Models and Runtimes

Warden selects one runtime backend for a config layer and can use separate model lanes for different kinds of model work.

Runtime

The runtime selects the backend used for model-backed execution. Configure it under [defaults]:

[defaults]
runtime = "pi"

Runtime	Purpose
`pi`	Default. Runs through Pi. Model values must use `provider/<provider-specific-model-id>` selectors.
`claude`	Runs through Claude Code. Requires Anthropic API key or Claude Code OAuth auth.

Runtime selection is global within a config layer. runtime is not currently a skill-level or trigger-level field.

Pi Model Selectors

When runtime = "pi", configured model values must include a provider prefix:

[defaults.agent]
model = "anthropic/claude-sonnet-4-6"

Examples:

Selector	Credential
`openai/gpt-5.5`	`WARDEN_OPENAI_API_KEY`
`anthropic/claude-sonnet-4-6`	`WARDEN_ANTHROPIC_API_KEY`
`fireworks/accounts/fireworks/models/kimi-k2p6`	`WARDEN_FIREWORKS_API_KEY`
`groq/llama-3.3-70b-versatile`	`WARDEN_GROQ_API_KEY`
`openrouter/meta-llama/llama-3.3-70b-instruct`	`WARDEN_OPENROUTER_API_KEY`
`together/meta-llama/Llama-3.3-70B-Instruct-Turbo`	`WARDEN_TOGETHER_API_KEY`
`cloudflare-workers-ai/@cf/moonshotai/kimi-k2.6`	`WARDEN_CLOUDFLARE_API_KEY` + `CLOUDFLARE_ACCOUNT_ID`
`cloudflare-ai-gateway/...`	`WARDEN_CLOUDFLARE_API_KEY` + `CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_GATEWAY_ID`

Warden splits Pi selectors at the first /. The provider comes before it and the provider-specific model ID comes after it, so model IDs may contain additional slashes. For example, cloudflare-workers-ai/@cf/moonshotai/kimi-k2.6 sets provider cloudflare-workers-ai and model ID @cf/moonshotai/kimi-k2.6.

Credential convention: Set WARDEN_{PROVIDER}_API_KEY to authenticate with a provider. Warden mirrors these to the native {PROVIDER}_API_KEY expected by each SDK at runtime. If you already have a native provider key set (e.g. OPENAI_API_KEY), Warden will use it directly and the WARDEN_-prefixed form is not required.

Multi-part credentials: Some providers require additional env vars beyond an API key. Cloudflare providers require CLOUDFLARE_ACCOUNT_ID (or WARDEN_CLOUDFLARE_ACCOUNT_ID). Cloudflare AI Gateway additionally requires CLOUDFLARE_GATEWAY_ID (or WARDEN_CLOUDFLARE_GATEWAY_ID). Warden mirrors these automatically when the WARDEN_-prefixed form is set.

Claude Runtime Models

When runtime = "claude", use the model IDs accepted by Claude Code:

[defaults]
runtime = "claude"

[defaults.agent]
model = "claude-sonnet-4-6"

In GitHub Actions, set WARDEN_ANTHROPIC_API_KEY or provide Claude Code OAuth auth. Locally, Claude runtime can also use existing Claude Code auth.

Model Lanes

Warden can use different models for different stages:

defaults.agent.modelstring: Main repo-aware skill analysis. Preferred default model field.
defaults.auxiliary.modelstring: Structured helper calls such as extraction, repair, merging, dedupe, and fix evaluation.
defaults.synthesis.modelstring: Post-analysis synthesis and consolidation. Falls back to defaults.auxiliary.model when unset.

[defaults]
runtime = "pi"

[defaults.agent]
model = "anthropic/claude-sonnet-4-6"
maxTurns = 30
effort = "medium"

[defaults.auxiliary]
model = "anthropic/claude-haiku-4-5"
maxRetries = 3

[defaults.synthesis]
model = "anthropic/claude-opus-4-5"

defaults.model and defaults.maxTurns are legacy shorthand for the agent lane. Prefer defaults.agent.model and defaults.agent.maxTurns in new config.

defaults.agent.effort optionally controls repo-aware skill effort across runtimes. Supported values are off, low, medium, high, and xhigh. When omitted, Warden sends explicit high adaptive thinking to the Claude runtime; Pi uses its own default thinking level.

Overrides

Skills and triggers can override the main agent model:

[[skills]]
name = "security-review"
model = "anthropic/claude-opus-4-5"

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize", "reopened", "labeled"]
draft = false
labels = ["Warden"]
model = "anthropic/claude-sonnet-4-6"

The CLI --model flag and WARDEN_MODEL environment variable are fallbacks. They only apply when the resolved skill or trigger path does not set a model.

Main agent model precedence, from highest to lowest:

Source	Notes
`skills.triggers.model`	Most specific. Applies to one trigger.
`skills.model`	Applies to one skill.
`defaults.agent.model`	Preferred global default.
`defaults.model`	Legacy global default.
`--model`	CLI fallback.
`WARDEN_MODEL`	Environment fallback.
SDK/runtime default	Used when no explicit model is set.

Auxiliary and synthesis models only come from [defaults.auxiliary] and [defaults.synthesis]. They do not inherit skill or trigger model overrides.

Effort is separate from model selection. For local runs, --effort overrides defaults.agent.effort for that invocation. Without either setting, each runtime uses its own default.

Generated Skill Commands

warden build and warden improve use the synthesis lane because they generate or revise skill artifacts. Their model fallback order is:

Source	Notes
`defaults.synthesis.model`	Preferred generated-skill model.
`defaults.auxiliary.model`	Fallback when synthesis is unset.
`--model`	CLI fallback for this command.
`WARDEN_MODEL`	Environment fallback.
SDK/runtime default	Used when no explicit model is set.