## Repo boundary

This repo owns **railiance-cluster** only (OAS S2 — cluster runtime). It does not own:

- OS hardening, SSH, firewall, Terraform/cloud-init provisioning → `railiance-infra` (S1)
- Platform services: PostgreSQL HA, Valkey, OpenBao, object storage → `railiance-platform` (S3)
- CI/CD templates, developer portal, SDKs → `railiance-enablement` (S4)
- Application Helm releases and workload manifests (incl. Gitea values) → `railiance-apps` (S5)
- Forge/registry infrastructure (Gitea/Forgejo operation) → `railiance-forge`
- Ecosystem graph/registry model → `railiance-fabric`
- Identity/SSO/MFA (Keycloak, IAM profiles) → `net-kingdom`
- State Hub code → `state-hub` / `the-custodian`

S2 *does* deploy cluster-scoped operators and addons (cert-manager, cnpg
operator, ArgoCD, nginx ingress) and owns kubeconfig custody, plus
cluster-owned deploy/verify gates for workloads whose repos have no cluster
access (e.g. the activity-core and llm-connect reconcile commands).