MAC environment configuration reference

Generated by scripts/generate-env-config-registry.py. Do not edit by hand. Defaults shown as consumer-defined are intentionally owned by the calling subsystem; the registry does not invent a second default.

Variable	Type	Default	Family	Description
MAC_ACTIVE_CODING_AGENT	str	consumer-defined	core	Set by the executor for one run, never by an operator: the coding CLI it chose from the list.
MAC_AGENT_ATTESTATION_KEY	str	consumer-defined	agent	Agent setting: agent attestation key.
MAC_AGENT_COMMAND_EXIT_GRACE_SECONDS	int	consumer-defined	agent	Agent setting: agent command exit grace seconds.
MAC_AGENT_DIR	str	consumer-defined	agent	Agent setting: agent dir.
MAC_AGENT_GEN_AUDIO_BASE_URL	str	consumer-defined	agent	Agent setting: agent gen audio base url.
MAC_AGENT_GEN_AUDIO_MODELS	str	consumer-defined	agent	Agent setting: agent gen audio models.
MAC_AGENT_GEN_AUDIO_PORT	int	consumer-defined	agent	Agent setting: agent gen audio port.
MAC_AGENT_GEN_BASE_URL	str	consumer-defined	agent	Agent setting: agent gen base url.
MAC_AGENT_GEN_HOST	str	consumer-defined	agent	Agent setting: agent gen host.
MAC_AGENT_GEN_MODEL	str	consumer-defined	agent	Agent setting: agent gen model.
MAC_AGENT_GEN_PORT	int	consumer-defined	agent	Agent setting: agent gen port.
MAC_AGENT_GEN_VIDEO_BASE_URL	str	consumer-defined	agent	Agent setting: agent gen video base url.
MAC_AGENT_GEN_VIDEO_MODELS	str	consumer-defined	agent	Agent setting: agent gen video models.
MAC_AGENT_GEN_VIDEO_PORT	int	consumer-defined	agent	Agent setting: agent gen video port.
MAC_AGENT_ID	str	consumer-defined	agent	Agent setting: agent id.
MAC_AGENT_MEDIA_ROUTES	str	consumer-defined	agent	Agent setting: agent media routes.
MAC_AGENT_NAME	str	consumer-defined	agent	Agent setting: agent name.
MAC_AGENT_PYTHON	str	consumer-defined	agent	Agent setting: agent python.
MAC_AGENT_QUARANTINE_THRESHOLD	int	consumer-defined	agent	Agent setting: agent quarantine threshold.
MAC_AGENT_RECONCILE_RUNTIME_DEPS	bool	consumer-defined	agent	Agent setting: agent reconcile runtime deps.
MAC_AGENT_SERVICE_NAME	str	consumer-defined	agent	Agent setting: agent service name.
MAC_AGENT_STALE_AFTER_SECONDS	int	consumer-defined	agent	Agent setting: agent stale after seconds.
MAC_AGENT_STATE_DIR	str	consumer-defined	agent	Agent setting: agent state dir.
MAC_AGENT_ZOMBIE_STREAM_AGE_SECONDS	int	consumer-defined	agent	Agent setting: agent zombie stream age seconds.
MAC_API_ALLOW_OPEN	bool	consumer-defined	api-auth	Api Auth setting: api allow open.
MAC_API_TIMEOUT_SECONDS	int	consumer-defined	api-auth	Api Auth setting: api timeout seconds.
MAC_API_TOKEN	str	consumer-defined	api-auth	Api Auth setting: api token.
MAC_API_TOKENS	str	consumer-defined	api-auth	Api Auth setting: api tokens.
MAC_API_TOKEN__JORDANH_HUB	str	consumer-defined	api-auth	Api Auth setting: api token jordanh hub.
MAC_API_URL	str	consumer-defined	api-auth	Api Auth setting: api url.
MAC_ATTESTATION_HEAL_MIN_SECONDS	int	consumer-defined	core	Core setting: attestation heal min seconds.
MAC_ATTESTATION_KEY	str	consumer-defined	core	Core setting: attestation key.
MAC_ATTESTATION_KEY_ENV	str	consumer-defined	core	Core setting: attestation key env.
MAC_AUTO_REGISTER_FLEET	bool	consumer-defined	core	Core setting: auto register fleet.
MAC_BASH_CONTRACT_OK	bool	consumer-defined	core	Core setting: bash contract ok.
MAC_BEADS_BRIDGE_HUB_AGENT	str	consumer-defined	core	Retired beads bridge selector; ignored by current hub-agent resolution.
MAC_BIN	str	consumer-defined	core	Core setting: bin.
MAC_BIND_HOST	str	consumer-defined	core	Core setting: bind host.
MAC_BLOCKED_ATTEMPT_RETRY_BACKOFF_SECONDS	int	consumer-defined	core	Core setting: blocked attempt retry backoff seconds.
MAC_BUS_TASK_CONTEXT_EVENTS	str	consumer-defined	core	Core setting: bus task context events.
MAC_CERTIFIER_CANDIDATE_SRC	str	consumer-defined	core	Core setting: certifier candidate src.
MAC_CERTIFIER_CONTEXT_DIGEST	str	consumer-defined	core	Core setting: certifier context digest.
MAC_CERTIFIER_IMAGE	str	consumer-defined	core	Core setting: certifier image.
MAC_CERTIFIER_PLATFORM	str	consumer-defined	core	Core setting: certifier platform.
MAC_CERTIFIER_SOURCE_REVISION	str	consumer-defined	core	Core setting: certifier source revision.
MAC_CERTIFIER_STATUS_COMMAND_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: certifier status command timeout seconds.
MAC_CERTIFIER_TUNNEL_HEALTH_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: certifier tunnel health timeout seconds.
MAC_CHAT_GATEWAY_IMPL	str	consumer-defined	core	Core setting: chat gateway impl.
MAC_CLAUDE_CONTINUATION_ROUNDS	str	consumer-defined	core	Core setting: claude continuation rounds.
MAC_CLAUDE_MAX_TURNS	str	consumer-defined	core	Core setting: claude max turns.
MAC_CLAUDE_MODEL	str	consumer-defined	core	Hub setting, inherited by workers with the coding-CLI list: the model Claude Code runs on through the hub's /v1/messages (default claude-opus-4-8). A task pin that names a Claude model wins.
MAC_CLIENT_CREDENTIALS_DIR	str	consumer-defined	core	Core setting: client credentials dir.
MAC_CLIENT_CREDENTIAL_TTL_SECONDS	int	consumer-defined	core	Core setting: client credential ttl seconds.
MAC_CLIENT_PRINCIPALS_AUDIT_FILE	str	consumer-defined	client-auth	Client Auth setting: client principals audit file.
MAC_CLIENT_PRINCIPALS_FILE	str	consumer-defined	client-auth	Client Auth setting: client principals file.
MAC_CLIENT_PROFILES_DIR	str	consumer-defined	core	Core setting: client profiles dir.
MAC_CODING_AGENT	str	consumer-defined	core	Deprecated. off (or none, 0) still disables the coding route so the executor fails closed. A CLI name is honoured only when no MAC_CODING_AGENTS list exists anywhere, and is reported as deprecated: set the ordered list on the hub instead.
MAC_CODING_AGENTS	str	opencode	core	Hub setting: the fleet's ordered list of coding CLIs (comma-separated; known: opencode, claude; default opencode). The hub projects it into every assignment and returns it on every heartbeat, so workers inherit it. The executor runs the first CLI that works on that host and moves to the next only on a structured route failure (binary missing, no hub token, failed in-sandbox preflight, or an auth, rate-limit or upstream failure the hub router recorded for that CLI's route). On a worker it is read only when the hub has issued no list, and is reported as a local override.
MAC_CODING_AGENT_PREFLIGHT_FAILURE_TTL_SECONDS	int	consumer-defined	coding-agent-auth	Coding Agent Auth setting: coding agent preflight failure ttl seconds.
MAC_CODING_AGENT_PREFLIGHT_TIMEOUT	int	consumer-defined	coding-agent-auth	Coding Agent Auth setting: coding agent preflight timeout.
MAC_CODING_AGENT_PREFLIGHT_TTL_SECONDS	int	consumer-defined	coding-agent-auth	Coding Agent Auth setting: coding agent preflight ttl seconds.
MAC_CODING_AGENT_SANDBOX	str	consumer-defined	coding-agent-auth	Coding Agent Auth setting: coding agent sandbox.
MAC_CODING_AGENT_SANDBOX_OK	bool	consumer-defined	coding-agent-auth	Coding Agent Auth setting: coding agent sandbox ok.
MAC_CODING_DEFAULT_MODEL	str	gpt-5.6-sol	core	Logical router model opencode runs on (--model machub/<name>) when the task does not pin one with MAC_TASK_MODEL.
MAC_CODING_MODELS	str	gpt-5.6-sol	core	Comma-separated logical model names the generated opencode config declares under its one provider, machub (the hub router at $MAC_HUB_URL/v1). Each must be a model the hub's MAC_ROUTER_PROVIDERS aliases. The task's own model is always added.
MAC_CODING_ROUTE_MAX_AGE_SECONDS	int	consumer-defined	coding-route	Coding Route setting: coding route max age seconds.
MAC_COMMAND_AUDIT_RETENTION_SECONDS	int	consumer-defined	core	Core setting: command audit retention seconds.
MAC_COMMAND_ID	str	consumer-defined	core	Core setting: command id.
MAC_CONTRACT_GIT	str	consumer-defined	core	Core setting: contract git.
MAC_CONTRACT_RUNTIME_VENV	str	consumer-defined	core	Core setting: contract runtime venv.
