refactor(config): centralize runtime bootstrap snapshot

CHANGELOG.md

@@ -10,3 +10,17 @@
 ### Operations
 
 - Documented administrator credential provisioning, rotation, rollout verification, rollback, evidence handling, and the boundary with the separate runtime-authentication fail-closed work tracked in issue #78.
+- Clarified the public `RuntimeConfiguration` bootstrap contract after the
+  September 2026 removal of `credentials_path`: external callers now keep
+  credential-file selection in `CredentialRegistry` and use
+  `RuntimeConfiguration` only for non-secret runtime settings. This separation
+  follows least privilege and fail-safe bootstrap boundaries rather than
+  treating process env as long-lived application authority; see Saltzer and
+  Schroeder (1975), NIST SP 800-57 Part 1 Rev. 5, and the repository copy at
+  `docs/papers/nist-sp-800-57-part-1-rev-5.pdf`.
+- Preserved protected startup semantics for `WAF_IDS_STATE_PATH`: absent,
+  empty, and whitespace-only bootstrap values all keep seeded in-memory state;
+  only a non-empty trimmed value enables JSON file persistence. The Runtime
+  Configuration adapter now enforces the same invariant before constructing a
+  `PathBuf`, with a hostile regression covering empty, space-only, and tab-only
+  inputs.

docs/architecture.md

@@ -27,7 +27,9 @@ flowchart LR
 
 ## Components
 
-- `src/main.rs`: process startup and operator configuration from `BIND_ADDR`, `ADMIN_TOKEN`, `WAF_IDS_STATE_PATH`, `DNSBL_ORIGIN`, and `EVENT_LIMIT`.
+- `src/runtime_config.rs`: runtime-configuration supporting subdomain bootstrap. Reads non-secret process settings from env once, validates them into an immutable `RuntimeConfiguration`, and passes that snapshot inward to `run_from_env`.
+- `src/credentials.rs`: secret bootstrap adapter. Reads `ADMIN_TOKEN`, `ADMIN_TOKENS`, and optional `WAF_IDS_CREDENTIALS_PATH` only at the process edge, then exposes a process-local `CredentialRegistry`.
+- `src/main.rs`: thin process entrypoint and shutdown-signal installation.
 - `src/lib.rs`: Axum app, routing, management APIs, optional JSON persistence, gateway handler, upstream proxying, admin console, support bundle assembly, NDJSON event export, and in-crate HTTP tests.
 - `crates/waf-ids-core`: reusable domain models plus validation, upsert, scoring, DNSBL zone export, event retention, threat-feed freshness, KPI snapshot, and commercial readiness logic.
 - `/admin`: embedded web console.
@@ -49,6 +51,30 @@ flowchart LR
 - **DNSBL Serving**: Hickory DNS should serve authoritative DNSBL responses directly after zone export semantics stabilize.
 - **AI SOC**: AI triage should summarize events, map likely ATT&CK tactics, and recommend actions. Enforcement-changing recommendations require human approval.
 
+### Further reading (runtime bootstrap authority separation)
+
+- Saltzer, J. H., & Schroeder, M. D. (1975). The protection of information in
+  computer systems. *Proceedings of the IEEE, 63*(9), 1278-1308.
+  https://doi.org/10.1109/PROC.1975.9939 - least privilege and fail-safe
+  defaults support keeping secret bootstrap in `CredentialRegistry` and making
+  application code consume one validated non-secret snapshot instead of reading
+  mutable environment variables throughout the runtime.
+- Barker, E. (2020). *Recommendation for key management: Part 1-General* (NIST
+  Special Publication 800-57 Part 1 Rev. 5). National Institute of Standards
+  and Technology. https://doi.org/10.6028/NIST.SP.800-57pt1r5 -
+  [`papers/nist-sp-800-57-part-1-rev-5.pdf`](papers/nist-sp-800-57-part-1-rev-5.pdf).
+  The protected-storage, access-control, replacement, and recovery lifecycle
+  maps to Wardnet's split between secret bootstrap inputs and non-secret
+  listener, DNSBL, and retention settings.
+- Krause, A., Klemmer, J. H., Huaman, N., Wermke, D., Acar, Y., & Fahl, S.
+  (2023). Pushed by accident: A mixed-methods study on strategies of handling
+  secret information in source code repositories. In *32nd USENIX Security
+  Symposium (USENIX Security 23)* (pp. 2527-2544).
+  https://www.usenix.org/conference/usenixsecurity23/presentation/krause -
+  operational evidence that repository-visible secrets remain a recurring
+  failure mode, which is why Wardnet keeps credential-file selection and admin
+  tokens out of `RuntimeConfiguration`.
+
 ### Further reading (CISA KEV catalog pull)
 
 - CISA. (2021). *Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities.* Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/known-exploited-vulnerabilities — the directive establishing the catalog's confirmed-active-exploitation inclusion criterion, which is why `kev_import.rs` treats catalog membership alone as at least `High` severity rather than deriving it from a numeric score.
@@ -59,7 +85,8 @@ flowchart LR
 
 - Default bind address is localhost.
 - Remote management requires `ADMIN_TOKEN` plus external TLS and identity controls.
-- `WAF_IDS_STATE_PATH` enables JSON state persistence for standalone operation. Without it, the service uses seeded in-memory state.
+- Runtime configuration is loaded once at bootstrap and handed inward as an immutable snapshot; application code does not read operational env vars directly.
+- `WAF_IDS_STATE_PATH` enables JSON state persistence only when its bootstrap value is non-empty after trimming. Absent, empty, or whitespace-only input preserves the seeded in-memory state mode.
 - File-backed writes use temporary sibling files followed by atomic rename. Management API mutations roll back in memory if the state file cannot be replaced.
 - Block mode is route-scoped to avoid global accidental enforcement.
 - JSON persistence is a baseline durability mechanism, not a substitute for a production database, backup plan, or audited change workflow.
@@ -71,4 +98,4 @@ flowchart LR
 - FigJam: `docs/figma/enterprise-product-architecture.md`
 - Product workflows: `docs/product-design/enterprise-operator-workflows.md`
 - Enterprise scorecard: `docs/analytics/enterprise-value-scorecard.md`
-- Complexity audit: `docs/ponytail/2026-07-02-complexity-audit.md`
+- Complexity audit: `docs/ponytail/2026-07-02-complexity-audit.md`