[jacobprall]

Fixes #48 and #69 together, since both rewrite render.yaml. This is a draft until someone deploys it from a fork (checklist below).

#69 Environment groups

• vibe-factory-shared holds RENDER_API_KEY and is attached to the gateway and the workflow service.
• vibe-factory-workflow-secrets holds APPS_REPO, RENDER_WORKSPACE_ID, ANTHROPIC_API_KEY, and the GitHub credentials, and is attached only to the workflow service. The issue proposed naming it vibe-factory-workflows, but that is already the workflow service's name.
• DATABASE_URL, FACTORY_API_KEY, RENDER_WORKFLOW_SLUG, UI_USERNAME, and UI_PASSWORD stay on their services.
• AGENTS.md invariant 1 still holds: the gateway gets no group that contains the model key or a GitHub credential.
• The issue asked to confirm that workflows support fromGroup. The Blueprint schema allows it, and render blueprints validate accepts this file.
• doctor and .env.example needed no change, because they read the local .env. The Quickstart, README, AGENTS.md, and extension guide are updated.

#48 Workflow repo

• Removes repo: from the workflow service. The schema says an omitted repo means the repository that holds the Blueprint, which is how the gateway already works. fc278a9 added the pin without saying why, so this needs a real deploy to confirm.
• Removes the "a fork must change repo:" instructions from the README, Quickstart, and AGENTS.md.

Before merge, someone must

• Fork the repo, deploy this branch's Blueprint from the fork, and confirm the workflow service shows the fork as its repository and builds it.
• Confirm the Blueprint prompts once for each group secret.
• Run one prompt end to end on that deploy.

Note for factories already deployed

Syncing this Blueprint creates the groups but doesn't remove the existing per-service values. Render gives a service's own value priority over a group value, so delete the old per-service secrets from both services after the sync, or rotating a key in a group won't take effect.

Testing

• render blueprints validate render.yaml is valid and plans to create the 2 env groups.
• check-jsonschema against the published schema passes.
• npm run check passes.

Made with Cursor