EXTENDED DOCUMENTATION
Environment Guide / 环境变量指南
This guide explains the environment variables used by
in plain English and Chinese. If you are not a developer, you do not need to memorize everything. Think of the variables in four layers:本指南用中英文解释
使用的环境变量。 如果你不是开发者，你不需要记住所有变量。 你只需要把变量理解成四层：- Chain addresses and RPCs / 链地址与 RPC
- Signing keys / 签名密钥
- Nitro and Supabase access / Nitro 与 Supabase 访问
- Runtime policy knobs / 运行策略参数
Must Know / 你必须关心的变量
These are the variables that matter for day-to-day operation. If one of these is wrong, the system usually stops working.
这些是日常运行最关键的变量。 其中任意一个出错，系统通常就会停止工作。
Runtime Access / Runtime 访问
- English: Explicit URL of the confidential Morpheus runtime. In production, confidential/mutating calls try this endpoint only; the web tier and relayer do not append or traverse the / public fallbacks. 中文：机密 Morpheus runtime 的显式地址。生产环境中的机密/变更类调用只尝试此端点；web 与 relayer 不会追加或遍历 / 公网回退。
- / English: Optional network-scoped runtime URLs when you want explicit mainnet/testnet separation. 中文：可选的分网络 runtime 地址，用于显式区分 mainnet/testnet。
- English: Browser/public runtime URL used only by explicitly non-confidential status and catalog operations. In production it is never promoted into the server's confidential Nitro candidate list and never receives the server's runtime bearer on fallback. 中文：仅供显式标记为非机密的状态与目录操作使用的浏览器/公网 runtime 地址。生产环境绝不会将其提升为服务端机密 Nitro 候选地址，回退请求也绝不会携带服务端 runtime bearer。
- / English: Network-scoped health endpoints for the attested box used by runtime status. Configure both in production; a URL may contain the placeholder. A generic is only a fallback and a reported network mismatch is fail-closed. 中文： runtime status 使用的 attested box 分网络健康地址。生产环境应同时配置两项；地址可包含 占位符。通用的 仅作 fallback，若返回的 network 不匹配会 fail-closed。
- or English: Data-plane authentication secret for the Nitro runtime. Prefer . It does not authorize control-plane workflow, broadcast, feed-tick, automation, or relayer-operations routes. In production the web proxy attaches it only to exact server-configured candidates, never public/registry fallbacks. 中文：Nitro runtime 数据面的鉴权密钥。优先使用 。它不授权控制面 workflow、广播、feed-tick、自动化或 relayer 运维接口。生产环境的 web 代理只会把它发往服务端显式配置的 候选地址，绝不会发给公网/注册表回退地址。
Edge Hardening / 边缘防护
- English: Upstash Redis REST endpoint used by worker-side rate limiting and idempotency guards. Required in production for the rate limiter; the application will refuse to start if it is missing in production. 中文：worker 侧限流与幂等保护使用的 Upstash Redis REST 地址。在生产环境中 必须 配置 的限流器；若缺失，应用将拒绝启动。
- English: Upstash Redis REST bearer token. Required in production alongside . 中文：Upstash Redis REST 鉴权 token。生产环境中需与 一起配置。
- English: Enables worker-side Upstash-backed request guards for sensitive routes like paymaster / relay / compute / VRF. 中文：开启 worker 侧基于 Upstash 的敏感路由保护，例如 paymaster / relay / compute / VRF。
- English: If , Upstash failures reject guarded requests instead of failing open. 中文：若为 ，Upstash 故障时拒绝请求，而不是放行。
- English: Per-route fixed-window request ceilings enforced through Upstash. 中文：通过 Upstash 执行的分路由固定窗口请求上限。
- English: Optional deployment/admin token for Cloudflare scripts and worker rollout. 中文：可选的 Cloudflare 部署/管理 token，用于脚本和 worker 发布。
- English: Cloudflare account id used when deploying the edge gateway worker. 中文：发布 edge gateway worker 时使用的 Cloudflare account id。
- English: Optional secret used by the Cloudflare gateway worker to verify Turnstile tokens on abuse-prone endpoints. 中文：Cloudflare gateway worker 可选使用的 Turnstile secret，用于高风险接口的人机验证。
Supabase / Supabase
- English: Supabase project URL for server-side reads/writes. 中文：Supabase 项目地址，后端和 relayer 写数据时会用到。
-
preferred, or legacy
English: High-privilege Supabase server key for server routes and relayer persistence. Prefer the modern secret key when both are present.
