// reference · 03

Environment variables and files

Where everything lives: config precedence, the environment variables Okami reads, and what shows up in the .okami/ directory when you use the agent.

Configuration precedence

filerole · versioned?
okami.yamlbase config (providers, memory, contracts) · ✅ yes
okami.local.yamllocal overrides (deep-merge over base; wins) · ❌ no
.envPROJECT secrets · ❌ no
~/.okami/.envGLOBAL secrets (any workspace, 0600) · ❌ no
okami.policy.yamlauthored conformance posture · ✅ yes

Secrets take precedence: real environment > project .env > global .env. okami config set <UPPERCASE_KEY> writes to the global .env by default (--project uses the project's).

Environment variables

params OKAMI_API_TOKEN secret Bearer for the HTTP API (okami serve) — fail-closed, without it the API won't boot. MIMO_API_KEY secret Key for the MiMo provider (the one API-key provider in the default posture). <PROVIDER>_API_KEY secret Referenced by api_key_env (e.g. GITHUB_TOKEN in an MCP header). PAPERCLIP_API_URL / _API_KEY secret Paperclip connection — injected per-run on the heartbeat; don't fill in by hand. PAPERCLIP_RUN_ID / _AGENT_ID / … string Paperclip run metadata (reference/tests). EDITOR string Editor used by okami config edit (else nano/notepad).

The .okami/ directory (per workspace/agent)

pathwhat it is
events.jsonlappend-only turn timeline (redacted, with trace_id)
audit.jsonlevery tool + approval decision
sessions/<chat>.jsonlappend-only transcript (one line per turn)
checkpoints/journal.jsonlwrite journal (lock + HMAC) for rollback
memory.dbsqlite-fts5 memory (+ vectors)
taste.jsondesign-taste attractors/repulsors
persona_signals.jsonobserved signals to evolve VOICE/PERSONA
tuning.jsonper-model stats (capability auto-tune)
quarantine/downloaded skills awaiting the scan
gateway.pid · gateway.logPID and log of the background gateway
cron.jsonscheduled jobs
chat_historythe REPL's line history

Open this page in the interactive docs