MAC_CONTROL_PLANE_DB_PASSWORD	str	consumer-defined	core	Core setting: control plane db password.
MAC_CONTROL_PLANE_ROLE	str	consumer-defined	core	Core setting: control plane role.
MAC_CRASH_CORE_MAX_BYTES	int	consumer-defined	core	Core setting: crash core max bytes.
MAC_CRASH_CORE_RETAIN_COUNT	int	consumer-defined	core	Core setting: crash core retain count.
MAC_CRASH_SPOOL_DIR	str	consumer-defined	core	Core setting: crash spool dir.
MAC_CREDENTIAL_RENEW_AT_FRACTION	str	consumer-defined	core	Core setting: credential renew at fraction.
MAC_DATABASE_URL	str	consumer-defined	core	Core setting: database url.
MAC_DB	str	consumer-defined	core	Core setting: db.
MAC_DEAD_CODE_MIN_CONFIDENCE	str	consumer-defined	core	Core setting: dead code min confidence.
MAC_DEBUG_TERMINAL_ENABLED	bool	consumer-defined	core	Core setting: debug terminal enabled.
MAC_DEBUG_TERMINAL_SESSION_ID	str	consumer-defined	core	Core setting: debug terminal session id.
MAC_DEFAULT_PUBLICATION_TARGET	str	consumer-defined	core	Core setting: default publication target.
MAC_DEFAULT_REVIEWER_STALE_AFTER_SECONDS	int	consumer-defined	core	Core setting: default reviewer stale after seconds.
MAC_DEPLOYED_SOURCE_REVISION_FILE	str	consumer-defined	core	Core setting: deployed source revision file.
MAC_DEPLOY_ENV_FILE	str	consumer-defined	deployment	Deployment setting: deploy env file.
MAC_DEPLOY_FLEETS_CONFIG	str	consumer-defined	deployment	Deployment setting: deploy fleets config.
MAC_DEPLOY_FLEET_REGISTRY	str	consumer-defined	deployment	Deployment setting: deploy fleet registry.
MAC_DEPLOY_GH_TOKEN	str	consumer-defined	deployment	Deployment setting: deploy gh token.
MAC_DEPLOY_GITHUB_REVIEW_KEY_B64	str	consumer-defined	deployment	Deployment setting: deploy github review key b64.
MAC_DEPLOY_HUB_TOKEN	str	consumer-defined	deployment	Deployment setting: deploy hub token.
MAC_DEPLOY_HUB_URL	str	consumer-defined	deployment	Deployment setting: deploy hub url.
MAC_DEPLOY_REV	str	consumer-defined	deployment	Deployment setting: deploy rev.
MAC_DEPLOY_SUPERVISOR_CONF_DIR	str	consumer-defined	deployment	Deployment setting: deploy supervisor conf dir.
MAC_DEPLOY_TAILSCALE_AUTH_KEY	str	consumer-defined	deployment	Deployment setting: deploy tailscale auth key.
MAC_DEPLOY_TAILSCALE_NETWORKING	str	consumer-defined	deployment	Deployment setting: deploy tailscale networking.
MAC_DEPLOY_TAILSCALE_PROXY_PORT	int	consumer-defined	deployment	Deployment setting: deploy tailscale proxy port.
MAC_DEPLOY_TARGET	str	consumer-defined	deployment	Deployment setting: deploy target.
MAC_DEPLOY_TOKENHUB_API_KEY	str	consumer-defined	deployment	Deployment setting: deploy tokenhub api key.
MAC_DEPLOY_TOKENHUB_INSTALL	bool	consumer-defined	deployment	Deployment setting: deploy tokenhub install.
MAC_DEPLOY_TOKENHUB_PORT	int	consumer-defined	deployment	Deployment setting: deploy tokenhub port.
MAC_DEPLOY_TOKENHUB_REF	str	consumer-defined	deployment	Deployment setting: deploy tokenhub ref.
MAC_DEPLOY_TOKENHUB_URL	str	consumer-defined	deployment	Deployment setting: deploy tokenhub url.
MAC_DIRECTABLE_TIMEOUT	int	consumer-defined	core	Core setting: directable timeout.
MAC_DIRECTIVES_ENABLED	bool	consumer-defined	core	Core setting: directives enabled.
MAC_DISPATCH_DUE_AGING_SECONDS	int	consumer-defined	core	Core setting: dispatch due aging seconds.
MAC_DISPATCH_PAGE_PREFIX_WIDTH	str	consumer-defined	core	Core setting: dispatch page prefix width.
MAC_DISPATCH_PRIORITY_AGING_SECONDS	int	consumer-defined	core	Core setting: dispatch priority aging seconds.
MAC_EVIDENCE_ARTIFACT_MAX_BYTES	int	consumer-defined	evidence	Evidence setting: evidence artifact max bytes.
MAC_EVIDENCE_ARTIFACT_TOTAL_MAX_BYTES	int	consumer-defined	evidence	Evidence setting: evidence artifact total max bytes.
MAC_EVIDENCE_BLOB_DIR	str	consumer-defined	evidence	Evidence setting: evidence blob dir.
MAC_EVIDENCE_INLINE_MAX_BYTES	int	consumer-defined	evidence	Evidence setting: evidence inline max bytes.
MAC_EVIDENCE_MEDIA_MAX_FILES	str	consumer-defined	evidence	Evidence setting: evidence media max files.
MAC_EVIDENCE_MEDIA_TOTAL_MAX_BYTES	int	consumer-defined	evidence	Evidence setting: evidence media total max bytes.
MAC_EXECUTOR_AGENT_TIMEOUT	int	consumer-defined	core	Core setting: executor agent timeout.
MAC_FIRECRAWL_CHECK_TIMEOUT_SECONDS	int	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl check timeout seconds.
MAC_FIRECRAWL_GATEWAY_ALLOW_PRIVATE_TARGETS	bool	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl gateway allow private targets.
MAC_FIRECRAWL_GATEWAY_MAX_BYTES	int	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl gateway max bytes.
MAC_FIRECRAWL_GATEWAY_MAX_SEARCH_LIMIT	int	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl gateway max search limit.
MAC_FIRECRAWL_GATEWAY_TIMEOUT	int	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl gateway timeout.
MAC_FIRECRAWL_GATEWAY_USER_AGENT	str	consumer-defined	firecrawl-gateway	Firecrawl Gateway setting: firecrawl gateway user agent.
MAC_FLEET	str	consumer-defined	core	Core setting: fleet.
MAC_FLEETS_CONFIG	str	consumer-defined	core	Core setting: fleets config.
MAC_FLEET_NAME	str	consumer-defined	core	Core setting: fleet name.
MAC_FLEET_TENANT_ID	str	consumer-defined	core	Core setting: fleet tenant id.
MAC_GITHUB_INGEST_ENABLED	bool	consumer-defined	github-ingest	Github Ingest setting: github ingest enabled.
MAC_GITHUB_INGEST_INITIAL_DELAY_SECONDS	int	consumer-defined	github-ingest	Github Ingest setting: github ingest initial delay seconds.
MAC_GITHUB_INGEST_INTERVAL_SECONDS	int	consumer-defined	github-ingest	Github Ingest setting: github ingest interval seconds.
MAC_GITHUB_INGEST_MAX_ISSUES_PER_REPO	str	consumer-defined	github-ingest	Github Ingest setting: github ingest max issues per repo.
MAC_GITHUB_INGEST_MAX_OPEN_TASKS_PER_PROJECT	str	consumer-defined	github-ingest	Github Ingest setting: github ingest max open tasks per project.
MAC_HEADSCALE_COMMAND_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: headscale command timeout seconds.
MAC_HERMES_AGENT_DIR	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes agent dir.
MAC_HERMES_ALLOW_APPROVAL_PROMPTS	bool	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes allow approval prompts.
MAC_HERMES_BIN	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes bin.
MAC_HERMES_DRY_RUN	bool	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes dry run.
MAC_HERMES_FLEET_NAME	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes fleet name.
MAC_HERMES_GATEWAY_API_KEY	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway api key.
MAC_HERMES_GATEWAY_BASE_URL	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway base url.
MAC_HERMES_GATEWAY_MODEL	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway model.
MAC_HERMES_GATEWAY_PROVIDER	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway provider.
MAC_HERMES_GATEWAY_REQUEST_TIMEOUT_SECONDS	int	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway request timeout seconds.
MAC_HERMES_GATEWAY_STALE_TIMEOUT_SECONDS	int	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes gateway stale timeout seconds.
MAC_HERMES_HOME	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes home.
MAC_HERMES_INSTANCE_ID	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes instance id.
MAC_HERMES_LOG_SUMMARY	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes log summary.
MAC_HERMES_PERSONA_ID	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes persona id.
MAC_HERMES_PYTHON	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes python.
MAC_HERMES_RUNTIME_CONTEXT_FILE	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes runtime context file.
MAC_HERMES_RUNTIME_CONTEXT_MARKDOWN	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes runtime context markdown.
MAC_HERMES_RUNTIME_CONTEXT_REQUIRED	bool	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes runtime context required.
MAC_HERMES_SLACK_API_BASE	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes slack api base.