中文：Supabase 高权限服务端 key，后端接口和 relayer 写运行记录时会用到。若同时存在，优先使用新版 secret key。
English: It is also used for web operation logging and encrypted-ciphertext persistence. 中文：它也用于 web 操作日志写入和加密密文持久化。
Admin Control Plane / 管理面权限
- English: Admin key for provider-config management routes ONLY. It does not authorize control-plane execution (callback broadcast, feed-tick, automation, job reads) or Cloudflare control-plane ingress — use an operator/control-plane key for those. 中文：仅用于 provider 配置管理接口的管理员 key。它不授权控制面执行（回调广播、feed-tick、自动化、任务读取）或 Cloudflare 控制面入口——这些请使用 operator / 控制面 key。
- English: Primary control-plane credential. In production it must be configured independently from all Nitro runtime data-plane tokens. 中文：主控制面凭据。生产环境中必须单独配置，不能与任何 Nitro runtime 数据面 token 共用。
- English: Credential for workflow callbacks, feed ticks, and automation execution. The Cloudflare control plane should use this when calling the application backend. 中文：workflow 回调、feed tick 与自动化执行凭据。Cloudflare 控制面调用应用后端时应使用它。
- English: Independent credential for relayer-originated control-plane calls. 中文：relayer 发起控制面调用时使用的独立凭据。
- English: Admin key for relayer metrics, jobs, retry, and replay routes. 中文：relayer 监控、任务、重试、重放接口使用的管理员 key。
- English: Admin key for . 中文： 使用的管理员 key。
- English: Admin key for . 中文： 使用的管理员 key。
- English: Operator/control-plane credential. Production does not reuse it as a fallback for relayer, signing, or relay routes: every privilege domain must have a pairwise-distinct value. 中文：运维/控制面凭据。生产环境不会再将其复用为 relayer、签名或 relay 路由的回退凭据；每个权限域都必须使用两两不同的值。
- (migration alias) English: Development-only migration switch allowing a runtime token on control-plane scopes. Production ignores it and fails closed. Independently named credentials that reuse a runtime token value are also rejected. 中文：仅开发环境使用的迁移开关，临时允许 runtime token 用于控制面作用域。生产环境忽略此开关并 fail-closed；独立命名但复用 runtime token 值的凭据同样会被拒绝。
- English: Legacy fallback admin key. Prefer scoped keys above in production. 中文：旧的通用管理员 key。生产环境更建议使用上面这些分域 key。
Neo N3 / Neo N3
- English: Neo N3 RPC endpoint. 中文：Neo N3 的 RPC 地址。
- English: Neo N3 network magic. Must match testnet or mainnet. 中文：Neo N3 网络 magic，必须和当前网络一致。
- English: Neo N3 MorpheusOracle contract hash. 中文：Neo N3 的 MorpheusOracle 合约地址。
- English: Optional Neo N3 external callback adapter contract hash. The kernel inbox is canonical; this is only needed for integrations that still want a dedicated callback bridge. 中文：可选的 Neo N3 外部 callback adapter 合约地址。系统 inbox 才是标准路径；只有仍然需要独立 callback bridge 的集成才需要它。
- English: Neo N3 shared numeric resource module contract hash. 中文：Neo N3 共享数值资源模块合约地址。
- or English: Legacy worker-side Neo N3 signing material. No worker lane reads it any more — worker signing goes through the custody signer service (). 中文：遗留的 worker Neo N3 签名私钥。worker 各通道均已不再读取——worker 签名一律走托管签名服务（）。
- or English: Legacy verifier signing material. No lane reads it any more — on-chain result verification uses the public key only (), and the name survives only in the pinned-registry drift checks. 中文：遗留的 verifier 签名私钥。任何通道均已不再读取——链上结果校验只使用公钥（）；该变量名仅存在于 pinned 注册表 drift 校验。
- English: Generic Neo N3 operator WIF consumed only by local smoke tooling (, ). No deployed runtime lane reads it — all signing is custody-side. 中文：通用 Neo N3 WIF，仅本地冒烟工具（、）消费。部署的运行时通道均不读取——签名全部走托管服务。
-
or
English: Legacy relayer/updater Neo N3 signing material. No runtime lane reads it any more: relayer signing is custody-only and the web control plane relays through the worker's txproxy lane, leaving only smoke tooling and the pinned-registry drift checks.
