The file named by ATRIUM_CONFIG is TOML with one table per module. Unknown keys are refused. A string value may contain ${NAME} references to environment variables; an unset variable is refused. <key>_file reads the value from a file and trims it; secret settings accept only <key>_file. A secret setting’s environment variable also has a _FILE form naming a file whose trimmed contents are the value; setting both forms is refused. Every key set here or through its environment variable is pinned: it shows read-only and cannot be changed with atrium settings. Precedence: environment variable, configuration file, stored value, default.