feat: seed governance config and responses routing

volumes/env/.env.example

@@ -1,17 +1,42 @@
 # FuzzForge Agent Configuration
-# Copy this to .env and configure your API keys
+# Copy this to .env and configure your API keys and proxy settings
 
-# LiteLLM Model Configuration
-LITELLM_MODEL=gemini/gemini-2.0-flash-001
-# LITELLM_PROVIDER=gemini
+# LiteLLM Model Configuration (default routed through the proxy)
+LITELLM_MODEL=openai/gpt-5
+LITELLM_PROVIDER=openai
 
-# API Keys (uncomment and configure as needed)
-# GOOGLE_API_KEY=
-# OPENAI_API_KEY=
-# ANTHROPIC_API_KEY=
-# OPENROUTER_API_KEY=
-# MISTRAL_API_KEY=
+# Proxy configuration
+# Base URL is used by the task agent to talk to the proxy container inside Docker.
+# When running everything locally without Docker networking, replace with http://localhost:10999.
+FF_LLM_PROXY_BASE_URL=http://llm-proxy:8080
 
-# Agent Configuration
+# Default virtual key issued by the proxy for the task agent.
+# Leave as sk-proxy-default and the bootstrap job will replace it on startup.
+# If you paste your real OpenAI key here before the first boot, the bootstrap
+# job moves it into a generated .env.bifrost file and swaps this value with the
+# proxy-issued virtual key so the agent still authenticates via the gateway.
+OPENAI_API_KEY=sk-proxy-default
+
+# Upstream provider keys (loaded by the proxy via env.BIFROST_* references).
+# You can fill these directly, but normally the bootstrapper manages them for
+# you in .env.bifrost after the first startup. To scope keys to specific models,
+# set BIFROST_OPENAI_MODELS=openai/gpt-5 (or similar) before launching the proxy.
+# BIFROST_OPENAI_KEY=
+# BIFROST_OPENAI_MODELS=openai/gpt-5,openai/gpt-5-nano
+# BIFROST_OPENAI_USE_RESPONSES_API=true
+# BIFROST_ANTHROPIC_KEY=
+# BIFROST_GEMINI_KEY=
+# BIFROST_MISTRAL_KEY=
+# BIFROST_OPENROUTER_KEY=
+
+# LiteLLM proxy (alternative gateway)
+# LITELLM_MASTER_KEY=sk-master-key
+# LITELLM_SALT_KEY=choose-a-random-string
+
+# Bifrost gateway (default proxy)
+# APP_HOST=0.0.0.0
+# APP_PORT=8080
+
+# Agent behaviour
 # DEFAULT_TIMEOUT=120
 # DEFAULT_CONTEXT_ID=default