中文：旧版 relayer / updater 的 Neo N3 签名私钥。运行时通道均已不再读取：relayer 签名只走托管服务，web 控制面经 worker 的 txproxy 通道转发，仅剩冒烟工具与 pinned 注册表 drift 校验消费。
English: There is no local or derived key fallback on any signing lane, including NeoDID digest signatures — provisioning
is mandatory. 中文：任何签名通道（包括 NeoDID 摘要签名）都不存在本地或派生密钥回退——必须配置 。English: The generated testnet Nitro env now disables derived signing by default when it injects an explicit verifier signer, so the published testnet verifier key is not accidentally shadowed by a derived role key. 中文：现在生成的 testnet Nitro env 在注入显式 verifier signer 时会默认关闭派生签名覆盖，避免已发布到链上的 testnet verifier key 被派生角色密钥意外替换。
Neo X signer boundary / Neo X 签名边界
- and English: Legacy Node feed-pusher selection. The production Rust host now implements attested NeoX through the distinct , and the Rust relayer owns broadcast, successful receipt confirmation, and durable state. Production refuses the host-key route; these variables remain compatibility-only. 中文：旧 Node feed-pusher 的选择项。生产 Rust host 已通过独立的 实现可证明的 NeoX ，并由 Rust relayer 负责广播、成功回执确认与持久化状态。生产环境拒绝 host-key 路径；这些变量仅保留用于兼容。
- English: Development-only opt-in for legacy host-side Neo X signing. It never enables host signing in production. 中文：仅开发环境使用的旧版 host-side Neo X 签名开关。它绝不会在生产环境启用 host 签名。
- , , English: Legacy host private keys. Vercel, control-plane, relayer, and production feed-pusher environments must not define them. The standalone host fulfiller is also production-disabled until a custody/enclave secp256k1 signer is wired. 中文：旧版 host 私钥。Vercel、控制面、relayer 与生产 feed-pusher 环境不得定义这些变量。在 custody/enclave secp256k1 signer 接通前，独立 host fulfiller 在生产环境同样禁用。
Provider Data Source / 数据源
- English: API key for the default market-data provider. 中文：默认行情数据源 TwelveData 的 API key。
NeoDID Web3Auth / NeoDID 的 Web3Auth 配置
- English: Server-side Web3Auth client id used by the TEE worker when verifying for . 中文：当 时，TEE worker 用来校验 的服务端 Web3Auth client id。
- English: Server-only Web3Auth app key used to sign for frontend domain validation. This must never be exposed as a variable. 中文：仅服务端使用的 Web3Auth app key，用来为前端域名生成 签名。它绝不能暴露成 变量。
- English: Browser-exposed Web3Auth client id for the Next.js app. The worker also accepts it as a fallback if is not set. 中文：Next.js 前端可见的 Web3Auth client id。如果没有设置 ，worker 也会把它作为回退值使用。
- English: Browser-side Web3Auth network selection for the live login page. Current production default is . 中文：前端 Web3Auth 登录页使用的网络选择。当前生产默认值是 。
- English: JWKS endpoint used by the TEE worker to verify Web3Auth JWT signatures. Default is . 中文：TEE worker 用于校验 Web3Auth JWT 签名的 JWKS 地址。默认值是 。
Common Tuning / 常用调节项
These variables are safe to change when tuning behavior. They do not usually change trust assumptions.
这些变量常用于调节行为。 它们通常不会改变系统的信任模型。
Feed Policy / Feed 策略
- English: Comma-separated active chain list for relayer scanning and feed sync: , , or both. The generated production template defaults conservatively to ; both chains are authoritative when fully configured. 中文：relayer 扫链和 feed 同步使用的活动链列表，可为 、 或两者。生成的生产模板保守地默认 ；完整配置后两条链均为权威 Rust 通道。
- English: Default project slug used by feed tasks. 中文：feed 任务默认使用的项目 slug。
- English: Default provider for feed sync tasks. 中文：feed 同步任务默认 provider。
- English: Comma-separated provider list for multi-provider feed reads. 中文：多 provider feed 读取时使用的 provider 列表，逗号分隔。
- English: Comma-separated default pair list. 中文：默认交易对列表，逗号分隔。 English: This now covers crypto, equities, ETFs, commodities, and FX pairs. Pair-level scaling can still be applied through the feed registry. 中文：现在默认列表可覆盖加密资产、股票、ETF、大宗商品和外汇；如有超小价格对，仍可通过 feed registry 做单位缩放。
- English: Minimum price change before a new on-chain feed update is submitted. 中文：价格变化至少达到多少 basis points 才提交新的链上 feed 更新。