MAC_HERMES_SLACK_HOME_CHANNELS_JSON	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes slack home channels json.
MAC_HERMES_SLACK_HOME_CHANNEL_NAME	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes slack home channel name.
MAC_HERMES_STARTUP_CHECK	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes startup check.
MAC_HERMES_SYNC_SLACK_HOME_CHANNELS	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes sync slack home channels.
MAC_HERMES_WORKSPACE	str	consumer-defined	hermes-runtime	Hermes Runtime setting: hermes workspace.
MAC_HOME	str	consumer-defined	core	Core setting: home.
MAC_HOME_DIR	str	consumer-defined	core	Core setting: home dir.
MAC_HOSTNAME	str	consumer-defined	core	Core setting: hostname.
MAC_HUB_CODING_AGENTS	str	consumer-defined	hub	Set by the worker from each heartbeat response, never by an operator: the hub's ordered coding-CLI list, used for the worker's own route probes and status report.
MAC_HUB_CONTROL_PLANE_CPU_HIGH	str	consumer-defined	hub	Hub setting: hub control plane cpu high.
MAC_HUB_CONTROL_PLANE_CPU_LOW	str	consumer-defined	hub	Hub setting: hub control plane cpu low.
MAC_HUB_CONTROL_PLANE_RSS_HIGH_MB	str	consumer-defined	hub	Hub setting: hub control plane rss high mb.
MAC_HUB_CONTROL_PLANE_RSS_LOW_MB	str	consumer-defined	hub	Hub setting: hub control plane rss low mb.
MAC_HUB_LOAD_SHED_AGENT	str	consumer-defined	hub	Hub setting: hub load shed agent.
MAC_HUB_LOAD_SHED_DISABLED	str	consumer-defined	hub	Hub setting: hub load shed disabled.
MAC_HUB_LOAD_SHED_FORCE	str	consumer-defined	hub	Hub setting: hub load shed force.
MAC_HUB_LOAD_SHED_HIGH	str	consumer-defined	hub	Hub setting: hub load shed high.
MAC_HUB_LOAD_SHED_LOW	str	consumer-defined	hub	Hub setting: hub load shed low.
MAC_HUB_MAX_CONCURRENT_TASKS	str	consumer-defined	hub	Hub setting: hub max concurrent tasks.
MAC_HUB_MAX_TEST_JOBS	str	consumer-defined	hub	Hub setting: hub max test jobs.
MAC_HUB_MIN_TEST_JOBS	str	consumer-defined	hub	Hub setting: hub min test jobs.
MAC_HUB_TEST_JOBS_FRACTION	str	consumer-defined	hub	Hub setting: hub test jobs fraction.
MAC_HUB_TICK_INTERVAL_SECONDS	int	consumer-defined	hub	Hub setting: hub tick interval seconds.
MAC_HUB_TICK_STALE_AFTER_SECONDS	int	consumer-defined	hub	Hub setting: hub tick stale after seconds.
MAC_HUB_TOKEN	str	consumer-defined	hub	Hub setting: hub token.
MAC_HUB_URL	str	consumer-defined	hub	Hub setting: hub url.
MAC_HUB_VERIFY_IMAGE	str	consumer-defined	hub	Hub setting: hub verify image.
MAC_HUB_VERIFY_PROFILE	str	default	hub	Shared hub and Linux OpenShell worker verifier resource profile. Unset, empty or default preserves driver defaults. bounded-tmpfs requests 12 CPUs, 32 GiB memory, an 8 GiB sandbox-local Docker tmpfs for PostgreSQL and 8 MAC pytest workers. Repository fixture scratch uses a separate sandbox-local directory so fixture copies cannot fill the database mount. Requires a writable Linux tmpfs proof before repository code runs; unsupported profiles fail closed. Configure on each hub/worker process. Applies at sandbox create and fresh worker verification exec, including separate read-only verifiers; existing sandbox resources remain unchanged. Conflicting worker create resource overrides are rejected.
MAC_HUB_VERIFY_TIMEOUT	int	consumer-defined	hub	Hub setting: hub verify timeout.
MAC_HUB_VERIFY_VM_CONFIG	str	consumer-defined	hub	Private controller configuration for explicitly allowlisted repositories verified in disposable dedicated KVM guests; other repositories retain OpenShell verification.
MAC_HUMAN	str	consumer-defined	core	Core setting: human.
MAC_HUMAN_USERNAME	str	consumer-defined	core	Core setting: human username.
MAC_IDE_HANDOFF_FILE	str	consumer-defined	core	Core setting: ide handoff file.
MAC_IDE_PROXY_TOKEN	str	consumer-defined	core	Core setting: ide proxy token.
MAC_IMAGE_BUILDER	str	consumer-defined	core	Core setting: image builder.
MAC_IMAGE_BUILD_CONTEXT	str	consumer-defined	core	Core setting: image build context.
MAC_IMAGE_DOCKERFILE	str	consumer-defined	core	Core setting: image dockerfile.
MAC_IMAGE_NAME	str	consumer-defined	core	Core setting: image name.
MAC_IMAGE_PLATFORM	str	consumer-defined	core	Core setting: image platform.
MAC_IMAGE_REGISTRY	str	consumer-defined	core	Core setting: image registry.
MAC_IMAGE_SOURCE_SHA	str	consumer-defined	core	Core setting: image source sha.
MAC_IMAGE_SOURCE_SHA_FILE	str	consumer-defined	core	Core setting: image source sha file.
MAC_IMAGE_TAG	str	consumer-defined	core	Core setting: image tag.
MAC_IMPACT_MAP_CHECKED	str	consumer-defined	core	Core setting: impact map checked.
MAC_INFERENCE_TOKEN	str	consumer-defined	core	Set by the executor inside the task sandbox, never by an operator: a per-task token bound to the worker's agent that may call only POST /v1/chat/completions and /v1/embeddings. It expires after 6 hours and is revoked when the task ends. The worker token never enters the sandbox.
MAC_INFRASTRUCTURE_REQUEUES	str	consumer-defined	core	Core setting: infrastructure requeues.
MAC_JOURNAL_AGENT	str	consumer-defined	core	Core setting: journal agent.
MAC_JOURNAL_BACKUP_HOOK	str	consumer-defined	core	Core setting: journal backup hook.
MAC_JOURNAL_DATE	str	consumer-defined	core	Core setting: journal date.
MAC_JOURNAL_DIR	str	consumer-defined	core	Core setting: journal dir.
MAC_JOURNAL_MANIFEST	str	consumer-defined	core	Core setting: journal manifest.
MAC_JOURNAL_PATH	str	consumer-defined	core	Core setting: journal path.
MAC_JUDGE_MODEL	str	consumer-defined	core	Hub setting, inherited by workers with the coding-CLI list: the model the independent judge uses through the hub router (default claude-opus-4-8). If it is unavailable, tasks proceed unjudged and one human report is filed per model and failure class.
MAC_LANDING_DEADLINE_SECONDS	int	86400	core	Wall-clock deadline, from the first landing attempt, for every review/landing wait (reviewer, hub verify, publication target/evidence, checks pending, release barrier). Past it the task moves to BLOCKED with landing_budget_exhausted.
MAC_LANDING_MAX_ATTEMPTS	int	8	core	Landing attempts (publication retries, unavailable hub verifies) a task may spend between review and landing before it moves to BLOCKED with landing_budget_exhausted. Attempts back off from 5 to 60 minutes.
MAC_LAUNCHD_ARTIFACT_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: launchd artifact timeout seconds.
MAC_LAUNCHD_COMMAND_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: launchd command timeout seconds.
MAC_LAUNCHD_LOG_PREFIX	str	consumer-defined	core	Core setting: launchd log prefix.
MAC_LAUNCHD_MAX_OUTPUT_BYTES	int	consumer-defined	core	Core setting: launchd max output bytes.
MAC_LAUNCHD_POLL_INTERVAL_SECONDS	int	consumer-defined	core	Core setting: launchd poll interval seconds.
MAC_LAUNCHD_PYTHON_BIN	str	consumer-defined	core	Core setting: launchd python bin.
MAC_LAUNCHD_TRANSITION_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: launchd transition timeout seconds.
MAC_LAUNCHD_TX_ACTIVE	str	consumer-defined	core	Core setting: launchd tx active.
MAC_LAUNCHD_TX_AFTER_RESTORE_HOOK	str	consumer-defined	core	Core setting: launchd tx after restore hook.
MAC_LAUNCHD_TX_BACKUPS	str	consumer-defined	core	Core setting: launchd tx backups.
MAC_LAUNCHD_TX_COUNT	int	consumer-defined	core	Core setting: launchd tx count.
MAC_LAUNCHD_TX_DIR	str	consumer-defined	core	Core setting: launchd tx dir.
MAC_LAUNCHD_TX_DOMAIN	str	consumer-defined	core	Core setting: launchd tx domain.
MAC_LAUNCHD_TX_EXISTED	str	consumer-defined	core	Core setting: launchd tx existed.
MAC_LAUNCHD_TX_LABEL	str	consumer-defined	core	Core setting: launchd tx label.
MAC_LAUNCHD_TX_MODE	str	consumer-defined	core	Core setting: launchd tx mode.
MAC_LAUNCHD_TX_MUTATING	str	consumer-defined	core	Core setting: launchd tx mutating.
MAC_LAUNCHD_TX_OBSERVED_STATE	str	consumer-defined	core	Core setting: launchd tx observed state.
MAC_LAUNCHD_TX_OLD_STATE	str	consumer-defined	core	Core setting: launchd tx old state.
MAC_LAUNCHD_TX_PATHS	str	consumer-defined	core	Core setting: launchd tx paths.
