ARDR: P0 StarIntel deployment config, trusted init, and secret boundary #193

New issue

Open

opened 2026-09-02 17:26:15 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:26:15 +00:00

Owner

Scope

Bounded ARDR research transaction seeded by lost-rob0t/starintel-server#38 after complete current issue-backlog enumeration.

Concrete problem

The original #38 issue mixes already-repaired deployment defects with a real residual configuration/security boundary. Current starintel-server/master already uses a Nix-built OCI image with the application closure, Compose service DNS/readiness, Valkey, loopback host bindings, and Compose secret files. Research must preserve those repairs rather than re-design Docker.

Residual gap: normal runtime settings are still materialized through an executable Lisp init file selected by STAR_SERVER_INIT_FILE; environment/secret handling is split between shell entrypoint and Lisp helpers; and #38's remaining TLS/base-path/config/production-secret behavior needs a single validated deployment contract.

Exact implementation baseline

lost-rob0t/starintel-server@8fb297d146e7332fae7e38170b5b49d49530ac53

Relevant source:

docker-compose.yml
nix/images.nix
docker/star-server-entrypoint.sh
docker/star-server-init.lisp
scripts/stack-test.sh

Research target

Define the smallest StarIntel-native boundary that:

keeps current Nix OCI/Compose packaging;
uses data-only validated configuration for ordinary settings;
keeps any executable Lisp startup extension explicitly separate and trusted;
normalizes VALUE / VALUE_FILE secret resolution consistently without logging secret values;
rejects unsafe production defaults/unknown settings where required;
aligns readiness/lifecycle with #37 and thread/admission configuration with #34/#35/#36;
adds no new StarLang syntax unless a genuine language semantic is discovered.

Approval boundary

Research may become READY_FOR_DESIGN and design may be produced automatically. Implementation authorization remains PENDING / operator-only.

## Scope Bounded ARDR research transaction seeded by `lost-rob0t/starintel-server#38` after complete current issue-backlog enumeration. ## Concrete problem The original #38 issue mixes already-repaired deployment defects with a real residual configuration/security boundary. Current `starintel-server/master` already uses a Nix-built OCI image with the application closure, Compose service DNS/readiness, Valkey, loopback host bindings, and Compose secret files. Research must preserve those repairs rather than re-design Docker. Residual gap: normal runtime settings are still materialized through an executable Lisp init file selected by `STAR_SERVER_INIT_FILE`; environment/secret handling is split between shell entrypoint and Lisp helpers; and #38's remaining TLS/base-path/config/production-secret behavior needs a single validated deployment contract. ## Exact implementation baseline `lost-rob0t/starintel-server@8fb297d146e7332fae7e38170b5b49d49530ac53` Relevant source: - `docker-compose.yml` - `nix/images.nix` - `docker/star-server-entrypoint.sh` - `docker/star-server-init.lisp` - `scripts/stack-test.sh` ## Research target Define the smallest StarIntel-native boundary that: - keeps current Nix OCI/Compose packaging; - uses data-only validated configuration for ordinary settings; - keeps any executable Lisp startup extension explicitly separate and trusted; - normalizes `VALUE` / `VALUE_FILE` secret resolution consistently without logging secret values; - rejects unsafe production defaults/unknown settings where required; - aligns readiness/lifecycle with #37 and thread/admission configuration with #34/#35/#36; - adds no new StarLang syntax unless a genuine language semantic is discovered. ## Approval boundary Research may become `READY_FOR_DESIGN` and design may be produced automatically. **Implementation authorization remains PENDING / operator-only.**