- English: Minimum time between feed submissions. Current production default is so the mainnet scanner evaluates the full catalog once per minute. 中文：两次 feed 提交之间的最短间隔。当前生产默认值是 ，也就是主网每分钟扫描一次完整价格目录。
- English: Feed-sync scan cadence for the relayer loop. 中文：relayer 扫描并触发 feed 同步的周期。
Relayer / Relayer
- English: How often the relayer scans for new chain events. 中文：relayer 轮询链上新事件的频率。
- English: Maximum number of parallel fulfill jobs. 中文：relayer 并发处理 fulfill 的最大数量。
- English: Maximum block span scanned per relayer loop. 中文：每次 relayer 循环最多扫描多少个区块。
- English: Maximum retry count for failed jobs. 中文：失败任务最多重试次数。
- English: Base retry delay. 中文：重试的基础延迟。
- English: Maximum retry delay. 中文：重试的最大延迟。
- English: Optional Neo N3 start block used when the relayer has no saved checkpoint yet. 中文：当 relayer 还没有保存过 checkpoint 时，Neo N3 扫块使用的可选起始区块。
Automation / 自动化任务
- English: Legacy automation scheduler switch. The production Rust relayer currently requires and rejects during and because durable automation claim/confirmation/persistence is not yet authoritative. cannot override this refusal. 中文：旧自动化调度器开关。当前生产 Rust relayer 必须设为 ；由于自动化的持久 claim/确认/落盘协议尚未成为权威实现， 与启动 都会拒绝 。 不能覆盖该拒绝。
- English: Non-production opt-in only. When and is not , / startup may proceed with a warning while the automation lane still reports . Production ignores this flag and still refuses . 中文：仅非生产显式允许。设为 且 不是 时，校验/启动可以带着警告继续，但 automation 车道仍报告未实现。生产环境忽略此开关，仍然拒绝 。
- English: Maximum active automation jobs loaded from Supabase per tick. 中文：每个 tick 从 Supabase 读取的活跃自动化任务上限。
- English: Maximum number of due automation executions that may be queued on-chain per tick. 中文：每个 tick 最多排队上链的自动化执行次数。
- English: Reserved knob for limiting per-tick price-trigger evaluation fan-out. 中文：限制每个 tick 价格触发检查扇出的预留参数。 English: Keep this at or above the configured pair catalog size if you expect all pairs to be evaluated within the same scheduler cycle. 中文：如果你希望同一个调度周期内检查完全部价格对，这个值应不小于当前配置的 pair 总数。
- English: Default cooldown for price-threshold triggers when the job does not specify one. 中文：价格阈值触发器未显式指定冷却期时使用的默认冷却时间。
Timeouts / 超时
- English: Upstream fetch timeout for Oracle requests. 中文：Oracle 拉取外部数据时的超时。
- English: Maximum response size for built-in provider fetches such as TwelveData / Coinbase / Binance. Use this when provider-side HTML or verbose JSON errors exceed the stricter generic upstream cap. 中文：内建 provider（例如 TwelveData / Coinbase / Binance）响应体的最大字节数。当 provider 侧返回较大的 HTML 或详细 JSON 错误时，可用它覆盖更严格的通用上限。
- English: Timeout for JS oracle scripts. 中文：旧 JS Oracle 脚本的超时。
- English: Timeout for JS compute scripts. 中文：旧 JS Compute 脚本的超时。
- English: Global default timeout for WASM execution. Current default is . 中文：WASM 执行的全局默认超时。当前默认值是 。
- English: Oracle-only WASM timeout override. 中文：只覆盖 Oracle WASM 执行超时。
- English: Compute-only WASM timeout override. 中文：只覆盖 Compute WASM 执行超时。
Advanced / 高级配置
Only touch these if you understand the runtime model.
这些变量只建议在理解运行时模型后再修改。
Derived Keys / 派生密钥
- English: Enables derived keys (from AWS Secrets Manager) for worker and relayer signing. 中文：开启派生密钥（来自 AWS Secrets Manager），供 worker 和 relayer 用于签名。
Attestation / 远程认证
- English: Adds Nitro (NSM) attestation metadata to worker responses when requested. 中文：在请求需要时，把 Nitro (NSM) attestation 元数据附加到 worker 返回里。
Oracle Key Storage / Oracle 密钥封装存储
- English: Wrapping-key path for the stable Oracle X25519 transport key. 中文：稳定 Oracle X25519 传输密钥所使用的封装密钥路径。
- English: Filesystem path where the sealed Oracle transport key is stored. 中文：封装后的 Oracle 传输密钥在文件系统中的存放路径。
Deliberately Disabled By Default / 默认故意关闭的高风险项
These are intentionally left unset in production unless you explicitly want the risk.
