Configuration reference

cengrid.config.jsonc is committed and contains no secret values. Comments are allowed.

Top-level fields

Field	Meaning
`contract`	`1`. Required.
`orgId`	Required. Short organisation identifier.
`publicUrl`	Required. The one public address.
`target`	Required. `docker`, `fly` or `aws`.
`services`	Required. Must include `core`. `slack`, `web-ui`, `admin`, `portal` and `auth` are optional. Drop `auth` to use an external identity provider.
`botName`	Optional, up to 31 characters. Names the bot in Slack app manifests, the prompt and sign-in pages. Default `Cengrid`.
`orgName`	Optional, up to 40 characters. How the bot refers to your organisation.
`modelProvider`	Optional: `anthropic`, `openai` or `openrouter`. Makes that key a required secret.
`model`	Optional default model, passed to core as `PI_MODEL`.
`plugins`	Extra services. A prebuilt image `{ "name": "linear", "image": "ghcr.io/you/cengrid-linear:1.0" }`, or a Dockerfile at `plugins/<name>/` with no entry needed.
`skills`	Extra directories of `SKILL.md` files to mount.
`env`	Non-secret environment per service, for example `env.core`, `env.portal`. Secret-shaped keys are rejected.
`secretEnv`	Per service, a map of environment-variable name to secret-store name, for example `secretEnv.core.SECURITY_SCREEN_PROXY_TOKEN`. The value itself lives in `.env` or your secret store, never in the config.
`sandbox`	Sandbox settings: `app`, `backend`, `image`, `baseImage`, `env`, `secretEnv`.
`securityScreen`	Optional external screening proxy. See below.
`region`, `flyOrg`	Fly only.
`aws`	AWS only: account, region, cluster, deploy-role ARN, secrets prefix, networking and per-service ECR and ECS settings.

The bot’s name and orgName can also be changed live under Governance → Advanced → Branding, a JSON field with the keys accent, mark, selfLabel and orgName, which then takes precedence over the deployed values. Further advanced keys (apiUrl, basePort, vms, imageOverrides, appPrefix, imageFrom and deployAppPrefix) are accepted too; see cli/src/config.ts for their meaning.

Command time limits

Each agent execute command has a wall-clock limit and is killed with exit code 124 when it runs over.

Variable	Default	Meaning
`env.core.EXEC_TIMEOUT_DEFAULT_SEC`	120	Limit for a command that sets none
`env.core.EXEC_TIMEOUT_MAX_SEC`	300	Ceiling on the limit the agent may set per command
`env.core.SANDBOX_TIMEOUT_SEC`	600	The sandbox’s own backstop

Security screen proxy

A securityScreen proxy receives one or more HTTPS POSTs per classification with content-type: application/json, the routed token in x-api-key and redirects disabled.

{
  "text": "untrusted content",
  "hook": "user_input",
  "metadata": {
    "surface": "webhook",
    "origin": "automation",
    "cengrid": { "request_id": "uuid", "input_index": 0, "chunk_index": 0, "chunk_count": 1 }
  }
}

hook is user_input or tool_response. The chunk coordinates are mirrored under your provider label so a direct provider endpoint can read its own namespace. A successful provider answers with finite score and threshold numbers from 0 to 1, and an optional lowercase primary_outcome:

{ "score": 0.91, "threshold": 0.7, "primary_outcome": "prompt_injection" }

Throttled requests retry with bounded backoff inside the classification deadline. Invalid responses, timeouts, redirects and other errors count as unavailable: enforcement fails closed, and shadow mode leaves the built-in model authoritative while recording the comparison. The configured provider is an audit label, not a built-in adapter name, so any service implementing this contract can be used.