Runtime configuration and policy

Make configuration a validated lifecycle, not an untyped key/value escape hatch. Read the repository's domain decisions, configuration loader, consumers, administrative permissions, secret-store contract, and testing policy first. Reuse the existing control plane rather than creating another settings service.

Classify settings and ownership

For each setting, identify its owner, type, validation, scope, sensitivity, default policy, source precedence, reloadability, consumers, and failure behavior. Keep these categories distinct:

• deployment/bootstrap settings needed to reach the configuration service;
• non-secret operational settings and references to protected secrets;
• business policies with draft, validation, publication, and revision semantics;
• activation flags, kill switches, and permissions that authorize effects.