MAC_LAUNCHD_TX_RECOVERY_POLICY	str	consumer-defined	core	Core setting: launchd tx recovery policy.
MAC_LAUNCHD_TX_ROLLBACK_HOOK	str	consumer-defined	core	Core setting: launchd tx rollback hook.
MAC_LAUNCHD_TX_SAVED_EXIT_TRAP	str	consumer-defined	core	Core setting: launchd tx saved exit trap.
MAC_LAUNCHD_TX_SAVED_HUP_TRAP	str	consumer-defined	core	Core setting: launchd tx saved hup trap.
MAC_LAUNCHD_TX_SAVED_INT_TRAP	str	consumer-defined	core	Core setting: launchd tx saved int trap.
MAC_LAUNCHD_TX_SAVED_TERM_TRAP	str	consumer-defined	core	Core setting: launchd tx saved term trap.
MAC_LAUNCHD_TX_TARGET	str	consumer-defined	core	Core setting: launchd tx target.
MAC_LAUNCHD_TX_TEMPORARIES	str	consumer-defined	core	Core setting: launchd tx temporaries.
MAC_LAUNCHD_TX_TEMP_COUNT	int	consumer-defined	core	Core setting: launchd tx temp count.
MAC_LEASE_EXPIRY_FINALIZER_STALE_SECONDS	int	consumer-defined	core	Core setting: lease expiry finalizer stale seconds.
MAC_LEASE_ID	str	consumer-defined	core	Core setting: lease id.
MAC_LEDGER_BACKUP_DIR	str	consumer-defined	core	Core setting: ledger backup dir.
MAC_LEDGER_BACKUP_ENABLED	bool	consumer-defined	core	Core setting: ledger backup enabled.
MAC_LOCAL_CONSOLE_ENABLED	bool	consumer-defined	client-auth	Client Auth setting: local console enabled.
MAC_LOCAL_CONSOLE_GROUP	str	consumer-defined	client-auth	Client Auth setting: local console group.
MAC_LOCAL_CONSOLE_SOCKET	str	consumer-defined	client-auth	Client Auth setting: local console socket.
MAC_LOOP_HEARTBEAT_SECONDS	int	consumer-defined	core	Core setting: loop heartbeat seconds.
MAC_LOOP_STALL_THRESHOLD_SECONDS	int	consumer-defined	core	Core setting: loop stall threshold seconds.
MAC_MACHINE_ID	str	consumer-defined	core	Core setting: machine id.
MAC_MAX_CHILD_TASKS_PER_PARENT	str	consumer-defined	core	Core setting: max child tasks per parent.
MAC_MAX_DECOMPOSE_DEPTH	str	consumer-defined	core	Core setting: max decompose depth.
MAC_MAX_TASK_LEASE_SECONDS	int	consumer-defined	core	Core setting: max task lease seconds.
MAC_MEMORY_EMBEDDING_DIM	int	consumer-defined	memory	Memory setting: memory embedding dim.
MAC_MEMORY_TOPOLOGY_FILE	str	consumer-defined	memory	Memory setting: memory topology file.
MAC_MIGRATION_DATABASE_URL	str	consumer-defined	core	Core setting: migration database url.
MAC_MODELS_DEV_CACHE_FILE	str	consumer-defined	core	Core setting: models dev cache file.
MAC_NETWORK_PROVIDER	str	consumer-defined	core	Fleet overlay: tailscale, headscale, or none. When tailscale or headscale, the hub process refuses to listen on 0.0.0.0 / LAN / public addresses and binds loopback plus the Tailscale IPv4 instead. Not a host firewall by itself; it is the listen-address policy that makes the overlay the only worker path. Unset means no mesh bind policy (container/dev).
MAC_NOTIFIER_DRAIN_HUB_AGENT	str	consumer-defined	notifier	Notifier setting: notifier drain hub agent.
MAC_NOTIFIER_DRAIN_LIMIT	int	consumer-defined	notifier	Notifier setting: notifier drain limit.
MAC_NOTIFIER_DRAIN_ON_HEARTBEAT	str	consumer-defined	notifier	Notifier setting: notifier drain on heartbeat.
MAC_NO_TICKET_MIRROR	str	consumer-defined	core	Core setting: no ticket mirror.
MAC_OBSERVABILITY_VERBOSE_POLL	bool	consumer-defined	core	Core setting: observability verbose poll.
MAC_OPENSHELL_ALLOW_NO_LANDLOCK	bool	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell allow no landlock.
MAC_OPENSHELL_BIN	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell bin.
MAC_OPENSHELL_BUILD_LOCK_POLL_SECONDS	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell build lock poll seconds.
MAC_OPENSHELL_BUILD_LOCK_WAIT_SECONDS	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell build lock wait seconds.
MAC_OPENSHELL_CHILD	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell child.
MAC_OPENSHELL_CREATE_ARGS	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell create args.
MAC_OPENSHELL_DELETE_TIMEOUT	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell delete timeout.
MAC_OPENSHELL_DOCKER_BIN	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell docker bin.
MAC_OPENSHELL_ENV_PASSTHROUGH	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell env passthrough.
MAC_OPENSHELL_EVENTS_FILE	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell events file.
MAC_OPENSHELL_GATEWAY	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell gateway.
MAC_OPENSHELL_GATEWAY_ENDPOINT	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell gateway endpoint.
MAC_OPENSHELL_GATEWAY_POLICY	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell gateway policy.
MAC_OPENSHELL_GC	bool	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell gc.
MAC_OPENSHELL_GPU_AVAILABLE	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell gpu available.
MAC_OPENSHELL_HOST_ALIAS	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell host alias.
MAC_OPENSHELL_KEEP	bool	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell keep.
MAC_OPENSHELL_POLICY	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell policy.
MAC_OPENSHELL_POLICY_BUS_GATE	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell policy bus gate.
MAC_OPENSHELL_POLICY_BUS_PAGE	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell policy bus page.
MAC_OPENSHELL_POLICY_SYNC	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell policy sync.
MAC_OPENSHELL_POLICY_WAIT_SECONDS	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell policy wait seconds.
MAC_OPENSHELL_PROGRESS_INTERVAL	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell progress interval.
MAC_OPENSHELL_REAP_ORPHANS	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell reap orphans.
MAC_OPENSHELL_RECONCILE_LEASES	bool	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell reconcile leases.
MAC_OPENSHELL_REPO_REQUIRES_CODING_AGENT	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell repo requires coding agent.
MAC_OPENSHELL_REQUIRED	bool	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell required.
MAC_OPENSHELL_RUNTIME_IMAGE_REF_FILE	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell runtime image ref file.
MAC_OPENSHELL_SANDBOX	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell sandbox.
MAC_OPENSHELL_SANDBOX_ID	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell sandbox id.
MAC_OPENSHELL_SANDBOX_NAME	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell sandbox name.
MAC_OPENSHELL_STALE_AFTER_SECONDS	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell stale after seconds.
MAC_OPENSHELL_TASK_EGRESS	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell task egress.
MAC_OPENSHELL_TRANSFER_TIMEOUT	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell transfer timeout.
MAC_OPENSHELL_VERIFICATION_START_TIMEOUT	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: openshell verification start timeout.
MAC_OPENSH_GATEWAY_OWNER	str	consumer-defined	core	Core setting: opensh gateway owner.
MAC_OPENSH_GW	str	consumer-defined	core	Core setting: opensh gw.
MAC_PERSONA_INSTANCE_ID	str	consumer-defined	core	Core setting: persona instance id.
MAC_PG_BACKUP_DIR	str	consumer-defined	core	Core setting: pg backup dir.
MAC_PG_BACKUP_ENABLED	bool	consumer-defined	core	Core setting: pg backup enabled.
MAC_PG_BACKUP_INITIAL_DELAY_SECONDS	int	consumer-defined	core	Core setting: pg backup initial delay seconds.
MAC_PG_BACKUP_INTERVAL_SECONDS	int	consumer-defined	core	Core setting: pg backup interval seconds.
MAC_PG_BACKUP_KEEP_LAST	bool	consumer-defined	core	Core setting: pg backup keep last.
MAC_PG_BACKUP_MANIFEST	str	consumer-defined	core	Core setting: pg backup manifest.
MAC_PG_BACKUP_PATH	str	consumer-defined	core	Core setting: pg backup path.
MAC_PG_BACKUP_SHA256	str	consumer-defined	core	Core setting: pg backup sha256.
MAC_PG_BACKUP_SYNC_CMD	str	consumer-defined	core	Core setting: pg backup sync cmd.
MAC_PG_BACKUP_URL	str	consumer-defined	core	Core setting: pg backup url.
MAC_PG_BACKUP_VERIFY_EVERY	str	consumer-defined	core	Core setting: pg backup verify every.
