## Repo boundary

This repo owns **activity-core** only: when / what / where — schedules,
ActivityDefinitions, rule/instruction evaluation, ops_run claim queue, and
bounded declared side-effects.

It does not own:

- Task / work-item vocabulary → `info-tech-canon` (Task Model)
- Responsibility / accountability / org roles → `info-tech-canon` (Organization Model)
- Policy *content* (canon, ADRs) → owning repo files
- Policy *publication* → `policy-nexus` (`policy.coulomb.social`)
- Regulatory intake / interpretation → `risk-nexus`
- Repo registry, C-rule consistency, work-record index → `repo-manager`
- Messages, progress projections, hub ports → `hub-core`
- Temporary compatibility routes → `state-hub` until STATE-WP-0079 retirement
- Issue lifecycle / external tracker mapping → `issue-core`
- AuthN / directory → `key-cape` / identity
- AuthZ decisions → `flex-auth`
- SSH certificates → `ops-warden` (`warden sign` only)
- Secrets / API keys → OpenBao (`railiance-platform`); route via `warden route`
- Tunnels → `ops-bridge`
- Domain work execution → per-repo workers / `rein-aharness` claiming ops_runs