Configuration

HOCON config/base.conf is the single source of truth. Env vars enter only via ${?VAR} capture; application code reads synth.config.load_config() and never os.environ.

The ritual:

just resolve-config   # materialize -> build/config/synth.{env,json}
just preflight        # deny/warn validation (bin/preflight.py)
just policy           # conftest gate (policy/environment/synth.rego)

Preflight and the rego policy express the same deny/warn taxonomy, so the gates hold both in-process and in CI. Every deny message names its remediation.