这些变量默认不建议开启，除非你明确知道风险并接受它。
- English: Enables user-supplied JS script execution. Default unset means disabled. 中文：允许执行用户提供的 JS 脚本。默认不写就是关闭。
- English: Allows provider requests to override builtin base URLs. Default unset means disabled. 中文：允许 provider 请求覆盖内置 base URL。默认不写就是关闭。
- English: Dev-only override that disables the Node permission model for script/WASM child processes (the model is ON by default). Ignored — fail closed — when . Replaces the retired toggle, which no longer has any effect. 中文：仅用于开发的覆盖项：关闭脚本/WASM 子进程的 Node permission model（默认开启）。当 时该覆盖被忽略（fail closed）。取代已失效的 。
- English: Enables the compute-in-enclave fulfillment lane in the relayer. Required in production for : when and this flag is unset, VRF fulfillment refuses the relayer-local fallback and fails closed as a terminal config error (no retry, no on-chain failure callback). Rollout note: activate together with on relayer services or VRF fulfillment halts. 中文：在 relayer 中启用 enclave 内计算履约通道。生产环境 必需：当 且未设置本标志时，VRF 履约拒绝 relayer 本地 回退并以 terminal config error fail closed（不重试、不上链失败回调）。上线注意：需与 relayer 服务的 配套启用，否则 VRF 履约会停止。
- English: Low-level overrides for child-process permissions. 中文：脚本子进程底层权限覆盖项。
Usually Safe To Ignore / 大多数时候你可以忽略
These exist for internal defaults or diagnostics.
这些变量主要是为了兼容、诊断或内部默认值。
- ,
Worker Runtime Reference / Worker 运行时变量参考
Every variable below is read by the live workers (
, ) but was previously documented nowhere. Names are integration contracts with the systemd env files on the Nitro box — never rename them. Format: default + one-line semantics.下面的变量都被线上 worker（
、）实际读取， 但之前没有任何文档。变量名是 Nitro box systemd env 文件的集成契约——绝不能改名。 格式：默认值 + 一句话语义。Custody Signer Service / 托管签名服务
- / English: Base URL and bearer token of the custody signer service (inside the Nitro enclave). All Neo N3 signing — relayer lanes and both worker lanes ( / , / ) — goes through it; neither the relayer nor the worker holds or reads any signing WIF. See §5. 中文：托管签名服务（Nitro enclave 内）的地址与 Bearer token。全部 Neo N3 签名——relayer 各通道与 worker 两条通道（ / 、 / ）——都经由它完成，relayer 与 worker 自身均不再持有或读取任何签名 WIF。见 §5。
- / / / English: Custody key ids per signing role. Updater and oracle_verifier are required for the relayer's Neo N3 lanes; updater is also the tx-relay lane's on-chain identity on the worker (the lane relays oracle-contract invocations — / — as the updater account), and worker is required for the worker sign lane ( enforces all three); fee_funder is optional (auto fee top-up only, best-effort). 中文：各签名角色对应的托管 key id。updater 与 oracle_verifier 是 relayer Neo N3 通道的必需项；updater 同时也是 worker tx-relay 通道的链上身份（该通道以 updater 账户转发 oracle 合约调用—— / ）；worker 是 worker 签名通道的必需项（ 强制校验）；fee_funder 可选（仅自动手续费补充，尽力而为）。
- / English: Distinct NeoX custody roles. signs EIP-1559 transactions submitted to NeoX; signs the semantic EIP-191 fulfillment proof consumed by the oracle contract. They must never resolve to the same key id. 中文：相互独立的 NeoX 托管角色。 签署提交至 NeoX 的 EIP-1559 交易； 签署预言机合约消费的语义化 EIP-191 履约证明。两者绝不能解析到同一个 key id。
Signer Pinning And Network-Scoped Keys / 签名 pinning 与分网络密钥
- English: Security toggle (default unset = pinned-only). When true-like, signer roles may fall back to unpinned key material instead of failing closed. A runtime env file that sets it true fails (); only the bootstrap files under that generates may carry it true. 中文：安全开关（默认不设置 = 只允许 pinned）。为 true 时 signer 角色可回退到未 pinned 的密钥材料，而不是直接失败。运行时 env 文件里为 true 会被 拒绝（）；只有 生成的 下 bootstrap 文件允许为 true。
- / (and ) English: Network-scoped relayer signing material; takes precedence over the unscoped for that network. No signing lane reads these any more (all Neo N3 signing is custody-only since the custody migration); they remain consumed only by smoke tooling and the pinned-registry drift checks. 中文：分网络 relayer 签名密钥；对应网络上优先于不带后缀的 。所有签名通道均已不再读取（custody 迁移后 Neo N3 签名只走托管服务）；目前仅冒烟工具与 pinned 注册表 drift 校验仍会消费。
