Operating mode
Test mode talks to the test Urbanride; production mode talks to the live one and bookings are real. Switching voids every open preview and ends every active session for every user. Each mode uses its own Urbanride Bot API key (below) — production cannot be entered until its key is stored.
Text model
Voice defaults
The default provider opens first in the picker. Locking it removes the per-session choice entirely — every voice session uses the default.
API keys
Keys are stored encrypted and are write-only: the console shows the last four characters, never the value. A replaced key is used from the next request — no restart.
Users
The registry lives in config/pilot-users.json on the server. Sign-in matches the host token's subject against each user's email. Admin access is granted by the host application's token (role: "admin"), not by anything in this list — gate it where you gate the rest of your app (ATLAS_ADMIN_EMAILS is the bootstrap exception).
| Name | Capabilities | Environment |
|---|