> ## Documentation Index > Fetch the complete documentation index at: https://docs.qredence.ai/llms.txt > Use this file to discover all available pages before exploring further. # fleet-rlm configuration reference > Reference for fleet-rlm runtime policy: config/fleet.toml profiles, FLEET_* environment inputs, MLflow tracing, and recursive RLM bounds. Fleet starts from the required, committed `config/fleet.toml` policy file. The active profile is selected by `[config] default_profile` inside that file. Policy is strict, resolved once at process startup, and takes effect only after restart. The TOML file contains no secret values. It declares environment-variable names for Root/Sub API keys, the database URL, the Daytona API key, and managed MLflow destinations. Only those named values are read from the process environment or repository `.env` (process values win). Other `FLEET_*` variables — including model, RLM, endpoint, runtime, and MLflow settings — are ignored unless the selected profile explicitly names them. `FLEET_CONFIG_PROFILE` is not consulted. Unknown TOML keys, absent profiles, missing TOML, and invalid variable references fail startup. ## Runtime prerequisites The provider environment contract is policy-derived. The shipped interactive profiles (`daytona`, `daytona-recursive`) use OpenCode Go. Managed and benchmark profiles use the Databricks AI Gateway. Every provider-backed profile also requires `FLEET_DAYTONA_API_KEY`. | Profile family | Provider values | Persistence and tracing | | ------------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `daytona` / `daytona-recursive` | `FLEET_OPENCODE_GO_API_KEY`, `FLEET_OPENCODE_GO_BASE_URL`, `FLEET_DAYTONA_API_KEY` | Configure `FLEET_DATABASE_URL` at Alembic head for durable deployment; local SQLite is suitable for development. Local MLflow tracing is enabled. | | `daytona-managed` | `DATABRICKS_TOKEN`, `FLEET_DATABRICKS_AI_GATEWAY_BASE_URL`, `FLEET_DAYTONA_API_KEY` | `FLEET_DATABASE_URL` and every managed MLflow environment name below are required. | | `daytona-bench` / `daytona-bench-40` | `DATABRICKS_TOKEN`, `FLEET_DATABRICKS_AI_GATEWAY_BASE_URL`, `FLEET_DAYTONA_API_KEY` | Use the explicitly configured database for benchmark runs. MLflow tracing is disabled. | Profiles are explicit and do not fall back to each other. Daytona startup never applies migrations; use `uv run python scripts/db_init.py` or Alembic directly. The [generated profile matrix](https://github.com/qredence/fleet-rlm/blob/main/docs/reference/profile-matrix.md) shows the provider, token, recursion, and environment contract derived from `config/fleet.toml`. ## Policy structure `config/fleet.toml` deep-merges `[defaults]` into the selected `[profiles.]`. It centralizes: * Application identity. * Runtime timeouts, leases, liveness, and the credentialed-command live switch. * Root/Sub model ids, provider-service routing, endpoint, token limit, temperature, cache, retries, and secret-variable references. * RLM limits and host verbosity. * Storage limits and the database variable reference. * Daytona API-key/Volume/Snapshot policy. * MLflow tracking policy. * Fleet/DSPy logger level. `storage.max_upload_bytes` bounds uploads and workspace files, `storage.max_url_bytes` bounds fetched public URL sources, and `storage.max_artifact_bytes` bounds artifact bodies. ### Live commands `runtime.live_enabled` defaults to `true` for explicitly invoked provider, Daytona, and Prime Oolong commands. Set it to `false` in the selected TOML policy to fail closed before those commands construct provider or Daytona clients. This policy replaces the old `FLEET_LIVE=1` shell switch; invoking a live command remains an explicit operator action, and the required credentials are still validated. ### MLflow tracing When tracing is enabled, `mlflow.async_logging` keeps trace export off the Turn critical path and `mlflow.trace_sampling_ratio` controls the fraction of Turns sent to MLflow. The committed default is asynchronous export with a `1.0` sampling ratio. Trace payloads retain bounded, readable prompts, reasoning, generated code, tool payloads, and responses. `mlflow.trace_content_max_chars` bounds each readable field and defaults to `10000` characters. The trace export boundary still protects credentials, connection strings, private paths, and system-prompt dumps. The `mlflow.trace_content_mode` setting is removed. `fleet.toml` files that still set `trace_content_mode = "safe"` fail validation with an unknown-key error; delete the key. Trace content is now always readable (bounded by `mlflow.trace_content_max_chars`). Benchmark profiles (`daytona-bench`, `daytona-bench-40`) keep tracing off to stay traceless. Fleet enables MLflow DSPy inference autologging for the selected experiment; compile and evaluator traces remain disabled for live Turn observability. ### PostHog product analytics The optional `[posthog]` policy section controls fail-soft PostHog product analytics. The shipped `[defaults.posthog]` policy enables analytics against the EU ingestion host and stays disabled whenever the named token variable is absent. Analytics never block startup, and re-init during the FastAPI lifespan is idempotent. | Setting | Description | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | `posthog.enabled` | Switches analytics on or off for the selected profile. | | `posthog.project_token_env` | Environment variable that holds the PostHog project token. The token is read as a `SecretStr` and never logged. | | `posthog.host` | Ingestion host. Must be an absolute `http(s)` URL; trailing slashes are normalized. The committed default targets the EU instance. | Benchmark profiles (`daytona-bench`, `daytona-bench-40`) explicitly disable analytics to stay traceless, mirroring the MLflow policy. Every event shares one stable per-installation `distinct_id` persisted under the storage data root at `/analytics-instance-id`. The deterministic local user id is never used as a PostHog identity, so multiple installations remain distinct. PostHog exception autocapture is disabled; Turn failures are captured through sanitized failure messages only. The client emits these events from the corresponding HTTP routes: | Event | Trigger | | ------------------------------------ | --------------------------------------------------------------------------- | | `session_created`, `session_updated` | `POST /api/sessions`, `PATCH /api/sessions/{id}` | | `turn_created` | `POST /api/sessions/{id}/turns` (post-open, pre-stream) | | `turn_failed` | Turn open-failure and stream-failure phases; client disconnect is excluded. | | `artifact_downloaded` | `GET /api/artifacts/{id}` | | `run_cancellation_requested` | `POST /api/runs/{id}/cancel` | | `skill_listed` | `GET /api/skills` | | `settings_policy_updated` | `PATCH /api/settings/policy` | The Settings API exposes `posthog.enabled`, `posthog.project_token_env`, and `posthog.host` for editing through the loopback `/api/settings` surface. Changes apply after the next Fleet restart. Example policy: ```toml config/fleet.toml theme={null} [defaults.posthog] enabled = true project_token_env = "POSTHOG_PROJECT_TOKEN" host = "https://eu.i.posthog.com" [profiles.daytona-bench.posthog] enabled = false ``` ### Recursive RLM The `[rlm]` recursion settings bound the native `rlm_query(prompt=prompt)` child harness: | Setting | Description | | ---------------------------------- | ------------------------------------------------------------------------------------------------------ | | `recursion_enabled` | Enable one real child level. Default profiles keep recursion disabled; `daytona-recursive` enables it. | | `recursion_max_calls` | Bounded number of native child queries per Turn. | | `recursion_max_prompt_chars` | Cap on the prompt characters passed to each child. | | `recursion_child_max_iters` | Iteration cap inside each child RLM. | | `recursion_child_max_llm_calls` | Semantic LM call cap inside each child. | | `recursion_child_max_output_chars` | Output character cap per child. | | `recursion_max_parallel_children` | Maximum concurrent independent child RLMs. Defaults to `2`. | The native recursive-child boundary is a fixed product invariant (`RLM_NATIVE_CHILD_DEPTH = 1`), not an editable policy value. Policies that still set `rlm.recursion_max_depth` fail validation; delete the key. Under `daytona-recursive`, each child receives a fresh, dedicated Daytona Sandbox, ordinary Daytona network egress, and the same Volume ID mounted at `recursive///`. That private sibling scope cannot reach the Root `workspaces/` mount. The child receives no Fleet Tools or credentials; strict cleanup purges its scope and deletes its Sandbox before Root success can commit. ### Autonomous