The boot-invariant set includes NAVIGATOR_SURREAL_ENDPOINT, RESTATE_BROKER_URL, storage configuration,
SESSION_SECRET, the SENDGRID_* keys, and DOCUSIGN_HMAC_KEY. The Environment Matrix above lists every startup key
by owning process and lifecycle; .env.example remains the per-variable contract with defaults, secret classification,
and provider-specific notes. See docs/oss-install.md §4 and .env.example.
Two rules keep client data safe, and the deploy will not let you skip them. First, plaintext secrets never live in the
manifest tree — key material is SOPS-encrypted per value in deployments/<name>/secrets.enc.yaml, decrypted only by
navigator ops secrets apply into that deployment's own Secret Manager, so no readable credential enters Git. Second,
one interface, your choice of source — the Secret Manager CSI driver projects each deployment's Secret into the pod
(neon-law-stg is live on it). See docs/deployment-secrets.md. Local KIND uses its
generated .devx/env, and optional sandbox integrations use a gitignored .env. The env-var interface is identical
across them.