SPARC v1.13.1

SPARC v1.13.1

A configuration-simplification and documentation release. The headline theme is reducing what operators must set — inferring and deriving configuration instead of requiring it — hardening data-in-transit and storage posture, making PIV/CAC identity mapping configurable, and shipping the User Guides both as wiki screenshots and as an in-app Help Center.

"Not required" ≠ "deleted." Nothing that worked before stops working. These changes reduce what you must set; legacy variables remain honored as fallbacks unless explicitly called out as breaking below.

⚠️ Behavior changes to review before upgrading

• Database TLS floor (#789). In production, sslmode is now floored at require — SPARC refuses an unencrypted database connection. A boot posture check reports the measured TLS state per connection (primary + cache/queue/cable). Give SPARC a TLS-capable database, or set SPARC_DB_SSLMODE deliberately. See docs/DATABASE_TLS.md. (NIST SC-8.)
• Object storage defaults to local, and production hard-fails on it (#793). With nothing set, storage resolves to local disk (previously :amazon), and production refuses to boot on local disk — because on ECS/EKS the container filesystem is ephemeral and uploads are silently lost on redeploy. Set SPARC_STORAGE_URL=s3://your-bucket (region from AWS_REGION), or acknowledge durable local disk with SPARC_ALLOW_LOCAL_STORAGE=true. See docs/OBJECT_STORAGE.md. (CP-9, SI-12.)
• Rate limiting is always on (#793). The SPARC_RATE_LIMITING_ENABLED kill switch was removed — throttling now runs unconditionally outside test. To exempt trusted sources (NLB, health checks, monitoring), safelist them with SPARC_RATE_LIMIT_SAFELIST_CIDRS instead of disabling.
• Document-approval gate defaults on (#789). SPARC_REQUIRE_DOCUMENT_APPROVAL now defaults to true.
• Service-account inactivity window 90 → 30 days (#793). SPARC_SA_INACTIVITY_DAYS is unified into SPARC_INACTIVITY_DAYS (default 30); the old variable is a deprecated alias.
• SPARC_AWS_REGION deprecated (#791). Use the SDK-standard AWS_REGION; the old name still works as an alias.

Configuration simplification (#785)

Driven by the observation that a real deployment was setting ~97 env + 10 secrets, roughly half of them redundant. Three passes:

• Pass 1 (#789). Eliminate redundant/default-matching variables; infer enable-flags from credential presence (e.g. setting OIDC credentials enables OIDC — no separate toggle); derive OIDC redirect and API audience; collapse to two operator emails (admin + support). Adds structured JSON logging + log-to-stdout (default in production) for containerized log capture.
• Pass 2 (#791). DATABASE_URL becomes the single, preferred database source (all four databases derived from it, with SPARC_DB_* as fallback). FIDO2 relying-party ID derived from the app URL. SPARC_AWS_REGION → AWS_REGION.
• Pass 2.1 (#793). Rate-limiting always-on (see above), unified inactivity window, and SPARC_STORAGE_URL as the single object-storage variable (scheme picks the provider, the same way DATABASE_URL drives the database).

New/updated operator docs: docs/DATABASE_TLS.md, docs/OBJECT_STORAGE.md, docs/PIV_IDENTITY_MAPPING.md, and docs/ENVIRONMENT_VARIABLES.md.

Phishing-resistant auth — PIV/CAC identity mapping (#790)

• The PIV/CAC identity parser is now configurable rather than assuming a single DoD certificate shape. SPARC_PIV_IDENTITY_SOURCE selects how the user identity is extracted (edipi_cn, upn, email, or subject_cn with SPARC_PIV_UID_PATTERN), with an email-match opt-out. UPN is now parsed from the SAN otherName OID 1.3.6.1.4.1.311.20.2.3.
• Proven end-to-end locally with a software-PIV + nginx mTLS proxy, exercising both the DoD and non-DoD identity shapes.

Documentation

• Per-screen screenshots in the User Guides (#781). Every User Guide now embeds a representative screenshot, captured repeatably against the prod image with real Chrome over seeded demo data (no real identifiers). PUSH_TO_WIKI.sh now publishes image assets.
• In-app Help Center (#784). Every deployment now bundles the User Guides as an in-app, offline, searchable Help Center — reachable from the sidebar, a contextual ? button that deep-links to the guide for the current screen, and the Resources page. Guides render from the same bundled Markdown, so the in-app docs and the wiki never drift.

Fixes

• docker compose up --build (the standard dev command) is fixed — the storage/DB-TLS posture checks no longer fire during assets:precompile (a build step), which had been aborting the image build.

---

Full config disposition and rationale: docs/dev/785_config_reduction_plan.md.