memory `rlm.autonomous_memory_categories` is a TOML-only list of canonical Workspace Memory category names and defaults to `[]`, which omits `propose_memory` from the Root Tool inventory entirely. A non-empty allowlist enables a Root-only, Run-scoped candidate collector and permits best-effort promotion only after a successful durable Turn commit; it does not change explicit-user memory behavior. ## Environment inputs Only variables named by the selected profile are read. | Variable | Policy reference | Meaning | | --------------------------------------------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | `FLEET_DATABASE_URL` | `storage.database_url_env` | Async SQLAlchemy URL; required by the managed profile and durable deployments. | | `FLEET_DAYTONA_API_KEY` | `daytona.api_key_env` | Daytona provider credential for every profile. | | `FLEET_OPENCODE_GO_API_KEY` | Root/Sub `api_key_env` in `daytona` and `daytona-recursive` | OpenCode Go credential. | | `FLEET_OPENCODE_GO_BASE_URL` | Root/Sub `base_url_env` in `daytona` and `daytona-recursive` | OpenCode Go endpoint. | | `FLEET_OPENAI_API_KEY` | Custom Root/Sub `api_key_env` reference | OpenAI-compatible provider credential for custom policy only. | | `DATABRICKS_TOKEN` | Root/Sub `api_key_env` in managed and benchmark profiles | Databricks AI Gateway credential. | | `FLEET_DATABRICKS_AI_GATEWAY_BASE_URL` | Root/Sub `base_url_env` in managed and benchmark profiles | Databricks AI Gateway endpoint. | | `FLEET_MLFLOW_EXPERIMENT_NAME` | `daytona-managed.mlflow.experiment_name_env` | Managed MLflow experiment. | | `FLEET_MLFLOW_TRACE_CATALOG` / `FLEET_MLFLOW_TRACE_SCHEMA` | `daytona-managed.mlflow.*_env` | Unity Catalog destination. | | `FLEET_MLFLOW_TRACE_TABLE_PREFIX` / `FLEET_MLFLOW_TRACING_SQL_WAREHOUSE_ID` | `daytona-managed.mlflow.*_env` | Trace table prefix and SQL warehouse. | | `POSTHOG_PROJECT_TOKEN` | `posthog.project_token_env` | PostHog project token for product analytics. Analytics are enabled by the shipped policy but stay disabled when this variable is absent. | Model ids may use an explicit `provider/model` prefix. For an OpenAI-compatible base URL, bare ids are normalized with the `openai/` prefix before constructing `dspy.LM`. ## Terminal-only setting `FLEET_API_URL` changes the standalone pi-tui API base URL from `http://127.0.0.1:8000`. It is not a backend `Settings` field and is unnecessary when the supervised `fleet cli` command supplies the local API URL. ## Local terminal editing The pi-tui `/settings` command reads and edits the non-secret policy in `config/fleet.toml`. It is available only to a loopback API client, including when an operator has explicitly exposed the normal API on another interface. The selector supports `[defaults]` and every existing named profile, and offers choice, text/number, and boolean child panels. Edits are revision-checked, atomically written, and validated against every profile before saving. They never read or display `.env` values or provider credentials; database and provider values are represented only by their environment-variable names. A saved policy applies only after Fleet is restarted; existing runtime composition and active Turns are never changed in place. The companion pi-tui `/profiles` command writes the chosen name to `config.default_profile` through the same loopback policy. It labels the active profile as running and a different `default_profile` as selected for restart. ## Example .env Copy the shipped template and fill only variables named by the selected profile: ```bash .env theme={null} # Every profile FLEET_DAYTONA_API_KEY=... FLEET_DATABASE_URL=postgresql+asyncpg://user:pass@host/db # Interactive profiles (daytona, daytona-recursive) FLEET_OPENCODE_GO_API_KEY=... FLEET_OPENCODE_GO_BASE_URL=https:///v1 # Managed or benchmark profiles # DATABRICKS_TOKEN=... # FLEET_DATABRICKS_AI_GATEWAY_BASE_URL=https:///serving-endpoints # FLEET_MLFLOW_EXPERIMENT_NAME=... # FLEET_MLFLOW_TRACE_CATALOG=... # FLEET_MLFLOW_TRACE_SCHEMA=... # FLEET_MLFLOW_TRACE_TABLE_PREFIX=... # FLEET_MLFLOW_TRACING_SQL_WAREHOUSE_ID=... ``` Never commit `.env`, credentials, raw provider failures, or evidence containing secrets. ## See also * [CLI reference](/fleet-rlm/reference/cli) * [HTTP API reference](/fleet-rlm/reference/http-api) * [Deployment guide](/fleet-rlm/guides/deployment)