knobspec

One file declares every setting and secret. Everything else comes from it.

One payment of $99, plus sales tax where it applies, and every future update. Delivered as a private GitHub repository you're invited to.

See it work

knobspec 1.0.2real run

$ knobspec preflight --spec knobspec/examples/app.json
MISSING required secret: DATABASE_URL
MISSING required secret: SESSION_SECRET
missing recommended secret: SMTP_PASSWORD
preflight FAILED

$ LOG_LEVEL=debug knobspec shadows --spec knobspec/examples/app.json --store knobspec/examples/saved.json
These settings are currently set by environment variables, so editing them in the settings screen will NOT take effect. LOG_LEVEL -> the environment.
  LOG_LEVEL: 'How much the app logs' = debug (a saved value is being ignored)

Real output of knobspec 1.0.2, run on 2026-10-05 on the shipped example spec and saved settings on our test machine; the environment variable is set for one command only.

What it does

Declare each secret and setting once. Get a presence-only status, a generated .env.example, a missing-secret preflight for CI and deploys, and a warning when an environment variable silently overrides a saved setting.

Presence-only status: Shows whether each secret is set and how long it is, never the value. Can merge in what a second process holds.
Missing-secret preflight: knobspec preflight exits 1 when a required secret is missing. It can read a .env file without exporting it, and --strict also fails on overrides.
Generated .env.example: Annotated with purpose, where to get it and where to set it. example --check fails CI when the file is stale.
Override warning: Names each setting an environment variable is deciding and flags a saved value that is being ignored. Also flags variables that are set but unusable, such as text where a number belongs.
Typed settings: Environment variable, then saved value, then default. Int clamping, bool parsing, enum, URL and email checks, and an atomic JSON store with backups.
Unread-name finder: Lists declared secrets and settings that no file mentions, so the status page stops asking for dead keys.

What you get

knobspec 1.0.2: the Python package and the knobspec command, a worked example spec with saved settings, and the full test suite, with 186 automated tests.

A commercial license. Use it and change it in your own projects and your clients' projects. Don't share or resell the source. Read the license.

Every update. New versions land in the same repository; git pull to get them.

Requirements

Python 3.10 or newer. Python 3.10 or newer, no runtime dependencies. TOML specs need Python 3.11 or the toml extra.

How buying works

Enter your GitHub username. You'll see the account before you pay, so you can check it's yours.
Pay $99, plus any sales tax shown at checkout, on Stripe's checkout page.
Accept the invitation GitHub emails you. Signed in as that account, you'll also find it at github.com/dominares-tools/knobspec/invitations. Invitations expire after 7 days; you can get a new one any time.
Clone and install:
```
git clone https://github.com/dominares-tools/knobspec.git
```
Private repo: sign in to GitHub on this computer first. Run gh auth login and choose HTTPS, or give git a personal access token when it asks for a password. To use an SSH key instead, clone git@github.com:dominares-tools/knobspec.git.
```
python3 -m venv .venv && . .venv/bin/activate
pip install ./knobspec
```

Questions

Do I need GitHub?

Yes. Access is a read-only invitation to a private repository, sent to the GitHub account you choose.

Can I get a refund?

Yes, within 14 days, no questions asked. Access ends when the refund goes through. Refund policy.

Who takes the payment?

Payments are handled by Stripe, which works out sales tax. Your receipt and card statement show Link (LINK.COM*), Stripe's checkout service.

Something wrong?

Email support@dominares.org. Every buyer of a tool shares its repository, so support happens by email rather than in GitHub issues.