Seven tools, four flows. Each flow is one row in the table — and one Steps block.The tools page lists what each one does. This page shows how they connect. Read the table first; the Steps below it expand each flow.
The flows at a glance
CI Tier 1 — Doppler distributes via secrets-sync
CI Tier 2 — infra fetches at runtime
The high-sensitivity Doppler config (database passwords, RunsOn license, Qdrant keys) never sits in GitHub Actions secrets. The job fetches at runtime via the read-only service token distributed by Tier 1.OpenTofu — Terrakube → OpenBao
Local AI session — mint on demand, store nothing
See Local AI isolation for the diagram and the full proof. Short version: no GitHub token sits on the workstation. Each request mints a short-lived, scoped token that lives in memory for that operation and is never written to disk.git and gh reach that mint by different routes — git through a credential helper, gh through a shell wrapper, because gh reads a token from the environment and never consults git’s credential helpers. Write access needs an explicit claim on one named repository.
Where each flow is documented
- CI Tier 1: secrets-sync
- CI Tier 2: doppler
- OpenTofu: OpenBao + IaC tooling
- Local AI session: local-ai-isolation + GitHub access
- Encrypted config: sops