The boot-invariant set includes NAVIGATOR_SURREAL_ENDPOINT, RESTATE_BROKER_URL, storage configuration,
SESSION_SECRET, the SENDGRID_* keys, and DOCUSIGN_HMAC_KEY. The Environment Matrix above lists every startup key
by owning process and lifecycle; .env.example remains the per-variable contract with defaults, secret classification,
and provider-specific notes. See docs/oss-install.md §4 and .env.example.
Two rules keep client data safe, and the deploy will not let you skip them. First, plaintext secrets never live in the
manifest tree — key material is SOPS-encrypted per value in the private row's secrets.enc.yaml, decrypted only by
navigator ops secrets apply into that deployment's own Secret Manager, so no readable credential enters Git. Second,
one interface, your choice of source — the Secret Manager CSI driver projects each deployment's Secret into the pod.
See docs/deployment-secrets.md. Local KIND uses its generated .devx/env, and optional
sandbox integrations use a gitignored .env. The env-var interface is identical across them.