fix(build): rename duplicate bench_mod in build.zig; wire SOPS at-rest

- Rename `bench_mod` → `mcp_bench_mod` for the protocol-tests bench
  module (line 350) — shadowed the top-level benchmark binary name,
  causing `zig build` to fail in test-smoke path.
- Add `.sops.yaml` with age creation rules matching estate standard
  (same public key as lcb-website).
- Add `.env.example` documenting all env vars consumed by the bridge
  and cartridges (BOJ_URL, COORD_BACKEND_URL, all third-party keys).
- Add `!.env.example` negation to .gitignore so the template is tracked
  despite the `.env.*` glob.
- Update Trustfile.a2ml SECRETS_HYGIENE to record boj-server SOPS as
  DEPLOYED.
- Minor .envrc / .gitignore housekeeping (quiet-mode flags, flake.lock).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.env.example

@@ -0,0 +1,60 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Copy this file to .env and fill in real values.
+# .env is gitignored; this template is intentionally committed.
+# For at-rest encryption of real secret files use SOPS (see .sops.yaml).
+
+# ── Core server endpoints ─────────────────────────────────────────────────────
+# REST API backend the MCP bridge forwards to (default: http://localhost:7700)
+BOJ_URL=http://localhost:7700
+
+# Local coordinator backend URL (default: http://127.0.0.1:7745)
+COORD_BACKEND_URL=http://127.0.0.1:7745
+
+# ── MCP bridge tunables ───────────────────────────────────────────────────────
+# Log level: trace | debug | info | warn | error (default: info)
+BOJ_LOG_LEVEL=info
+
+# Max requests per minute per client (default: 60)
+BOJ_RATE_LIMIT=60
+
+# Require Nickel schema validation for coordinator payloads: 0 | 1 (default: 0)
+COORD_REQUIRE_NICKEL=0
+
+# ── Forge tokens (bridge + cartridges) ───────────────────────────────────────
+GITHUB_TOKEN=
+GITLAB_TOKEN=
+GITLAB_URL=https://gitlab.com
+
+# ── Third-party API keys (cartridges) ────────────────────────────────────────
+AIRTABLE_API_KEY=
+ANTHROPIC_API_KEY=
+BUILDKITE_API_TOKEN=
+CF_API_TOKEN=
+CIRCLECI_TOKEN=
+CRATES_IO_TOKEN=
+DIGITALOCEAN_TOKEN=
+DOCKER_HUB_USERNAME=
+DOCKER_HUB_PASSWORD=
+DOCKER_HUB_TOKEN=
+FLY_API_TOKEN=
+GOOGLE_DOCS_ACCESS_TOKEN=
+GOOGLE_SHEETS_ACCESS_TOKEN=
+GRAFANA_API_TOKEN=
+GRAFANA_BASE_URL=
+HACKAGE_CREDENTIALS=
+HETZNER_API_TOKEN=
+HEX_API_KEY=
+LINODE_TOKEN=
+NPM_TOKEN=
+OBSIDIAN_REST_API_KEY=
+PROMETHEUS_BASE_URL=
+PROMETHEUS_TOKEN=
+PYPI_TOKEN=
+RAILWAY_TOKEN=
+RENDER_API_KEY=
+SENTRY_AUTH_TOKEN=
+SENTRY_BASE_URL=
+TODOIST_API_TOKEN=
+ZOTERO_API_KEY=

.envrc

@@ -1,27 +1,31 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Activate development environment
+# Activate development environment - QUIET MODE
 # Install direnv: https://direnv.net/
 
+# Suppress direnv output
+export DIRENV_LOG_FORMAT=
+
 # Load .tool-versions if asdf is available
 if has asdf; then
   use asdf
 fi
 
-# Load Guix shell if guix.scm exists
+# Load Guix shell if guix.scm exists (quiet mode)
 if has guix && [ -f guix.scm ]; then
-  use guix
+  use guix --quiet
 fi
 
-# Load Nix flake if flake.nix exists
+# Load Nix flake if flake.nix exists (quiet mode)
 if has nix && [ -f flake.nix ]; then
-  use flake
+  use flake --quiet
 fi
 
 # Project environment variables
 export PROJECT_NAME="Bundle of Joy Server"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists
+
+# Suppress guix locale warnings
+export GUIX_LOCPATH="${GUIX_LOCPATH:-$HOME/.guix-profile/lib/locale}"

.gitignore

@@ -53,10 +53,8 @@ __pycache__/
 /bin/
 
 # Nix
-# flake.lock is ignored in the template repo because each project should
-# generate its own lock file on first use. In derived projects, REMOVE this
-# line and track flake.lock for reproducible builds.
-flake.lock
+# flake.lock is tracked in derived projects for reproducible builds.
+# flake.lock
 
 # Haskell
 /.stack-work/
@@ -68,6 +66,7 @@ flake.lock
 # Secrets
 .env
 .env.*
+!.env.example
 *.pem
 *.key
 secrets/

.machine_readable/contractiles/trust/Trustfile.a2ml

@@ -470,7 +470,7 @@ at_rest:
     - repo: "lcb-website"
       status: "DEPLOYED"
     - repo: "boj-server"
-      status: "PENDING / runtime-only via Rokur"
+      status: "DEPLOYED — .sops.yaml + .env.example wired 2026-04-25"
   pre_commit_hooks:
     - "gitleaks"
     - "plaintext detector"

.sops.yaml

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# SOPS creation rules for boj-server.
+# Public age recipient below is safe to commit; only the matching secret key
+# (kept at ~/.config/sops/age/keys.txt, NEVER in this repo) can decrypt.
+#
+# Any file path matched by a rule below is auto-encrypted on `sops -e -i FILE`
+# and auto-decrypted on `sops -d FILE`.
+
+creation_rules:
+  # Convention: anything ending `.enc.yaml` / `.enc.json` / `.enc.env` is ciphertext.
+  - path_regex: \.enc\.(ya?ml|json|toml|env)$
+    age: age1jsaw33jj6gv75csgt0a0lyh8zufzyhzewv5308yccjenn8k34cgq4273pe
+  # Convention: anything inside `secrets/` is ciphertext (belt + braces).
+  - path_regex: secrets/.*\.(ya?ml|json|toml|env)$
+    age: age1jsaw33jj6gv75csgt0a0lyh8zufzyhzewv5308yccjenn8k34cgq4273pe

ffi/zig/build.zig

@@ -347,12 +347,12 @@ pub fn build(b: *std.Build) void {
     const p2p_tests = b.addTest(.{ .root_module = p2p_mod });
     const run_p2p = b.addRunArtifact(p2p_tests);
 
-    const bench_mod = b.createModule(.{
+    const mcp_bench_mod = b.createModule(.{
         .root_source_file = b.path("../../tests/mcp_bench.zig"),
         .target = target,
         .optimize = optimize,
     });
-    const bench_tests = b.addTest(.{ .root_module = bench_mod });
+    const bench_tests = b.addTest(.{ .root_module = mcp_bench_mod });
     const run_bench = b.addRunArtifact(bench_tests);
 
     const protocol_step = b.step("protocol-tests", "Run protocol-layer Zig tests");