MAC_PG_BACKUP_VERIFY_TOLERANCE	str	consumer-defined	core	Core setting: pg backup verify tolerance.
MAC_PG_BIN_DIR	str	consumer-defined	core	Core setting: pg bin dir.
MAC_PG_POOL_SIZE	int	consumer-defined	core	Core setting: pg pool size.
MAC_PORT	int	consumer-defined	core	Core setting: port.
MAC_POSTGRES_RUNTIME_COMMAND_TIMEOUT_SECONDS	int	consumer-defined	core	Core setting: postgres runtime command timeout seconds.
MAC_PREFER_CODING_AGENT	bool	consumer-defined	core	Core setting: prefer coding agent.
MAC_PROFILE	str	consumer-defined	core	Core setting: profile.
MAC_PROJECT_CONTRACT_FILE	str	consumer-defined	core	Core setting: project contract file.
MAC_PRUNE_KEEP_LAST	bool	consumer-defined	core	Core setting: prune keep last.
MAC_PRUNE_LOG_DAYS	str	consumer-defined	core	Core setting: prune log days.
MAC_PUBLICATION_STRATEGY	str	consumer-defined	core	Core setting: publication strategy.
MAC_PUBLICATION_WORKER_INTERVAL_SECONDS	int	consumer-defined	core	Core setting: publication worker interval seconds.
MAC_PUBLISH_DIR	str	consumer-defined	publication	Publication setting: publish dir.
MAC_PUBLISH_METHOD	str	consumer-defined	publication	Publication setting: publish method.
MAC_PUBLISH_PUBLIC_URL	str	consumer-defined	publication	Publication setting: publish public url.
MAC_PUBLISH_WEBDAV_ENABLED	bool	consumer-defined	publication	Publication setting: publish webdav enabled.
MAC_PUBLISH_WEBDAV_URL	str	consumer-defined	publication	Publication setting: publish webdav url.
MAC_QDRANT_CHECK_TIMEOUT_SECONDS	int	consumer-defined	qdrant-memory	Qdrant Memory setting: qdrant check timeout seconds.
MAC_QDRANT_MEMORY	str	consumer-defined	qdrant-memory	Qdrant Memory setting: qdrant memory.
MAC_QDRANT_MEMORY_ROLE	str	consumer-defined	qdrant-memory	Qdrant Memory setting: qdrant memory role.
MAC_QDRANT_RUNTIME_COMMAND_TIMEOUT_SECONDS	int	consumer-defined	qdrant-memory	Qdrant Memory setting: qdrant runtime command timeout seconds.
MAC_QDRANT_URL	str	consumer-defined	qdrant-memory	Qdrant Memory setting: qdrant url.
MAC_QUIET_LOCAL_BANNER	str	consumer-defined	core	Core setting: quiet local banner.
MAC_READ_ONLY_AUTHORITATIVE_VERIFIER	str	consumer-defined	core	Core setting: read only authoritative verifier.
MAC_RECONCILER_LEASE_SECONDS	int	consumer-defined	core	Core setting: reconciler lease seconds.
MAC_RECORD_HTTP_OBSERVATIONS	str	consumer-defined	core	Core setting: record http observations.
MAC_RECOVERY_TEST_TIMEOUT	int	consumer-defined	core	Core setting: recovery test timeout.
MAC_REFLECT_ENABLED	bool	consumer-defined	core	Core setting: reflect enabled.
MAC_REFLECT_TIMEOUT	int	consumer-defined	core	Core setting: reflect timeout.
MAC_RELAY_OBSERVABILITY	str	consumer-defined	core	Core setting: relay observability.
MAC_REPORT_EXECUTOR_APPROVED_EXECUTOR_SCRIPT_PATH	str	consumer-defined	core	Core setting: report executor approved executor script path.
MAC_REPORT_EXECUTOR_APPROVED_EXECUTOR_SCRIPT_SHA256	str	consumer-defined	core	Core setting: report executor approved executor script sha256.
MAC_REPORT_EXECUTOR_APPROVED_HOST_EXECUTOR_PATH	str	consumer-defined	core	Core setting: report executor approved host executor path.
MAC_REPORT_EXECUTOR_APPROVED_HOST_EXECUTOR_SHA256	str	consumer-defined	core	Core setting: report executor approved host executor sha256.
MAC_REPORT_EXECUTOR_APPROVED_ISOLATION_POSTURE	str	consumer-defined	core	Core setting: report executor approved isolation posture.
MAC_REPORT_EXECUTOR_APPROVED_OPENSHELL_BIN_PATH	str	consumer-defined	core	Core setting: report executor approved openshell bin path.
MAC_REPORT_EXECUTOR_APPROVED_OPENSHELL_BIN_SHA256	str	consumer-defined	core	Core setting: report executor approved openshell bin sha256.
MAC_REPORT_EXECUTOR_APPROVED_PLATFORM	str	consumer-defined	core	Core setting: report executor approved platform.
MAC_REPORT_EXECUTOR_APPROVED_POLICY_SHA256	str	consumer-defined	core	Core setting: report executor approved policy sha256.
MAC_REPORT_EXECUTOR_APPROVED_PYTHON_PATH	str	consumer-defined	core	Core setting: report executor approved python path.
MAC_REPORT_EXECUTOR_APPROVED_PYTHON_SHA256	str	consumer-defined	core	Core setting: report executor approved python sha256.
MAC_REPORT_EXECUTOR_APPROVED_RUNTIME_CONFIG_SHA256	str	consumer-defined	core	Core setting: report executor approved runtime config sha256.
MAC_REPORT_EXECUTOR_APPROVED_RUNTIME_IMAGE_REF	str	consumer-defined	core	Core setting: report executor approved runtime image ref.
MAC_REPORT_EXECUTOR_APPROVED_SOURCE_BUNDLE_SHA256	str	consumer-defined	core	Core setting: report executor approved source bundle sha256.
MAC_REPORT_EXECUTOR_APPROVED_SOURCE_ROOT	str	consumer-defined	core	Core setting: report executor approved source root.
MAC_REPOSITORY_ACCESS_FAILURE_COOLDOWN_SECONDS	int	consumer-defined	core	Core setting: repository access failure cooldown seconds.
MAC_REPOSITORY_ACCESS_SUCCESS_TTL_SECONDS	int	consumer-defined	core	Core setting: repository access success ttl seconds.
MAC_REPOSITORY_REF_RECONCILER_BASE_REF	str	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler base ref.
MAC_REPOSITORY_REF_RECONCILER_GRACE_DAYS	str	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler grace days.
MAC_REPOSITORY_REF_RECONCILER_INITIAL_DELAY_SECONDS	int	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler initial delay seconds.
MAC_REPOSITORY_REF_RECONCILER_INTERVAL_SECONDS	int	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler interval seconds.
MAC_REPOSITORY_REF_RECONCILER_MODE	str	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler mode.
MAC_REPOSITORY_REF_RECONCILER_REMOTE	str	consumer-defined	repository-lifecycle	Repository Lifecycle setting: repository ref reconciler remote.
MAC_REPO_ADMIN_WATCH	str	consumer-defined	core	Core setting: repo admin watch.
MAC_REPO_BOOTSTRAP_COMMAND	str	consumer-defined	core	Core setting: repo bootstrap command.
MAC_REPO_BOOTSTRAP_CREATES	str	consumer-defined	core	Core setting: repo bootstrap creates.
MAC_REPO_BOOTSTRAP_SETUP_RAN	str	consumer-defined	core	Core setting: repo bootstrap setup ran.
MAC_REPO_BOOTSTRAP_SETUP_RETURNCODE	str	consumer-defined	core	Core setting: repo bootstrap setup returncode.
MAC_REPO_BOOTSTRAP_SETUP_STATUS	str	consumer-defined	core	Core setting: repo bootstrap setup status.
MAC_REPO_REQUIRED_COMMANDS	bool	consumer-defined	core	Core setting: repo required commands.
MAC_REPO_TEST_COMMAND	str	consumer-defined	core	Core setting: repo test command.
MAC_REQUIRE_HERMES_STARTUP_READY	bool	consumer-defined	core	Core setting: require hermes startup ready.
MAC_REQUIRE_QDRANT_MEMORY	bool	consumer-defined	core	Core setting: require qdrant memory.
MAC_REQUIRE_TOKENHUB	bool	consumer-defined	core	Core setting: require tokenhub.
MAC_RESOURCE_HEALTH_INTERVAL_SECONDS	int	consumer-defined	core	Core setting: resource health interval seconds.
MAC_RETENTION_BATCH_SIZE	int	consumer-defined	core	Core setting: retention batch size.
MAC_RETENTION_INTERVAL_SECONDS	int	consumer-defined	core	Core setting: retention interval seconds.
MAC_RETENTION_MAX_BATCHES_PER_TICK	str	consumer-defined	core	Core setting: retention max batches per tick.
MAC_RETENTION_TELEMETRY_DAYS	str	consumer-defined	core	Core setting: retention telemetry days.
MAC_RETENTION_TICK_ENABLED	bool	consumer-defined	core	Core setting: retention tick enabled.
MAC_REVIEWED_PYTHON_VERSION	str	consumer-defined	core	Core setting: reviewed python version.
MAC_REVIEWED_UV_VERSION	str	consumer-defined	core	Core setting: reviewed uv version.
MAC_REVIEW_TICK_HUB_AGENT	str	consumer-defined	review	Review setting: review tick hub agent.
MAC_REVIEW_TICK_LIMIT	int	consumer-defined	review	Review setting: review tick limit.
MAC_REVIEW_TICK_ON_HEARTBEAT	str	consumer-defined	review	Review setting: review tick on heartbeat.
MAC_ROUTER_ANTHROPIC_PROVIDER	str	consumer-defined	router	Router setting: router anthropic provider.
MAC_ROUTER_ANTHROPIC_TIMEOUT_SECONDS	int	consumer-defined	router	Router setting: router anthropic timeout seconds.
