Complete runtime resilience and audit controls

tests/runtime-static.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+rg -F 'qualified Env' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
+rg -F 'qualified Text.URI' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
+rg -F 'newtype Secret value = Secret value' \
+  "$ROOT/src/Nuthatch/Config.hs" >/dev/null
+if rg -n 'lookupEnv|parseURI|splitOn.*://' \
+    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
+  printf 'configuration bypasses maintained parsers\n' >&2
+  exit 1
+fi
+if rg -n 'Secret.*deriving.*Show|data Config.*deriving.*Show' \
+    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
+  printf 'secret-bearing configuration has a revealing Show instance\n' >&2
+  exit 1
+fi
+for secret_type in \
+    SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
+  if sed -n \
+      "/^\\(newtype\\|data\\) $secret_type /,/^$/p" \
+      "$ROOT/src/Nuthatch/Types.hs" "$ROOT/src/Nuthatch/Oidc.hs" |
+      rg 'deriving stock .*Show' >/dev/null; then
+    printf 'secret-bearing application value has a Show instance\n' >&2
+    exit 1
+  fi
+done
+printf 'Runtime configuration structure passed\n'