feat(config): add Validate() method for startup validation

ARCHITECTURE.md

@@ -1794,6 +1794,18 @@ Configuration priority (highest to lowest):
 3. YAML config file (`dingo.yaml`)
 4. Hardcoded defaults
 
+After all sources are merged (including CLI flags), `Config.Validate()`
+(`internal/config`) checks the resulting configuration before any services
+start: mode enums, port ranges (privileged/out-of-range/duplicate), load-mode
+`immutableDbPath` requirement, path-traversal guards, TLS cert/key pairing,
+mempool watermarks, block-producer credential paths, and duration/strategy
+strings that are otherwise only parsed at their point of use. The relay,
+private, and metrics listener ports are required for the serving modes but not
+for `load`, which starts none of them. All violations are reported together in
+a single startup error. Validation runs for every service-starting command;
+the informational `version` and `list` subcommands are exempt so they still
+run against an otherwise-invalid config.
+
 Key configuration areas:
 - Network selection (preview, preprod, mainnet)
 - Storage mode (`core` or `api`)

cmd/dingo/config_parity_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 Blink Labs Software
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"testing"
+
+	"github.com/blinklabs-io/dingo/chainsync"
+	"github.com/blinklabs-io/dingo/internal/config"
+)
+
+// TestChainsyncStrategyWhitelistParity guards against drift between the
+// chainsync.strategy values internal/config.Validate accepts and those
+// chainsync.ParseHeaderSyncStrategy actually accepts. internal/config
+// cannot import chainsync without pulling node subsystems into the
+// config package, so this parity check lives in cmd/dingo, which can
+// import both.
+func TestChainsyncStrategyWhitelistParity(t *testing.T) {
+	for _, strategy := range config.AcceptedChainsyncStrategies {
+		if _, err := chainsync.ParseHeaderSyncStrategy(strategy); err != nil {
+			t.Errorf(
+				"config accepts chainsync.strategy %q but "+
+					"ParseHeaderSyncStrategy rejects it: %v",
+				strategy, err,
+			)
+		}
+	}
+}
+
+// TestMithrilBackendWhitelistParity guards against drift between the
+// mithril.backend values internal/config.Validate accepts and those
+// resolveMithrilBackend actually accepts.
+func TestMithrilBackendWhitelistParity(t *testing.T) {
+	for _, backend := range config.AcceptedMithrilBackends {
+		if _, err := resolveMithrilBackend(backend); err != nil {
+			t.Errorf(
+				"config accepts mithril.backend %q but "+
+					"resolveMithrilBackend rejects it: %v",
+				backend, err,
+			)
+		}
+	}
+}

cmd/dingo/main.go

@@ -307,12 +307,8 @@ DSN Override:
 			// When no subcommand given, check RunMode from config
 			switch cfg.RunMode {
 			case config.RunModeLoad:
-				if cfg.ImmutableDbPath == "" {
-					slog.Error(
-						"immutableDbPath must be set when runMode is 'load'",
-					)
-					os.Exit(1)
-				}
+				// Validate() has already enforced that ImmutableDbPath
+				// is set for load mode
 				loadRun(cmd.Context(), []string{cfg.ImmutableDbPath}, cfg)
 			case config.RunModeServe, config.RunModeDev, config.RunModeLeios:
 				// serve, dev, and leios modes all run the server
@@ -357,6 +353,24 @@ DSN Override:
 			return fmt.Errorf("applying CLI flags: %w", err)
 		}
 
+		// `dingo load <path>`: the positional argument is the
+		// highest-precedence source for ImmutableDbPath; merge it before
+		// validation so a config with runMode "load" and no
+		// immutableDbPath doesn't fail spuriously.
+		if cmd.Name() == "load" && len(args) > 0 {
+			cfg.ImmutableDbPath = args[0]
+		}
+
+		// version and list are informational and start no services, so
+		// they must still run even when the merged config is invalid.
+		switch cmd.Name() {
+		case "version", "list":
+		default:
+			if err := cfg.Validate(); err != nil {
+				return fmt.Errorf("invalid configuration: %w", err)
+			}
+		}
+
 		cmd.SetContext(config.WithContext(cmd.Context(), cfg))
 		return nil
 	}