MAC_ROUTER_AUDIO_KEY	str	consumer-defined	router	Router setting: router audio key.
MAC_ROUTER_AUDIO_TIMEOUT	int	consumer-defined	router	Router setting: router audio timeout.
MAC_ROUTER_AUDIO_UPSTREAM	str	consumer-defined	router	Router setting: router audio upstream.
MAC_ROUTER_BACKEND	str	consumer-defined	router	Router setting: router backend.
MAC_ROUTER_BIND_HOST	str	consumer-defined	router	Router setting: router bind host.
MAC_ROUTER_COOLDOWN_SECONDS	int	consumer-defined	router	Router setting: router cooldown seconds.
MAC_ROUTER_DEFAULT_MODEL	str	consumer-defined	router	Router setting: router default model.
MAC_ROUTER_DROP_PARAMS	str	consumer-defined	router	Router setting: router drop params.
MAC_ROUTER_FAILURE_THRESHOLD	int	consumer-defined	router	Router setting: router failure threshold.
MAC_ROUTER_IMAGE_KEY	str	consumer-defined	router	Router setting: router image key.
MAC_ROUTER_IMAGE_MODEL	str	consumer-defined	router	Router setting: router image model.
MAC_ROUTER_IMAGE_TIMEOUT	int	consumer-defined	router	Router setting: router image timeout.
MAC_ROUTER_IMAGE_UPSTREAM	str	consumer-defined	router	Router setting: router image upstream.
MAC_ROUTER_MAX_TOKENS_FLOOR	int	consumer-defined	router	Router setting: router max tokens floor.
MAC_ROUTER_MEDIA_JSON	str	consumer-defined	router	Router setting: router media json.
MAC_ROUTER_OUTAGE_REQUEUES	str	consumer-defined	router	Router setting: router outage requeues.
MAC_ROUTER_OUTAGE_WAITERS	str	consumer-defined	router	Router setting: router outage waiters.
MAC_ROUTER_OUTAGE_WAIT_SECONDS	int	consumer-defined	router	Router setting: router outage wait seconds.
MAC_ROUTER_PORT	int	consumer-defined	router	Router setting: router port.
MAC_ROUTER_PROVIDERS	str	consumer-defined	router	Router setting: router providers.
MAC_ROUTER_REJECT_MISMATCHED_PRINCIPAL	bool	consumer-defined	router	Router setting: router reject mismatched principal.
MAC_ROUTER_STREAM_TIMEOUT	int	consumer-defined	router	Router setting: router stream timeout.
MAC_ROUTER_TIMEOUT	int	consumer-defined	router	Router setting: router timeout.
MAC_ROUTER_TOKENS	str	consumer-defined	router	Router setting: router tokens.
MAC_ROUTER_VIDEO_KEY	str	consumer-defined	router	Router setting: router video key.
MAC_ROUTER_VIDEO_TIMEOUT	int	consumer-defined	router	Router setting: router video timeout.
MAC_ROUTER_VIDEO_UPSTREAM	str	consumer-defined	router	Router setting: router video upstream.
MAC_ROUTER_WILDCARD_MODELS	str	consumer-defined	router	Router setting: router wildcard models.
MAC_ROUTE_FINGERPRINT	str	consumer-defined	core	Core setting: route fingerprint.
MAC_SANDBOX_BASE_PATH	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox base path.
MAC_SANDBOX_NETWORK_CONCURRENCY	int	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox network concurrency.
MAC_SANDBOX_NODE_VERSION	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox node version.
MAC_SANDBOX_PATH_PREFIX	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox path prefix.
MAC_SANDBOX_PNPM_VERSION	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox pnpm version.
MAC_SANDBOX_PYTHON	str	consumer-defined	openshell-sandbox	Openshell Sandbox setting: sandbox python.
MAC_SCOPE_UNPROJECTED_TASKS	str	consumer-defined	core	Core setting: scope unprojected tasks.
MAC_SECRET_KEY	str	consumer-defined	core	Core setting: secret key.
MAC_SECRET_VAULT_TOKEN	str	consumer-defined	core	Core setting: secret vault token.
MAC_SECRET_VAULT_URL	str	consumer-defined	core	Core setting: secret vault url.
MAC_SELF_UPDATE_GIT_TIMEOUT	int	consumer-defined	core	Core setting: self update git timeout.
MAC_SELF_UPDATE_REPO	str	consumer-defined	core	Core setting: self update repo.
MAC_SELF_UPDATE_SERVICE_TIMEOUT	int	consumer-defined	core	Core setting: self update service timeout.
MAC_SEMANTIC_RETRY_BASE_SECONDS	int	15	semantic-retry	Semantic Retry setting: semantic retry base seconds.
MAC_SEMANTIC_RETRY_CAP_SECONDS	int	300	semantic-retry	Semantic Retry setting: semantic retry cap seconds.
MAC_SERVICE_ROLE_OPS	str	consumer-defined	core	Core setting: service role ops.
MAC_SHARED_SERVICES_MANAGER_AGENT	str	consumer-defined	core	Core setting: shared services manager agent.
MAC_SKIP_SLACK_VERIFY	str	consumer-defined	core	Core setting: skip slack verify.
MAC_SLACK_RELAY_POLL_SECONDS	int	consumer-defined	core	Core setting: slack relay poll seconds.
MAC_SLOW_REQUEST_SECONDS	int	consumer-defined	core	Core setting: slow request seconds.
MAC_SOURCE_COMMIT	str	consumer-defined	core	Core setting: source commit.
MAC_SRC	str	consumer-defined	core	Core setting: src.
MAC_STARTUP_CLEAR_HOLD	str	consumer-defined	core	Core setting: startup clear hold.
MAC_STARTUP_EMIT_CHECKOUT_SHA	str	consumer-defined	core	Core setting: startup emit checkout sha.
MAC_STARTUP_IMPORT_SELF_CHECK	str	consumer-defined	core	Core setting: startup import self check.
MAC_STATE_TO_A2A	str	consumer-defined	core	Core setting: state to a2a.
MAC_SUPERVISOR_KIND	str	consumer-defined	core	Core setting: supervisor kind.
MAC_SUPPRESS_VERSION_WARNING	str	consumer-defined	core	Core setting: suppress version warning.
MAC_TAILSCALE_HOSTNAME	str	consumer-defined	core	Core setting: tailscale hostname.
MAC_TAILSCALE_HTTP_PROXY	str	consumer-defined	core	Core setting: tailscale http proxy.
MAC_TAILSCALE_IP	str	consumer-defined	core	Core setting: tailscale ip.
MAC_TAILSCALE_NETWORKING_MODE	str	consumer-defined	core	Core setting: tailscale networking mode.
MAC_TAILSCALE_SOCKS5_PROXY	str	consumer-defined	core	Core setting: tailscale socks5 proxy.
MAC_TASK_ATTEMPT	str	consumer-defined	task-execution	Task Execution setting: task attempt.
MAC_TASK_CANONICAL_REMOTE	str	consumer-defined	task-execution	Task Execution setting: task canonical remote.
MAC_TASK_CODING_AGENTS	str	consumer-defined	task-execution	Set by the worker for each task run, never by an operator: the hub's ordered coding-CLI list from the task's assignment.
MAC_TASK_EXECUTOR_PYTHON	str	consumer-defined	task-execution	Task Execution setting: task executor python.
MAC_TASK_EXECUTOR_SCRIPT	str	consumer-defined	task-execution	Task Execution setting: task executor script.
MAC_TASK_FILE	str	consumer-defined	task-execution	Task Execution setting: task file.
MAC_TASK_FLOW_TICK_SINCE_HOURS	str	consumer-defined	task-execution	Task Execution setting: task flow tick since hours.
MAC_TASK_GIT_TOKEN	str	consumer-defined	task-execution	Task Execution setting: task git token.
MAC_TASK_ID	str	consumer-defined	task-execution	Task Execution setting: task id.
MAC_TASK_MAX_ITERATIONS	str	consumer-defined	task-execution	Task Execution setting: task max iterations.
MAC_TASK_MODEL	str	consumer-defined	task-execution	Task Execution setting: task model.
MAC_TASK_OPENSHELL_SANDBOX_NAME	str	consumer-defined	task-execution	Task Execution setting: task openshell sandbox name.
MAC_TASK_REPO_ACCESS_MODE	str	consumer-defined	task-repository	Task Repository setting: task repo access mode.
MAC_TASK_REPO_ACCESS_SCHEMA	str	consumer-defined	task-repository	Task Repository setting: task repo access schema.
MAC_TASK_REPO_BASE_SHA	str	consumer-defined	task-repository	Task Repository setting: task repo base sha.
MAC_TASK_REPO_BASE_TREE	str	consumer-defined	task-repository	Task Repository setting: task repo base tree.
MAC_TASK_REPO_BRANCH	str	consumer-defined	task-repository	Task Repository setting: task repo branch.
MAC_TASK_REPO_CONTENT_DIGEST	str	consumer-defined	task-repository	Task Repository setting: task repo content digest.
MAC_TASK_REPO_DEFAULT_BRANCH	str	consumer-defined	task-repository	Task Repository setting: task repo default branch.
MAC_TASK_REPO_GIT_CONTROL_DIGEST	str	consumer-defined	task-repository	Task Repository setting: task repo git control digest.
MAC_TASK_REPO_LEASE_ID	str	consumer-defined	task-repository	Task Repository setting: task repo lease id.
MAC_TASK_REPO_REFS_DIGEST	str	consumer-defined	task-repository	Task Repository setting: task repo refs digest.
MAC_TASK_REPO_REMOTE	str	consumer-defined	task-repository	Task Repository setting: task repo remote.