- / (and forms) English: Dedicated feed-updater signing material; same network-scoped precedence rules as the relayer keys. No runtime lane reads these any more: the web control plane's feed-tick and callback-broadcast routes no longer resolve or forward signer material (the worker signs through custody under the updater role), leaving only smoke tooling and the pinned-registry drift checks. 中文：feed updater 专用签名密钥；分网络优先级规则与 relayer 密钥相同。运行时通道均已不再读取：web 控制面的 feed-tick 与 callback-broadcast 路由不再解析或转发签名材料（worker 以 updater 角色经托管服务签名），仅剩冒烟工具与 pinned 注册表 drift 校验消费。
- (and , forms) English: Network-scoped legacy verifier signing material; drift-check only. The runtime surface receives (public key) for on-chain result verification. 中文：分网络的遗留 verifier 签名材料；仅用于 drift 校验。运行时表面只接收 （公钥），用于链上结果校验。
- / English: Network-scoped worker Neo N3 signing material (legacy). No worker lane reads these any more — both worker lanes sign through the custody service (); the names remain only in the pinned-registry drift checks and legacy smoke tooling. 中文：分网络的 worker Neo N3 签名材料（遗留）。worker 两条通道均已不再读取——签名一律走托管服务（）；该变量名仅存在于 pinned 注册表 drift 校验与旧的冒烟工具中。
- English: Legacy generic testnet operator WIF accepted only by local smoke tooling and the pinned-registry drift checks; no runtime lane reads it. 中文：旧的通用 testnet WIF，仅本地冒烟工具与 pinned 注册表 drift 校验接受；运行时通道均不读取。
RPC Endpoint Aliases / RPC 地址别名
- / English: Network-scoped Neo N3 RPC endpoints; preferred over the generic when the relayer pins a network. 中文：分网络 Neo N3 RPC 地址；relayer 固定网络时优先于通用 。
- , , , , , , , English: Comma-separated failover RPC lists plus accepted legacy single-URL aliases, merged in that order. 中文：逗号分隔的 RPC failover 列表以及兼容的旧单地址别名，按该顺序合并。
- English: Default false. When true, the generic values are also merged into a network-pinned RPC pool. 中文：默认 false。为 true 时，通用 也会并入已固定网络的 RPC 池。
Relayer Operations / Relayer 运行参数
- English: Production Rust lane selection: , , or (also the default when unset). 中文：生产 Rust 通道选择：、 或 （不设置时也默认 combined）。
- / English: requires sync enabled and at least one comma-separated symbol; config validation and runtime readiness both fail closed otherwise. may explicitly disable feed sync and operate as a request-only deployment; when feed sync is enabled it has the same symbol requirement. 中文： 必须启用同步并至少配置一个逗号分隔的 symbol，否则配置校验与运行时就绪检查都会失败关闭。 可显式关闭 feed sync 并退化为仅请求部署；启用 feed sync 时同样必须配置 symbol。
- / English: NeoX oracle and datafeed contract addresses. Request mode requires the oracle address; an enabled feed mode requires the datafeed address. 中文：NeoX oracle 与 datafeed 合约地址。request 模式需要 oracle 地址；启用 feed 时需要 datafeed 地址。
- English: Default . Retry ceiling for prepared-callback and finalize-only redelivery before the event is dead-lettered. 中文：默认 。prepared callback / finalize-only 重投的重试上限，超过即进入 dead letter。
- English: Default 120000. Healthcheck fails when the relayer heartbeat state is older than this. 中文：默认 120000。relayer 心跳状态超过该时长未更新时健康检查判定失败。
- English: Default 250. Minimum interval between relayer state-file persists. 中文：默认 250。relayer 状态文件两次落盘之间的最短间隔。
- English: Optional request-id cursor override used when no checkpoint exists for the request lane. 中文：request 通道没有 checkpoint 时使用的可选起始 request id。
- English: Default 45000. Confirmation wait budget for the NeoX EVM lane. 中文：默认 45000。NeoX EVM 通道等待交易确认的超时。
- / English: Relayer-specific overrides for / . 中文：relayer 专用的 / 覆盖项。
- English: Defaults to the value of . When true, durable-queue persistence failures block checkpoint advance instead of failing open. 中文：默认跟随 。为 true 时，持久化队列写入失败会阻止 checkpoint 前进，而不是放行。
