orchestrate-secrets-and-determinismlisted

# Orchestrate: Secrets and Determinism **Direct evidence**: the official starter repository states these as hard constraints, not suggestions — *"Store secrets in environment variables only; never hardcode keys,"* and *"Be deterministic; seed random sampling."* HackerRank's own advice separately names *"Hardcoded paths/secrets: Eliminate local dependencies and embedded credentials"* as a scored mistake. ## Why these two specific things Both are graded mechanically, not by judgment call — which makes them the cheapest possible points to lose: - **A hardcoded API key or local path breaks the submission the moment it's graded on infrastructure that isn't your laptop.** `code/` gets extracted somewhere else and run fresh; an absolute path like `/Users/yourname/orchestrate/corpus/` or an API key baked into a `.py` file either fails to run or, worse, leaks a credential into a public submission. - **Non-deterministic output makes the golden-dataset comparison unreliable, and looks like it might be gaming the metric.** If two runs on the same input produce different `output.csv` rows, a grader can't trust that what they're scoring is representative — and unseeded randomness in an evaluation-sensitive system reads as an oversight at best. ## The concrete checklist - [ ] Every API key, token, or credential is read via `os.environ` / `process.env` — none appear as string literals anywhere in the code - [ ] A `.env.example` (not `.env` itself) documents which environment variables