MAC_TASK_REPO_SOURCE	str	consumer-defined	task-repository	Task Repository setting: task repo source.
MAC_TASK_REPO_URL	str	consumer-defined	task-repository	Task Repository setting: task repo url.
MAC_TASK_REPO_WORKTREE	str	consumer-defined	task-repository	Task Repository setting: task repo worktree.
MAC_TASK_SUMMARY_BEGIN	str	consumer-defined	task-execution	Task Execution setting: task summary begin.
MAC_TASK_WORKSPACE	str	consumer-defined	task-execution	Task Execution setting: task workspace.
MAC_TEST_CHECKPOINT	str	consumer-defined	core	Core setting: test checkpoint.
MAC_TEST_CHECKPOINT_DIR	str	consumer-defined	core	Core setting: test checkpoint dir.
MAC_TEST_CHECKPOINT_RESULTS_DIR	str	consumer-defined	core	Core setting: test checkpoint results dir.
MAC_TEST_CHECKPOINT_ROOT	str	consumer-defined	core	Core setting: test checkpoint root.
MAC_TEST_CHECKPOINT_SKIP_FILE	str	consumer-defined	core	Core setting: test checkpoint skip file.
MAC_TEST_COVERAGE	str	consumer-defined	core	Core setting: test coverage.
MAC_TEST_DISABLE_GROUPS	str	consumer-defined	core	Core setting: test disable groups.
MAC_TEST_JOBS	str	2	core	Core setting: test jobs.
MAC_TEST_PG_CONTAINER	str	consumer-defined	core	Core setting: test pg container.
MAC_TEST_PG_DATADIR	str	consumer-defined	core	Core setting: test pg datadir.
MAC_TEST_PG_DB	str	consumer-defined	core	Core setting: test pg db.
MAC_TEST_PG_IMAGE	str	consumer-defined	core	Core setting: test pg image.
MAC_TEST_PG_LOCAL	str	consumer-defined	core	Core setting: test pg local.
MAC_TEST_PG_MAX_CONNECTIONS	str	consumer-defined	core	Core setting: test pg max connections.
MAC_TEST_PG_MAX_LOCKS	str	consumer-defined	core	Core setting: test pg max locks.
MAC_TEST_PG_PORT	int	consumer-defined	core	Core setting: test pg port.
MAC_TEST_PG_URL	str	consumer-defined	core	Core setting: test pg url.
MAC_TEST_PORTFOLIO	str	consumer-defined	core	Core setting: test portfolio.
MAC_TEST_PORTFOLIO_OUTPUT	str	consumer-defined	core	Core setting: test portfolio output.
MAC_TEST_REBUILD_MAP	bool	consumer-defined	core	Core setting: test rebuild map.
MAC_TEST_SELECT_BASE	str	consumer-defined	core	Core setting: test select base.
MAC_TEST_SERIAL_SLICE	str	consumer-defined	core	Core setting: test serial slice.
MAC_TEST_STALL_TIMEOUT	int	consumer-defined	core	Core setting: test stall timeout.
MAC_TICK_RUNS_REVIEW_SWEEP	str	consumer-defined	core	Core setting: tick runs review sweep.
MAC_TOKEN	str	consumer-defined	core	Core setting: token.
MAC_TOKENHUB_ALLOW_DEGRADED	bool	consumer-defined	tokenhub-legacy	Tokenhub Legacy setting: tokenhub allow degraded.
MAC_TOKENHUB_CHECK_TIMEOUT_SECONDS	int	consumer-defined	tokenhub-legacy	Tokenhub Legacy setting: tokenhub check timeout seconds.
MAC_TOKENHUB_PORT	int	consumer-defined	tokenhub-legacy	Tokenhub Legacy setting: tokenhub port.
MAC_TOKENHUB_URL	str	consumer-defined	tokenhub-legacy	Tokenhub Legacy setting: tokenhub url.
MAC_TOOLCHAIN_BIN	str	consumer-defined	core	Core setting: toolchain bin.
MAC_TOOLCHAIN_ROOT	str	consumer-defined	core	Core setting: toolchain root.
MAC_URL	str	consumer-defined	core	Core setting: url.
MAC_USER	str	consumer-defined	core	Core setting: user.
MAC_VALIDATE_REMOTE_REFS	bool	consumer-defined	core	Core setting: validate remote refs.
MAC_VENV	str	consumer-defined	core	Core setting: venv.
MAC_VERSION	str	consumer-defined	core	Core setting: version.
MAC_WEBDAV_BIND_ADDR	str	consumer-defined	webdav-publish	Webdav Publish setting: webdav bind addr.
MAC_WEBDAV_MAX_UPLOAD_BYTES	int	consumer-defined	webdav-publish	Webdav Publish setting: webdav max upload bytes.
MAC_WEBDAV_PORT	int	consumer-defined	webdav-publish	Webdav Publish setting: webdav port.
MAC_WEBDAV_PUBLIC_PATH	str	consumer-defined	webdav-publish	Webdav Publish setting: webdav public path.
MAC_WEBDAV_PUBLIC_URL	str	consumer-defined	webdav-publish	Webdav Publish setting: webdav public url.
MAC_WEBDAV_ROOT	str	consumer-defined	webdav-publish	Webdav Publish setting: webdav root.
MAC_WEBDAV_WRITE_TOKEN	str	consumer-defined	webdav-publish	Webdav Publish setting: webdav write token.
MAC_WEB_SEARCH_PROVIDER	str	consumer-defined	core	Core setting: web search provider.
MAC_WEB_SEARCH_URL	str	consumer-defined	core	Core setting: web search url.
MAC_WORKER_AGENT_ID	str	consumer-defined	worker	Worker setting: worker agent id.
MAC_WORKER_AGENT_NAME	str	consumer-defined	worker	Worker setting: worker agent name.
MAC_WORKER_ALLOWED_PROJECTS	str	consumer-defined	worker	Worker setting: worker allowed projects.
MAC_WORKER_CANCELLATION_POLL_SECONDS	int	consumer-defined	worker	Worker setting: worker cancellation poll seconds.
MAC_WORKER_CAPABILITIES	str	consumer-defined	worker	Worker setting: worker capabilities.
MAC_WORKER_CHAT_POLL_SECONDS	int	consumer-defined	worker	Worker setting: worker chat poll seconds.
MAC_WORKER_CLAIM_ONLY_CANARY_TASKS	str	consumer-defined	worker	Worker setting: worker claim only canary tasks.
MAC_WORKER_CODING_ROUTE_PROBE_INTERVAL_SECONDS	int	consumer-defined	worker	Worker setting: worker coding route probe interval seconds.
MAC_WORKER_COMMAND_INVENTORY_INTERVAL_SECONDS	int	consumer-defined	worker	Worker setting: worker command inventory interval seconds.
MAC_WORKER_COMMAND_INVENTORY_MAX	int	consumer-defined	worker	Worker setting: worker command inventory max.
MAC_WORKER_COMMAND_PROBES	str	consumer-defined	worker	Worker setting: worker command probes.
MAC_WORKER_DEPLOY_BARRIER_FILE	str	consumer-defined	worker	Retired beads bridge selector; ignored by current hub-agent resolution.
MAC_WORKER_DEPLOY_BARRIER_MAX_AGE_SECONDS	int	consumer-defined	worker	Retired beads bridge selector; ignored by current hub-agent resolution.
MAC_WORKER_DEPLOY_GENERATION	str	consumer-defined	worker	Retired beads bridge selector; ignored by current hub-agent resolution.
MAC_WORKER_DIRECTABLE	str	consumer-defined	worker	Worker setting: worker directable.
MAC_WORKER_EXECUTOR_TIMEOUT	int	consumer-defined	worker	Worker setting: worker executor timeout.
MAC_WORKER_HERMES_INSTANCE_ID	str	consumer-defined	worker	Worker setting: worker hermes instance id.
MAC_WORKER_HOSTNAME	str	consumer-defined	worker	Worker setting: worker hostname.
MAC_WORKER_PERSONA_ID	str	consumer-defined	worker	Worker setting: worker persona id.
MAC_WORKER_PROCESS_REVISION	str	consumer-defined	worker	Worker setting: worker process revision.
MAC_WORKER_REPOSITORY_BOOTSTRAP_TIMEOUT	int	consumer-defined	worker	Worker setting: worker repository bootstrap timeout.
MAC_WORKER_REPOSITORY_TEST_TIMEOUT	int	consumer-defined	worker	Worker setting: worker repository test timeout.
MAC_WORKER_REQUIRED_METADATA	bool	consumer-defined	worker	Worker setting: worker required metadata.
MAC_WORKER_RESOURCES	str	consumer-defined	worker	Worker setting: worker resources.
MAC_WORKER_RUNNING_DIGEST	str	consumer-defined	worker	Worker setting: worker running digest.
MAC_WORKER_SHUTDOWN_EXIT	str	consumer-defined	worker	Worker setting: worker shutdown exit.
MAC_WORKER_SHUTDOWN_GRACE_SECONDS	int	consumer-defined	worker	Worker setting: worker shutdown grace seconds.
MAC_WORKER_TOKEN	str	consumer-defined	worker	Worker setting: worker token.
MAC_WORKER_WORKSPACE	str	consumer-defined	worker	Worker setting: worker workspace.
MAC_WORKER_WORKSPACE_GC_ENABLED	bool	consumer-defined	worker	Worker setting: worker workspace gc enabled.
MAC_WORKER_WORKSPACE_GC_HIGH_WATER_GB	str	consumer-defined	worker	Worker setting: worker workspace gc high water gb.
MAC_WORKER_WORKSPACE_GC_INTERVAL_SECONDS	int	consumer-defined	worker	Worker setting: worker workspace gc interval seconds.
MAC_WORKER_WORKSPACE_GC_KEEP_RECENT	bool	consumer-defined	worker	Worker setting: worker workspace gc keep recent.
MAC_WORKER_WORKSPACE_GC_MAX_AGE_HOURS	str	consumer-defined	worker	Worker setting: worker workspace gc max age hours.
MAC_WORKER_WORKSPACE_GC_MIN_FREE_GB	str	consumer-defined	worker	Worker setting: worker workspace gc min free gb.
MAC_WORKFLOW_ADVANCEMENT_RESERVATION_SECONDS	int	consumer-defined	core	Core setting: workflow advancement reservation seconds.