- (legacy alias ) English: Default 300000. Cooldown before retrying Supabase persistence after repeated failures. 中文：默认 300000。Supabase 持久化连续失败后的重试冷却时间。
- English: Default 3000 (minimum 250). HTTP timeout for BetterStack heartbeat pings. 中文：默认 3000（最小 250）。BetterStack 心跳请求的 HTTP 超时。
BetterStack Telemetry / BetterStack 遥测
- / / English: Optional heartbeat URLs for the request lane, the feed lane, and explicit failure reporting; unset disables the ping. 中文：request 通道、feed 通道和失败上报的可选心跳地址；不设置则不发送。
- / English: Log-shipping credentials; both must be set to enable the BetterStack log sink. 中文：日志上报凭据；两者都设置后才启用 BetterStack 日志通道。
- (default 20) / (default 2000) / (default 2000) / (default 500) English: Batching, flush cadence, request timeout, and bounded-queue size for the log sink. 中文：日志通道的批量大小、刷新周期、请求超时和队列上限。
Worker Capacity And Providers / Worker 容量与数据源
- (default 16), , (default 6) English: Per-route in-flight request ceilings in the worker overload guard; disables the cap for that route. Other routes follow the same pattern (vrf*random 4, paymaster_authorize 8, oracle_smart_fetch 12, txproxy_invoke 12). 中文：worker 过载保护的分路由并发上限； 表示该路由不限。其他路由遵循同样的 命名（vrf_random 4、paymaster_authorize 8、oracle_smart_fetch 12、txproxy_invoke 12）。
- English: Default 2. Retry count for upstream market-data provider fetches. 中文：默认 2。上游行情 provider 拉取的重试次数。
- (default 3) / (default 60000) English: Circuit-breaker trip threshold and reset window for failing providers. 中文：provider 熔断的失败阈值与恢复窗口。
- English: TTL for the short-lived provider response cache. 中文：provider 响应短缓存的 TTL。
- English: Default . Aggregation method when multiple providers serve one pair. 中文：默认 。多 provider 喂同一交易对时的聚合方法。
- English: Default . Filesystem path for the persisted feed scheduler state. 中文：默认 。feed 调度器持久化状态的文件路径。
- English: Default 10000 (minimum 1000). Per-pair timeout inside a feed sync pass. 中文：默认 10000（最小 1000）。一次 feed 同步里单个交易对的超时。
- / English: Toggles for bootstrapping feed state from Supabase and for writing feed snapshots back to Supabase. 中文：从 Supabase 引导 feed 状态、以及把 feed 快照写回 Supabase 的开关。
- English: Default 65536. Size cap for registered compute scripts. 中文：默认 65536。注册 compute 脚本的大小上限。
- / / / English: Input/body size caps for compute payloads, ZKP verification inputs, oracle script inputs, and generic upstream responses. 中文：compute 入参、ZKP 校验入参、oracle 脚本入参和通用上游响应体的大小上限。
- / / English: ZKP verification runtime selection, timeout, and snarkjs binary override. 中文：ZKP 校验的运行时选择、超时和 snarkjs 可执行文件覆盖。
- English: Comma-separated host allowlist for raw oracle HTTP fetches. 中文：oracle 原始 HTTP 拉取允许访问的主机列表，逗号分隔。
Nitro Signer And AWS Integration / Nitro 签名器与 AWS 集成
- (alias ) English: Default . The frontier enclave, used only for the runtime marker and the NSM document. It holds no signing key — signing goes to the custody enclave via . 中文：默认 。frontier enclave，仅用于 运行时标记与 NSM 证明文档。它不持有签名密钥——签名走 custody enclave 的 。
- English: Defaults to . Endpoint used to fetch Nitro attestation documents. 中文：默认等于 。获取 Nitro attestation 文档的地址。
- English: When true-like, worker responses can attach Nitro (NSM) attestation metadata. 中文：为 true 时 worker 响应可以附带 Nitro (NSM) attestation 元数据。
- English: Enables derived role keys via the signer. 中文：通过 signer 启用派生角色密钥。
- (default ) / (default ) English: AWS Secrets Manager secret ids for the oracle transport wrapping key and the NeoDID salt. 中文：oracle 传输封装密钥与 NeoDID salt 在 AWS Secrets Manager 中的 secret id。
- English: Default . Region for the Secrets Manager lookups above. 中文：默认 。上述 Secrets Manager 访问使用的区域。
- / English: Worker HTTP listen port, checked in that order. 中文：worker HTTP 监听端口，按该顺序取值。
Oracle Key Material Overrides / Oracle 密钥材料覆盖
- / / / English: Explicit oracle X25519 transport-key injection; takes precedence over sealed-keystore and derived-key paths. 中文：显式注入 oracle X25519 传输密钥；优先于封装 keystore 与派生密钥路径。
