One config file that can’t be broken by a typo.

Per-key validation, not all-or-nothing

A bad value degrades exactly one key back to its default — the rest of the file loads normally, and the log names the offending key and every unknown one. A config mistake is an annoyance you can read, never a blank app.

A reference you can search, in the app

Settings embeds a searchable config reference, so the answer to “what was that key called” is in the same window as the file it edits. `muster reload-config` applies the live-safe keys — post-create hooks, the default shell, the automations switch — without a restart.

The honest boundary: secret backend, daemon, terminal and notification settings are restart-only, and the reload reply says exactly which keys those are.

Take the setup with you

Config-bundle export packs the setup — identities included — into a portable bundle that imports idempotently on another machine. Re-running an import doesn’t duplicate what’s already there.

Onboarding and logs, briefly

A five-step, skippable onboarding gets the first project running, including the choice of secret backend — applied live, no restart.

Every log line, the daemon’s included, passes through a redaction pipeline before it hits disk. When you paste a log into an issue, the tokens aren’t in it.