Blueprint: env groups for secrets, unpin the workflow repo

AGENTS.md

@@ -40,8 +40,9 @@ Environment gotchas:
   host also loads `.env` and must use the real Render API.
 - Keep network isolation off in the factory's environment. An isolated
   workflow cannot reach the database on the private network.
-- The workflow service in `render.yaml` sets `repo:` to the upstream
-  repository. A fork must change it.
+- Secrets in `render.yaml` live in two environment groups. Attach
+  `vibe-factory-workflow-secrets` only to the workflow service: it holds the
+  model key and the GitHub credential.
 
 ## Module map
 

README.md

@@ -110,9 +110,8 @@ paid plans and bill until you delete the app.
 
 Click **Deploy to Render** above, or create a Blueprint from this repository's
 `render.yaml`. It creates the gateway, the workflow service, and their database
-in a `vibe-factory` project, and prompts you for the secrets. If you deploy
-from a fork, first change the `repo:` field of the workflow service in
-`render.yaml` to your fork's URL. [docs/0_QUICKSTART.md](docs/0_QUICKSTART.md#deploy-the-factory-to-render)
+in a `vibe-factory` project, and prompts you once for each secret.
+[docs/0_QUICKSTART.md](docs/0_QUICKSTART.md#deploy-the-factory-to-render)
 has the full steps.
 
 ## Documentation

docs/0_QUICKSTART.md

@@ -172,9 +172,16 @@ the [README](../README.md). Fill in the prompted values listed under
 [Prerequisites](#prerequisites). `UI_PASSWORD` must contain at least 16
 characters or the gateway will refuse to start.
 
-If you deploy a fork, first change the workflow service's `repo:` field in
-`render.yaml` to the fork URL. Otherwise Render builds the upstream workflow
-code even though the Blueprint came from your fork.
+The secrets live in two environment groups, so you enter each one once:
+
+- `vibe-factory-shared` holds `RENDER_API_KEY` and is attached to both
+  services.
+- `vibe-factory-workflow-secrets` holds `APPS_REPO`, `RENDER_WORKSPACE_ID`,
+  `ANTHROPIC_API_KEY`, and the GitHub credential, and is attached only to the
+  workflow service.
+
+To rotate a key, change it in its group. Both services build from the
+repository that holds the Blueprint, so a fork runs its own code.
 
 Keep these deployment constraints:
 
@@ -210,7 +217,8 @@ create a local `.env` from the deployed resources:
 1. Copy `.env.example` to `.env`.
 2. From `vibe-factory-gateway`, copy `FACTORY_API_KEY`, `UI_USERNAME`,
    `UI_PASSWORD`, and `RENDER_WORKFLOW_SLUG`.
-3. From `vibe-factory-workflows`, copy `APPS_REPO`, `RENDER_API_KEY`,
+3. From the `vibe-factory-shared` environment group, copy `RENDER_API_KEY`.
+   From `vibe-factory-workflow-secrets`, copy `APPS_REPO`,
    `RENDER_WORKSPACE_ID`, `ANTHROPIC_API_KEY`, and either `GITHUB_TOKEN` or
    the three `GITHUB_APP_*` values.
 4. Open `vibe-factory-db` in the Dashboard and copy its **external**

docs/1_EXTENSION.md

@@ -272,7 +272,10 @@ The demo script reads `FACTORY_GATEWAY_URL` and `FACTORY_USER`.
 `PORT` configures the gateway and defaults to `3000`.
 
 Keep model and GitHub credentials off the gateway. Keep the GitHub credential
-out of every task input and every Sandbox an agent can use.
+out of every task input and every Sandbox an agent can use. In
+[`render.yaml`](../render.yaml), a new secret for both services goes in the
+`vibe-factory-shared` environment group, and a workflow-only secret goes in
+`vibe-factory-workflow-secrets`.
 
 ## Change checklist
 

render.yaml

@@ -13,6 +13,36 @@ projects:
         networking:
           isolation: disabled
 
+        # Secrets you enter once when the Blueprint is created, and rotate in
+        # one place. The gateway gets only vibe-factory-shared: the model key
+        # and the GitHub credential must never reach it.
+        envVarGroups:
+          - name: vibe-factory-shared
+            envVars:
+              # The gateway starts workflow tasks with it. The workflows host
+              # uses it for Sandboxes, the Render MCP server, Blueprint reads,
+              # and the deletes of a deleted app's resources.
+              - key: RENDER_API_KEY
+                sync: false
+          - name: vibe-factory-workflow-secrets
+            envVars:
+              - key: APPS_REPO
+                sync: false
+              - key: RENDER_WORKSPACE_ID
+                sync: false
+              - key: ANTHROPIC_API_KEY
+                sync: false
+              # Set the three GitHub App variables or GITHUB_TOKEN. Each option
+              # needs Contents: write on APPS_REPO.
+              - key: GITHUB_APP_ID
+                sync: false
+              - key: GITHUB_APP_PRIVATE_KEY
+                sync: false
+              - key: GITHUB_APP_INSTALLATION_ID
+                sync: false
+              - key: GITHUB_TOKEN
+                sync: false
+
         databases:
           - name: vibe-factory-db
             plan: 0.1c-256mb
@@ -43,16 +73,15 @@ projects:
                   type: workflow
                   name: vibe-factory-workflows
                   property: slug
-              # Used by the Render SDK to start the workflow task.
-              - key: RENDER_API_KEY
-                sync: false
+              - fromGroup: vibe-factory-shared
 
           # Runs every task that app/host.ts registers. The model key and the
-          # GitHub credential are set only here, never on the gateway.
+          # GitHub credential are set only here, never on the gateway. With no
+          # repo field, it builds the repository that holds this Blueprint, so
+          # a fork's workflow runs the fork's code.
           - type: workflow
             name: vibe-factory-workflows
             runtime: node
-            repo: https://github.com/render-examples/vibe-coding-app
             # A workflow must set its region. Task runs connect to the database
             # on the private network, and that network does not cross regions.
             # Use the same region as the database, which is oregon by default.
@@ -64,23 +93,5 @@ projects:
                 fromDatabase:
                   name: vibe-factory-db
                   property: connectionString
-              - key: APPS_REPO
-                sync: false
-              # Sandboxes, the Render MCP server, Blueprint reads, and the
-              # deletes of a deleted app's resources.
-              - key: RENDER_API_KEY
-                sync: false
-              - key: RENDER_WORKSPACE_ID
-                sync: false
-              - key: ANTHROPIC_API_KEY
-                sync: false
-              # Set the three GitHub App variables or GITHUB_TOKEN. Each option
-              # needs Contents: write on APPS_REPO.
-              - key: GITHUB_APP_ID
-                sync: false
-              - key: GITHUB_APP_PRIVATE_KEY
-                sync: false
-              - key: GITHUB_APP_INSTALLATION_ID
-                sync: false
-              - key: GITHUB_TOKEN
-                sync: false
+              - fromGroup: vibe-factory-shared
+              - fromGroup: vibe-factory-workflow-secrets