Add a validated application setting

Steps

• Add a non-secret default in config/app.php.
• Add a type and bound in config/schema.php.
• Add an explicit environment binding in config/load.php.
• Pass the setting through composition into the service that owns it.

// Schema member: validate the value before composing infrastructure.
new ConfigDefinition('knowledge_base.secure_cookie', type: 'bool', required: true);

// Loader binding: values come from the selected environment namespace.
'knowledge_base.secure_cookie' => ['KB_SECURE_COOKIE', 'bool'];

These are fragments, not complete PHP files; import ConfigDefinition and place the binding inside the loader's binding array. Mark credential definitions secret: true and reveal SecretValue only inside a trusted adapter.

Verify

Add a negative test for a malformed value and an independent environment test. Never dump configuration to a browser. See Configuration.

Editorial provenance

Source: resources/guides/add-setting.md. Source SHA-256: 53b3f78b83d53481be85fac5d407d97a0bdf300ac642943a7d9bae724f051cd3.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.