Every knob, threshold, and environment variable. No hidden defaults.
The detector classifies every piece of incoming content and decides whether it's worth saving. These are the thresholds that control that decision, all in src/threadweave/detector.py:
| Parameter | Default | Effect |
|---|---|---|
is_worth_saving min confidence | 0.35 | Content scoring below this is skipped. Lower = more saved, higher = stricter. |
| ANSWER weight | 1.0 | How heavily answer patterns contribute to the score. |
| DECISION weight | 1.0 | How heavily decision patterns contribute to the score. |
| REFERENCE per-match | 0.10 | Weight per reference pattern match (URLs, ticket numbers). Higher = more content classified as reference and skipped. |
| External source matches → force REFERENCE | 3+ matches | If content matches 3 or more external source patterns (newsletters, marketing, HR digests), it's forced to REFERENCE at 0.90 confidence and skipped. |
| External source penalty (1-2 matches) | Halve ANSWER/DECISION scores | Reduce substantive scores when 1-2 external source patterns are present. |
| LLM confidence minimum | 0.35 | Same threshold applied when LLM detector is active (matches regex). |
Seven levels, from least to most restrictive. The confidentiality engine in src/threadweave/confidentiality.py classifies content automatically using regex patterns. Saved entries can be manually reclassified.
| Level | Who can see it | Example |
|---|---|---|
| public | Anyone in the organization | Office Wi-Fi password, cafeteria menu |
| internal | Anyone in the org; never shared externally (Graph Connector excludes these) | Engineering roadmap, team processes |
| confidential | Wing members only | Client deliverables, project plans |
| restricted | Wing members + explicit access list | Pricing discussions, pre-release features |
| hr-confidential | HR wing only | Compensation, personnel matters |
| legal-privileged | Legal wing only | Attorney-client communications |
| client-confidential | People with access to that client_id | M&A deal terms, regulatory filings |
Each level is enforced at search time: entries above your clearance don't appear in results. The enforcement is at retrieval, not storage.
| Variable | Default | Description |
|---|---|---|
THREADWEAVE_PORT | 8000 | Port the API server listens on. |
THREADWEAVE_REQUIRE_AUTH | (off) | Set to 1 to enable API key authentication. |
THREADWEAVE_API_KEYS | (none) | Comma-separated tenant:key pairs. Admin key uses tenant *. |
MEMPALACE_PALACE_PATH | ~/.mempalace/palace/default | MemPalace data directory. |
By default, ThreadWeave uses regex detection. Set these variables to enable LLM-based classification via any OpenAI-compatible endpoint. The LLM only produces a classification label — never generates text.
| Variable | Example | Description |
|---|---|---|
THREADWEAVE_LLM_API_KEY | sk-... | API key. Falls back to OPENAI_API_KEY. |
THREADWEAVE_LLM_BASE_URL | http://localhost:11434/v1 | Endpoint. Ollama, vLLM, or any OpenAI-compatible server. |
THREADWEAVE_LLM_MODEL | llama3.1:8b | Model name. Must exist and be reachable. |
THREADWEAVE_LLM_PROVIDER | ollama | Provider hint. Used for logging and diagnostics. |
Without THREADWEAVE_LLM_BASE_URL set, the detector falls back to regex automatically. The /api/v1/health endpoint reports which detector is active.
| Variable | Used by | Description |
|---|---|---|
AZURE_TENANT_ID | Email Watcher, SharePoint | Azure AD tenant ID. |
AZURE_CLIENT_ID | Email Watcher, SharePoint | App registration client ID (needs Mail.Read, Sites.Read.All). |
AZURE_CLIENT_SECRET | Email Watcher, SharePoint | App registration client secret. |
THREADWEAVE_GRAPH_TENANT_ID | Graph External Connector | Azure AD tenant ID (may differ from the watcher app). |
THREADWEAVE_GRAPH_CLIENT_ID | Graph External Connector | App registration client ID (needs ExternalConnection.ReadWrite.OwnedBy). |
THREADWEAVE_GRAPH_CLIENT_SECRET | Graph External Connector | App registration client secret. |
MICROSOFT_APP_ID | Teams Bot | Bot Framework app ID. |
MICROSOFT_APP_PASSWORD | Teams Bot | Bot Framework app password. |
| Variable | Default | Description |
|---|---|---|
THREADWEAVE_GWS_CREDENTIALS_PATH | ~/.threadweave/gws_service_account.json | Path to service account JSON key file. |
THREADWEAVE_GWS_DELEGATED_ACCOUNT | (required) | Email of the user to impersonate via domain-wide delegation. |
THREADWEAVE_GWS_SCOPES | Gmail + Chat + Drive read-only | Comma-separated scope overrides. |
The detector patterns live in src/threadweave/detector.py. They're organized into named lists:
| Pattern list | Lines | Purpose |
|---|---|---|
DECISION_PATTERNS | ~40-56 | Explicit decisions: "we decided," "approved," "released as," "patched." |
ANSWER_PATTERNS | ~58-76 | Explanations: "the reason is," "you should," "the key insight." |
QUESTION_PATTERNS | ~78-91 | Questions that start with how/what/why/when or end with ?. |
CHAT_PATTERNS | ~93-110 | Casual conversation: greetings, thanks, acknowledgments. |
REFERENCE_PATTERNS | ~112-130 | Links, ticket numbers, PRs, file paths. |
EXTERNAL_SOURCE_PATTERNS | ~200-240 | Newsletters, HR digests, marketing, system notifications (21 patterns). |
Each pattern is a standard Python regex string. To add a custom pattern, append it to the relevant list. To tune for a specific language or domain, add equivalents. The patterns are plain text — no retraining, no model fine-tuning, no vendor dependency.
Authentication is off by default. Enable it with:
export THREADWEAVE_REQUIRE_AUTH=1 export THREADWEAVE_API_KEYS="tenant-eng:key-abc123,tenant-legal:key-def456,*:key-admin"
Each key maps to a tenant ID. Requests with X-API-Key: key-abc123 are scoped to tenant-eng — they can only see entries belonging to that tenant. The admin key (tenant *) bypasses scoping for administrative access.
Keys can also be stored in ~/.threadweave/keys.json:
{
"tenant-eng": "key-abc123",
"tenant-legal": "key-def456",
"*": "key-admin"
}
Endpoints exempt from auth (always open): GET /api/v1/health, GET /api/v1/metrics, GET /api/v1/metrics/prometheus.