[DDD] Replace direct runtime env reads with a bounded configuration registry

[seonghobae]

Problem and bounded context

Wardnet must capture non-secret process/bootstrap settings once, validate them at the delivery edge, and expose one immutable runtime snapshot to application/domain code. Runtime Configuration is a Supporting Subdomain. Process environment may remain an outer bootstrap transport, while CredentialRegistry remains authoritative for secret-bearing credential bootstrap. Runtime Configuration must not become a generic catch-all, secret store, or cross-service configuration database.

Protected/default truth is main@5829a0f08d78de464dd24393ce5d0f25fba9d126 through #159.

Current owning candidate — 2026-09-05

PR #140, refactor(config): centralize runtime bootstrap snapshot, is the canonical owning candidate at exact 054c11aafe835e497d6149efb09f1ccdee9d03bd on exact protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126. GitHub reports it Ready and mergeable. Fresh compare keeps protected main as the merge base with no behind commits. The branch integrated protected #159 non-destructively and retains the Runtime Configuration/Credential Registry boundary rather than duplicating protected workflow ownership.

The candidate:

• adds src/runtime_config.rs as the non-secret bootstrap adapter;
• loads one immutable RuntimeConfiguration before listener startup;
• derives application configuration from that snapshot plus CredentialRegistry;
• keeps secret environment/file bootstrap behind CredentialRegistry;
• recursively rejects new std::env::{var,var_os} reads outside designated Runtime Configuration/Credential Registry bootstrap adapters;
• documents Runtime Configuration as supporting/delivery architecture rather than domain authority;
• retains the deterministic lookup/test seam and standard-library temporary-directory repair, avoiding process-global environment races and undeclared test dependencies.

All current review threads are resolved. Three early Devin findings are outdated after their repairs; the credential-path thread is resolved and remains non-outdated because the causal fix removed WAF_IDS_CREDENTIALS_PATH from non-secret Runtime Configuration rather than creating duplicate path authority. The later public-API/documentation finding was repaired by the current docs/rustdoc increment. Resolved automated review is finding evidence, not independent human approval.

Latest hostile RED → causal GREEN

A fresh boundary review found that the positive integer bootstrap parser admitted zero for settings whose zero value is not a valid runtime bound.

• hostile RED 0f22aaffcf1db5f54190497f9fece5969cd89441 adds fail-closed regressions for RATE_LIMIT_WINDOW=0 and MAX_BODY_BYTES=0;
• causal GREEN d28a0119d4708b535dc04763dd51a11c835dba45 makes the positive-u64 bootstrap parser reject zero;
• current exact 054c11aafe835e497d6149efb09f1ccdee9d03bd is a linear child whose sole intervening commit, docs: raise runtime bootstrap doc coverage, changes rustdoc/documentation only and does not alter runtime authority or runner behavior;
• the distinct, intentional RATE_LIMIT=0 disable semantic remains unchanged rather than being conflated with positive-bound settings.

No predecessor workflow/review conclusion transfers to the current exact head.

Current exact-head evidence

Exact 054c11aafe835e497d6149efb09f1ccdee9d03bd remains non-passing at hosted execution:

• CI 33923492873 — queued; sole rust job 101186801054 is pre-checkout with steps=[], runner_id=0, empty runner identity, and explicit ubuntu-24.04;
• Fuzz 33923492809 — pending;
• Security Scan 33923492923 — queued;
• SAST Semgrep 33923493032 — queued;
• CodeQL PR 33923492956 — queued.

The exact candidate remains compatible with current protected main and mergeable at the PR graph layer. The current non-passing state is .github#712 runner/control-plane evidence, not ancestry breakage and not permission for no-op source churn or bypass. Fresh exact evidence is recorded on .github#712 comment 5547036615.

Live solo-maintainer governance also remains unreconciled: organization ruleset 18156473 still requires one generic approving review with no required reviewer/team and retains routine OrganizationAdmin/always bypass. .github#772 and current owner-plane PR .github#1644 own that repair; fresh Wardnet handoff is .github#772 comment 5547038262. Self/model approval and routine administrator bypass remain forbidden.

