# Public/individual instructor overlay: workstation-friendly hardening.

# Sandbox stricter: no outbound traffic; modest resources (CPU seconds).
ENABLE_TS_SANDBOX=true
TS_SANDBOX_MODE=auto
TS_SANDBOX_BLOCK_OUTBOUND_NETWORK=true
TS_SANDBOX_CPU_LIMIT=15
TS_SANDBOX_MEMORY_LIMIT_MB=256
TS_SANDBOX_TIMEOUT_SEC=15

# Token handling (pending feature wiring).
TOKEN_STORAGE_BACKEND=keyring
TOKEN_ENVELOPE_KEY_SOURCE=local
TOKEN_STARTUP_VALIDATION=true

# Logging hygiene (some flags are placeholders)
LOG_REDACT_PII=true
LOG_ROTATION_DAYS=14
LOG_LEVEL=INFO

# Bind settings are reserved for future HTTP transport (ignored in stdio mode).
MCP_BIND_HOST=127.0.0.1
MCP_BIND_PORT=8000
FIREWALL_HINT=allow-localhost-only

# Privacy
ENABLE_DATA_ANONYMIZATION=true