Environment variable precedence

MAC resolves each MAC_* variable according to a three-level contract:

1. Process environment wins. A variable already present in the invoking process environment (e.g. set by the supervisor unit, injected by a secret manager, or exported by the operator shell) is used as-is and is never overridden by the env file.
2. Env file supplies defaults. A variable absent from the process environment receives its value from the operator env file (typically ~/.mac/.env or the path given by MAC_ENV_FILE).
3. Env file is the operator default store. Operators should record stable deployment values — tokens, URLs, feature flags — in the env file. Runtime overrides belong in the process environment and are not written back to the file.

Fleet-scoped credential precedence

Credential-bearing variables that would otherwise collide when one workstation joins more than one fleet are resolved by mac.fleet_env.resolve, which understands a scoped form in addition to the legacy flat name.

Scoped naming rule

Each fleet-scoped variable has the form BASE_NAME__<FLEET>, where <FLEET> is the active fleet name normalized to an env-var suffix: uppercased, with every run of non-alphanumeric characters replaced by a single _ and leading/trailing _ stripped. For example, fleet example-fleet yields suffix EXAMPLE_FLEET, so MAC_API_TOKEN scopes to MAC_API_TOKEN__EXAMPLE_FLEET.

Resolution order

For a fleet-scoped base variable, resolve looks up values in this order and returns the first that is set:

1. Scoped form wins. BASE_NAME__<FLEET>, where the fleet comes from the explicit fleet argument (e.g. CLI --fleet) or, when that is absent, the MAC_FLEET environment variable.
2. Legacy flat form. BASE_NAME, used only when no scoped value is present (or no active fleet is known).

When a fleet-scoped variable is read via its legacy flat name, resolve emits a one-time deprecation warning per (variable, fleet) and points operators at the scoped form. Run mac admin config migrate-env-namespace to append scoped variants of the flat credentials in your env file and retire the collision.

Fleet-scoped base variables

Base variable	Example scoped form
MAC_API_TOKEN	MAC_API_TOKEN__EXAMPLE_FLEET
MAC_API_TOKENS	MAC_API_TOKENS__EXAMPLE_FLEET
MAC_DEPLOY_GITHUB_REVIEW_KEY_B64	MAC_DEPLOY_GITHUB_REVIEW_KEY_B64__EXAMPLE_FLEET
MAC_DEPLOY_HUB_TOKEN	MAC_DEPLOY_HUB_TOKEN__EXAMPLE_FLEET
MAC_DEPLOY_TAILSCALE_AUTH_KEY	MAC_DEPLOY_TAILSCALE_AUTH_KEY__EXAMPLE_FLEET
MAC_DEPLOY_TOKENHUB_API_KEY	MAC_DEPLOY_TOKENHUB_API_KEY__EXAMPLE_FLEET
MAC_TOKEN	MAC_TOKEN__EXAMPLE_FLEET
MAC_WORKER_TOKEN	MAC_WORKER_TOKEN__EXAMPLE_FLEET

Canonical host credential variables

Host services read only these canonical names after python -m mac.credential_aliases --convert rewrites ~/.mac/mac.env. The converter backs up changed files, refuses conflicting values, and is idempotent.

Canonical variable	Credential
MAC_API_TOKEN	hub API administrator token
MAC_API_TOKENS	hub API principal map
MAC_WORKER_TOKEN	worker bearer token
MAC_DEPLOY_HUB_TOKEN	deployment hub token
MAC_DEPLOY_TOKENHUB_API_KEY	legacy TokenHub deployment key
MAC_DEPLOY_TAILSCALE_AUTH_KEY	Tailscale enrollment key
MAC_DEPLOY_GITHUB_REVIEW_KEY_B64	GitHub review key

Fleet selection is separate: operator clients may select --fleet or MAC_FLEET and use MAC_API_TOKEN__<FLEET> alongside the corresponding entry in ~/.mac/fleets.yaml. That multi-fleet client feature is not a host credential alias and is intentionally retained.

Precedence and retirement

Fallback precedence is left-to-right in resolve_env_chain. Fleet-scoped credential keys are resolved before legacy flat keys by their owning subsystem. MAC_BEADS_BRIDGE_HUB_AGENT is retained only as a documented retired name and is never consulted by resolve_hub_agent.