What the Factory can reach. Each project's own infrastructure — DB, repo, deploy — and which credential slots are wired. The registry stores references, never secrets; the real values live in env (or vault) and resolve only at runtime.
references only · no secret ever sits in this table · the resolver reads env: today, vault: when you scale