runtime config + secretsThe control plane for what must never live in code: provider keys, model choices, runtime config.
Shared platform component. Domain applications are documented separately.
Ranger keeps the things that must not live in a repo or a Dockerfile. Provider credentials (LLM, Stripe, Plaid) and runtime choices (which model, which provider) are stored in Ranger and injected at startup, never baked into an image, never committed. Move a model or rotate a key without a rebuild.
LLM, Stripe, and Plaid credentials live in Ranger’s namespace and are injected at startup, out of code and out of images.
Which model and provider a generative call uses is configuration in Ranger, not a hardcoded constant or an env var.
Swap a key or repoint a model and services pick it up at startup, with no image rebuild and no code redeploy.
A role-gated UI plus server-side enforcement, behind the same Canopy OAuth as the rest of the platform.
Keys in a repo are a breach waiting to happen; model choices in env vars are a redeploy waiting to happen. Ranger holds both. Provider credentials and the generative model/provider selection live in its store and are injected into services at startup, so an image carries no secrets and no model assumptions.
Because configuration is read at runtime, rotating a credential or repointing the platform to a different model is an operational action, not an engineering one. No rebuild, no code change.
Ranger’s control plane is admin-role-gated and authenticates through the same Canopy OAuth as the rest of the platform: one identity model, all the way down.