Skip to main content
Status: target. Written 2026-10-19 from decisions agreed in chat; several accounts and every secret store below do not exist yet. TODO marks an unknown. This page holds names only: no value, no id that works as a credential, no URL with a token. Setting, copying or rotating a value is a human’s job (Secrets, ADR-0009).

​
Accounts

​
Where each secret name lives

A name appears in exactly one store. Application code reads it from the runtime, never from a file. No .env, no repository secret (Secrets).

​
Encore secret() (application secrets, per environment)

Declared as secret("NAME") in the service that uses it; a human sets each value in each environment with encore secret set. A new name must exist in an environment before the deploy that declares it, or provisioning fails. TODO: the authoritative list is whatever git grep 'secret("' finds once a service exists; secrets-doctor will compare it with encore secret list.

​
Infisical

TODO: confirm each /ci name against the workflow that reads it. CI logs in with OIDC, one machine identity per environment.

​
EAS environment variables (mobile)

Apple and Google store credentials live in EAS credentials, not in Infisical.

​
GitHub repository variables (not secrets)

VITE_SENTRY_DSN and other public build-time keys, TODO: names fixed when the console deploy workflow exists. Repository secrets stay empty by rule.

​
Cloudflare Worker bindings

Workers hold their own secrets as bindings (wrangler secret put, human only). TODO: names for the registry Worker (npm.figentra.com) and the R2 cache Worker.

​
Tools

Pinned in mise.toml (ADR-0027): node, pnpm, gitleaks. Run mise install once. Needed on the machine, pinned in mise.toml as each is adopted (TODO: confirm the list): infisical, encore, eas-cli, wrangler, gh, aws. Run mise ls --missing to see what is absent.

​
Ordered setup

1

Toolchain

Install mise, then mise install and pnpm install. Confirm with pnpm verify.
2

GitHub (owner)

Org figentra, repo stackra, branch protection on main, push protection and secret scanning on, squash merge only.
3

Linear

Team STA exists. Create a project per deliverable. Agents label their issues agent.
4

Infisical (owner)

Create the project in the EU region. Add /agents and /ci. Create a read-only machine identity for /agents and one OIDC-trusted identity per CI environment. Run infisical login, then infisical init to write the project id into the tracked .infisical.yaml (no secret in it).
5

Developer tokens (human)

Add the /agents names above in the Infisical UI. tools/scripts/mcp.sh reads them for MCP servers; nobody prints them.
6

AWS and Bedrock (owner)

Choose the AWS account. Create the profile named bedrock, then aws sso login with AWS_PROFILE=bedrock; OpenCode bills Bedrock through it. Create the monthly AWS Budget for Bedrock. The daily agent cap is $150 (Agents).
7

Cloudflare (owner)

Confirm the zone. Deploy the npm.figentra.com registry Worker and the R2 cache Worker. Create scoped API tokens and store them in /ci.
8

Remote cache and registry in CI

Set TURBO_TOKEN and NPM_FIGENTRA_TOKEN in /ci. Map the @stackra scope to the registry.
9

Encore Cloud (owner)

Create the org and app, connect the AWS account, create environments staging and prod (PR previews are automatic). Do this only once the deploy path (DP2) is decided.
10

Application secrets (human)

For each environment, encore secret set every declared name. Verify with encore secret list (names only).
11

Email (owner)

Add the sending domain in Resend. Add the SPF, DKIM and return-path records and a DMARC record in Cloudflare DNS. Create the API key and the webhook.
12

Observability

Sentry org and projects (backend, console, mobile, landing), Better Stack uptime and phone alerts, PostHog project.
13

Mobile (owner)

Apple team access, App Store Connect API key, Google Play Console forms and service account, EAS project and robot token. The first Play upload is by hand (Mobile release).
14

Payments and notifications (owner)

Stripe test keys first, live keys at launch. Slack app install and channels. Authorize connectors as needed.

​
Owner-only steps

These cannot be done by an agent, whatever the brief says:
  • Creating any account, accepting any vendor terms, any payment or billing setting.
  • Setting, rotating or deleting any secret value, in any store.
  • Apple and Google Play console forms, store credentials, the first store upload.
  • DNS and Cloudflare token creation; AWS account, SSO and budget settings.
  • Infisical identities and OIDC trust; Encore Cloud org and AWS linking.
  • Authorizing connectors (Slack) and approving production promotions.

​
Daily sign-in

The first lets mcp.sh fetch developer tokens from /agents. The second gives OpenCode its Bedrock session. TODO: AWS_PROFILE=bedrock moves into mise.toml [env] once agreed; until then set it per shell.

​
Checks

See also Secrets, CI, Deploys and Mobile release.