Every access value your app needs at runtime and every value your deployment needs to reach its own infrastructure get sorted into two clean files instead of scattered across several partly-tracked ones. A committed, scrubbed copy of each lets a reviewer confirm nothing sensitive leaked.
What ports as-is
- The runtime-versus-deployment split and its no-duplication rule
- A flat prefixed key shape a config service could serve unchanged
- An automated mirror-verification script
- A fixed order: inventory, classify, transcribe, shape, mirror, re-point, verify
What we build for you
- Which config files the repo actually has and which are tracked
- The variable names its existing deploy tooling already reads
- Which values are sensitive under that team's own threat model
