diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..301cf65
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,48 @@
+# Tapir — Stage-0 demo configuration. Copy to .env, fill in, and:
+#   set -a && . ./.env && set +a
+# No secrets are committed. At demo time, source secret values from op
+# (e.g. `op run -- ./bin/tapir run`) rather than pasting them here.
+#
+# Required-by-command:
+#   tapir auth : TAPIR_YT_CLIENT_ID, TAPIR_YT_CLIENT_SECRET, TAPIR_YT_TOKEN_REF, TAPIR_SECRETS_FILE
+#   tapir run  : the above + TAPIR_USER_ID, TAPIR_GATEWAY_URL, TAPIR_SUMMARIZER_MODEL, TAPIR_DB_DSN
+
+# --- identity -------------------------------------------------------------
+# The Tapir user this run operates as. MUST be a UUID (keys the user_id columns).
+TAPIR_USER_ID=
+
+# --- local AI gateway (LiteLLM) -------------------------------------------
+# OpenAI-compatible base URL (".../v1"). Default targets the koala NodePort.
+TAPIR_GATEWAY_URL=http://koala:30401/v1
+# Gateway key — sk-local-123 is STALE (401s); resolve LITELLM_MASTER_KEY from op.
+TAPIR_GATEWAY_KEY=
+# Summarization model alias, host/name form. Overridable; pick the final alias
+# when the gateway is reachable. Thinking models (qwen3/deepseek-r1) are viable —
+# the llm client now sends max_tokens=8192.
+TAPIR_SUMMARIZER_MODEL=koala/phi4-mini
+# Bounds a single completion call (Go duration). Generous for slow thinking models.
+TAPIR_SUMMARIZER_TIMEOUT=5m
+
+# --- Postgres store -------------------------------------------------------
+# DSN for the store sink; migrations apply on first connect. At demo time:
+# kubectl port-forward the postgres18 service, create a tapir db/role, point here.
+TAPIR_DB_DSN=postgres://tapir:PASSWORD@localhost:5432/tapir?sslmode=disable
+
+# --- YouTube OAuth (your registered client) -------------------------------
+# From Google Cloud console; YouTube Data API enabled; your account a test user.
+# The authorized redirect URI must match TAPIR_OAUTH_REDIRECT_ADDR + /callback.
+TAPIR_YT_CLIENT_ID=
+TAPIR_YT_CLIENT_SECRET=
+# Opaque SecretStore reference the refresh token is stored/resolved under.
+TAPIR_YT_TOKEN_REF=youtube/refresh_token
+# host:port the `auth` command binds for the local OAuth redirect listener.
+TAPIR_OAUTH_REDIRECT_ADDR=localhost:8080
+
+# --- secret store (Stage-0 stand-in for op/ESO) ---------------------------
+# Path to the 0600 file-backed SecretStore. Defaults to
+# <user-config-dir>/tapir/secrets.json if unset.
+TAPIR_SECRETS_FILE=
+
+# --- run loop -------------------------------------------------------------
+# Empty/0 = single pass. Set (e.g. 15m) to poll on that cadence.
+TAPIR_POLL_INTERVAL=
diff --git a/.gitignore b/.gitignore
index 8c92512..8589f72 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,4 +9,5 @@
 # Local env / editor
 .env
 .env.*
+!.env.example
 *.local