Required contract

1. Inventory every runtime process-environment read and classify secret bootstrap, non-secret runtime configuration, build/test-only input and external-tool input separately.
2. Build one immutable/versioned validated Runtime Configuration snapshot at the delivery/bootstrap boundary.
3. Preserve or explicitly version defaults, blank/unset semantics, bounds, URL/path validation, precedence and fail-closed startup behavior.
4. Move non-secret process settings behind the configuration port; no competing application/domain direct environment reads.
5. Keep secrets under CredentialRegistry; do not merge secret and non-secret authority.
6. Keep executable architecture fitness preventing provider/environment APIs from leaking inward.
7. Maintain realistic RED→GREEN coverage for defaults, malformed/boundary values, precedence, version mismatch and startup denial.
8. Keep architecture/ADR/runbook/threat model/gap baseline/CHANGELOG aligned with protected versus candidate maturity.
9. Preserve standalone operation and modular-monolith discipline; no service split solely for DDD terminology.

Completion gate

Close only after #140 or a verified successor carrying every unique code/test/docs delta reaches protected main, the resulting protected tree satisfies architecture fitness, and one unchanged exact integration candidate has terminal current repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence. No documentation-only closure, predecessor evidence reuse, self/model approval, no-op dispatch commit, routine bypass, force push, or gate weakening.

[seonghobae]

Fresh state correction — 2026-09-03: owning PR #140 is now exact 9389a2d63f0875f688de5ef3adff1ce6b54e1ab1, not the older 43d1b6e… snapshot in this issue body. The current lineage repairs the real nested architecture-fitness test regression without adding a lockfile dependency; current CodeQL is startup-failed and repository/central lanes remain non-terminal. No predecessor evidence transfers, and closure still requires protected integration plus the then-live architecture/security/coverage/governance gates.

[seonghobae]

Current owning candidate #140 has advanced non-force through the bootstrap-bounds RED→GREEN repair and current protected-main adoption.

Protected/default remains main@5829a0f08d78de464dd24393ce5d0f25fba9d126. Exact #140 is now 054c11aafe835e497d6149efb09f1ccdee9d03bd, Ready/mergeable and aligned with that protected base. The production behavior remains the causal d28a0119d4708b535dc04763dd51a11c835dba45 fix: the shared positive-u64 parser rejects zero for RATE_LIMIT_WINDOW and MAX_BODY_BYTES, while the intentional separate RATE_LIMIT=0 disable semantic is unchanged. The sole later increment is documentation/rustdoc coverage; no runtime authority changed.

The earlier pre-checkout queue snapshot is superseded. Fresh exact-head repository evidence is now:

• CI 33923492873 — SUCCESS;
• Fuzz 33923492809 — SUCCESS;
• Security Scan 33923492923 — SUCCESS;
• SAST Semgrep 33923493032 — SUCCESS;
• CodeQL PR 33923492956 — FAILURE, isolated to the central current-head dispatch/verdict path.

CodeQL detect-language job 101186802586 completed successfully. Compatibility job 101218136109 acquired a real Ubuntu 24.04 runner, verified the live PR/head, obtained the dispatch credentials, and successfully POSTed an exact codeql-scan repository dispatch on attempt 1. It then failed closed with VERDICT_STATE=pending because no authenticated terminal codeql-dispatch/actions status arrived. This downstream specimen is now attached to central producer defect .github#1925 comment 5552050347; .github#1926 is the narrow matrix-serialization repair and .github#1927/#1929 track the independent dispatcher-identity boundary.

There is no current #140 source/test/security failure to repair. Do not alter this head or rerun-storm CodeQL until the central producer path can publish a terminal authenticated verdict. Ordinary integration still also requires the live solo-maintainer governance repair under .github#772; self/model approval and routine administrator bypass remain invalid.