Unified configuration

Keep configuration non-secret and host-neutral. One strict versioned JSON document contains the verified application and bot identities, exact read scope, selected tools, Gateway policy, capability gates, feature-specific scopes, bounded limits, owned local storage roots, runtime settings, and credential-free observability policy. Secret fields contain only external environment or file references; collector headers remain environment references. Never put a bot token, collector header value, Discord name, message data, attachment URL, embed, component, or other Discord content in a configuration document.

Treat a selected configuration as the exclusive policy boundary. Activation must parse and materialize the document directly, resolve only the exact secret references it names, and never mutate process.env. Reject every other populated GUILDCONTROL_* or OTEL_* variable and every undeclared Discord token variable so ambient state cannot silently widen or alter file policy. Tool selection remains a callable-surface restriction, never a substitute for Discord permissions, exact allowlists, planning, approval, confirmation, freshness, operation receipts, or content-free audit gates.

Load standalone configuration only from a bounded canonical regular file owned by the process user or root, with one hard link and no group or world write access. Creation and replacement additionally require a canonical private directory owned by the process user. Publish through private exclusive temporary files, an exclusive lock, file and directory synchronization, and exact readback. Replacement must retain a recoverable hidden backup and refuse to change the pinned Discord identity.

Load a file-backed bot credential only from an absolute reference that resolves to a bounded stable regular target owned by root or the process user, with one hard link and no group or world write access. Permit a projected-secret symlink at the configured path, but open the resolved final target without following another link and verify path and metadata stability around one bounded UTF-8 read. Reject an ambient canonical token alongside a file reference instead of selecting a fallback. Never include bot credential bytes in errors, reports, logs, telemetry, configuration, or connector-managed persistent state.

Managed profiles use the same complete policy contract in a private per-user directory. Unsupported schema versions fail closed and no environment-policy compatibility shape is accepted. Profile removal must require exact confirmation and move a validated profile into private recoverable trash; it must never claim to revoke or modify the external Discord credential. Restore only the newest valid generation and only when no active profile has that name.

Canonical source: SECURITY.md