# Railiance ArgoCD Tenant Applications

This directory is synced by the `railiance-apps-root` ArgoCD Application.

Tenant teams author a thin ArgoCD `Application` manifest against the contract
in `docs/argocd-gitops.md`. Platform review merges that manifest here after
checking namespace, repository, sync policy, and secret-delivery shape.

Workload manifests stay in the owning tenant repo. The default source path for
tenant workloads is:

```text
k8s/railiance/
```

Since the founder's decision of 2026-09-21, this directory is the change path
for `production-approved` workloads (see `docs/argocd-gitops.md` § Production
Change Path). A merge here is a live production change. Adopting a workload
that is already running (for example `rapp-policy-nexus`, RPF-WP-0043) needs the
founder's go-ahead and a diff first. Do not add an Application for a
running workload directly.

Do not commit Kubernetes Secret values, ArgoCD repository credentials, OpenBao
tokens, deploy keys, or API keys here.