# Summary

You can now configure a service in an AI-native estate and manage its secrets safely.

In this module, you:

- **Classified** every value as a domain invariant (a named code constant), a
  deployment parameter (typed config), or a secret (a `SecretRef`), using the
  12-Factor litmus test to draw the line.
- Assembled config through the **precedence chain** - defaults, `config.toml`,
  `config.{env}.toml`, `COG_*` env vars, then CLI arguments - where later wins,
  and selected the environment by **which overlay file loads**, never by branching
  on the environment name in code.
- Parsed config **once at the boundary** into one typed, immutable value that
  **fails closed** on invalid or missing input, with a precise, layer-attributed
  error.
- Kept secrets out of git with the **three planes**, held a **`SecretRef`** in
  config that resolves at runtime, and used **dotenvx** to commit only
  encrypted-at-rest `.env` files with the private key held in the store.

The single idea underneath all of it: nothing environment-specific is hardcoded,
every secret is a reference, and a misconfigured service refuses to run rather
than fail deep in production.

## Next steps

- @cogitave.learn.secure-sdlc - the next module in **Engineering standards for
  an AI-native org**, on the controls and lifecycle gates a product carries beyond
  configuration.
- The **configuration standard** is the canonical reference, in Cogitave's
  standards repository, for the full conformance checklist, feature flags via
  OpenFeature, and config-as-code drift control.
- The **secrets & environment standard** and **ADR-0008** are Cogitave's
  canonical references for the secret store, rotation policy, and dev-env
  handling in full.