- English: Default false. In non-production development, allows a process-lifetime ephemeral oracle key when no stable key source is available — decryptability ends with the process. The worker rejects this opt-in when and logs stable/configured key-source failures before any development fallback. 中文：默认 false。在非生产开发环境中，没有稳定密钥来源时允许使用进程级临时 oracle 密钥——进程结束后密文不可解。 时 worker 会拒绝此选项，并在开发回退前记录稳定/显式密钥来源失败。
- English: NeoDID commitment salt. NeoDID digest signatures are custody-side (the enclave signs under ); there is no any more. 中文：NeoDID 承诺 salt。NeoDID 摘要签名走托管服务（enclave 以 签名）； 已移除。
Chain Write Safety Toggles / 链上写入安全开关
- English: Default false. Required for the raw signed-transaction broadcast route. 中文：默认 false。开启后才允许广播原始已签名交易。
- English: Default false. Allows Global witness scope in sponsored transactions instead of CalledByEntry. 中文：默认 false。允许代付交易使用 Global witness scope，而不是 CalledByEntry。
- English: Default 10. Cap (in GAS) on the network fee the sponsor lane will pay per transaction. 中文：默认 10。代付通道单笔交易愿意承担的网络费上限（GAS）。
- English: Default false. The raw sponsorship path stays disabled until this explicit runtime gate is enabled. Enabled requests must also provide an unsigned-transaction , target contract, and method that match the transaction script. 中文：默认 false。原始 代付路径保持关闭；只有显式开启此运行时开关，且请求提供与交易脚本一致的 unsigned 、目标合约和方法时才会处理。
Paymaster (Testnet Lane) / Paymaster（testnet 通道）
- / English: Per-network paymaster enablement; mainnet defaults to disabled. 中文：分网络 paymaster 开关；mainnet 默认关闭。
- / / / / / English: Testnet paymaster wiring: AA core and hook contract hashes, policy id, RPC override, and per-op gas ceiling. 中文：testnet paymaster 接线：AA core 与 hook 合约地址、policy id、RPC 覆盖和单次操作 gas 上限。
- / / / / English: Comma-separated allow/deny lists evaluated before sponsoring a user operation. 中文：代付前检查的逗号分隔允许/拒绝清单。
- / English: Explicit inner-contract allowlists for AA user operations when an on-chain whitelist hook is not configured. User operations fail closed unless this list or the on-chain hook policy is configured. 中文：AA user operation 未配置链上白名单 hook 时使用的内层合约白名单；两种策略都未配置时拒绝代付。
NeoX Message Lane / NeoX 消息通道
- (aliases , ) / / (alias ) English: EVM RPC endpoint, message contract address, and chain id for the NeoX encrypted-message reveal lane. 中文：NeoX 加密消息 reveal 通道使用的 EVM RPC、消息合约地址和 chain id。
Misc Aliases / 其他别名
- English: Additional legacy alias for the Supabase server key, read after / . 中文：Supabase 服务端 key 的另一个旧别名，排在 / 之后读取。
- English: JSON blob carrying runtime configuration injected by the deployment env files; individual env vars override its fields. 中文：部署 env 文件注入的运行时 JSON 配置；单独的环境变量优先于其中字段。
- / English: Network-scoped contract-hash overrides preferred over the unscoped names when the network is pinned. 中文：分网络合约地址覆盖项；固定网络时优先于不带后缀的变量。
- English: Legacy alias still accepted for the datafeed contract hash. 中文：datafeed 合约地址仍然接受的旧别名。
- English: Default 20. Web app only: 1-in-N sampling rate for successful monitoring GET operation logs ( logs every probe). 中文：默认 20。仅 web 应用使用：成功的监控类 GET 操作日志按 1/N 采样（设为 则每次都记录）。
Practical Advice / 实操建议
If you are the operator of this stack, the shortest checklist is:
如果你是这套系统的运维者，最短的检查清单只有下面这些：
- Make sure all contract addresses match the live deployed contracts. 确认所有合约地址与当前实际部署一致。
- Make sure updater / relayer keys still control the configured updater accounts. 确认 updater / relayer 私钥仍然对应当前链上 updater 账户。
- Make sure , , and are valid. 确认 、、 都是有效的。
- Keep unset unless you intentionally want user JS execution. 除非你明确要支持用户 JS 脚本，否则保持 不设置。
- Tune instead of changing hardcoded timeouts in code. 想调整 WASM 执行时间时，改 ，不要改代码里的硬编码。
CURRENT DESIGNUPDATED FOR DUAL-CVM ARCHITECTURE