This seems both underspecified and incorrect. Assuming a single-precision binary IEEE 754 floating-point number, 10.20 is actually 10.19999980926513671875. With double precision, it would be 10.199999999999999289457264239899814128875732421875. So what you see is not what you get, and it’s also unclear what exactly you’ll get.
> A value's type comes from its syntax, never from its content […] allowed-origins: [ 'https://example.com' 'https://example.org' ]
This looks like URLs, but are strings. What if you had:
> allowed-origins: [ 'httpș://example.com' 'ħttps://example.org' ]
Still strings and therefore fine for the SOML parser, but probably not a valid configuration in terms of the application-level types of the values. The syntax telling you the types is of limited utility as soon as the application schema has more specific ideas about the types than the configuration language.