_PATH=/var/lib/kavach/kavach.db
KAVACH_REPLAY_EVALUATION_PROVIDER=mock
KAVACH_RUN_REPLAY_WORKER=false
KAVACH_WORKER_POLL_SECONDS=1
KAVACH_WORKER_LEASE_SECONDS=300

Common Keys

• evaluation.parallelism — max concurrent evaluations.
• jobs.retry.max_attempts — retry budget per job.
• replay.evaluation.max_attempts — retry budget for the separate replay-evaluation job.
• replay.drift.threshold_policy — thresholds applied when replay evidence is compared with a compatible source baseline.
• projection.reconcile_interval — graph reconciliation cadence.
• audit.retention_days — audit log retention window.

Precedence

Runtime settings resolve environment over tenant over system scope. Environment variables apply only to boot-time concerns such as datastore connections and cannot override runtime governance settings.