The bot's secrets live in Gitea: signed settings travel with the release bundle

POST /deploy-bot may now carry X-Vanguard-Env, base64 JSON of the bot's own settings, and the HMAC covers
that header together with the body so the pair cannot be separated or swapped. dumpd merges only the keys
BOT_ENV_KEYS allows (DISCORD_BOT_TOKEN, DISCORD_GUILD_ID by default) into the stack .env, atomically and
preserving mode and owner, and reports the rest to the CI job as settings_refused. The server keeps what it
generates: a CI job cannot touch the database password or the Authentik keys.

Verified: allowed keys applied, server-owned keys refused while the rest still applied, a settings swap
after signing rejected with 401, and an empty settings header leaving .env untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bot/AGENT.md

@@ -50,6 +50,12 @@ signed with the repository secret `BOT_DEPLOY_SECRET`; the server verifies the s
 keeps the previous release for rollback, and restarts the container. The install log comes back in your CI
 job, so a failed deploy fails the run. Branches and pull requests test and build, and deploy nothing.
 
+**Your settings travel with it.** `DISCORD_BOT_TOKEN` (an Actions secret) and `DISCORD_GUILD_ID` (an Actions
+variable) are signed together with the bundle and written into the container's environment by the server, so
+this repo is where they are managed and rotated. The server accepts only the names its `BOT_ENV_KEYS` allows
+and reports the rest as `settings_refused`; it keeps ownership of what it generates, such as `DB_PASSWORD`.
+A new setting means asking the admin to add its name to that list (§6).
+
 Rules that follow from this:
 
 - Keep `requirements.txt` resolvable with **prebuilt wheels only**; a dependency that must compile will fail