# Public runtime environment

`.env.public` contains non-sensitive configuration that the cc-ci orchestrator
and its agent sessions need at runtime. It is intentionally tracked so it can
be inspected and reproduced with the rest of the CI configuration.

Load it together with the local secret file by sourcing
`/srv/cc-ci/cc-ci-plan/load-env.sh`. The helper reads `.env.public` first and
then `/srv/cc-ci/.testenv`; credentials, tokens, and keys belong only in the
latter file.

Do not put a value in `.env.public` merely because it is convenient. If it
would grant access or require rotation, it is a secret and belongs in
`.testenv`. Public service endpoints, model names, and account identifiers may
be tracked here.