Documentation

The boot context assembled once at start-up and handed to each subcommand: the validated configuration, the process logger, and the telemetry handle. withBootEnv builds it, and the ecluse entry point (see Ecluse) dispatches the selected subcommand over it. The heavier serve- and worker-side handles (the HTTP managers, the mirror queue, the metadata cache) are built later, per subcommand (see Ecluse.Proxy).

Apply the *_FILE secret indirection: a recognised secret variable may be supplied as <VAR>_FILE naming a file whose contents (one trailing newline stripped) become the variable's value -- the standard container-secret mount pattern, so a token never has to enter the environment itself. Only the secret-typed keys are eligible; any other *_FILE spelling transliterates to an unknown document key and is rejected by the strict parser as usual. Setting both a base variable and its _FILE form is a fail-loud conflict (never a silent precedence choice), and an unreadable file fails the same way; failures aggregate so one run reports them all. Shared by the boot and check-config.

Locate and read the config document per the ECLUSE_CONFIG semantics: the bytes when a document exists (plus the path consulted), no bytes at an absent default path (env + defaults alone boot a proxy), and a fail-loud message for an explicit ECLUSE_CONFIG that resolves to nothing -- a misconfiguration must never silently boot without the document the operator pointed at. Any other read failure (a permission error, a directory path) is a typed refusal too, naming the path and the error but never the file contents. Shared by the boot (withBootEnv) and check-config (Ecluse.CheckConfig), so the two cannot drift on the override semantics.

Assemble the BootEnv and run action within it: load and validate the configuration (failing fast on any error), apply the runtime posture, build the logger, and bracket the telemetry substrate for the action's lifetime.

Raised to abort start-up after a boot phase has reported its aggregated failure to stderr. A distinct type -- rather than a bare exitFailure -- so the abort is observable in a test without the process actually exiting; uncaught, it propagates to main and the runtime exits non-zero, the operator-facing fail-fast.