# rapp-postgres package boundary

`rapp-postgres` owns the PostgreSQL package manifests, consumer declarations,
role/database provisioning surface, isolation tests, database-specific
operations, and recovery procedure for the shared `platform-pg` service.

`railiance-platform` retains cluster-wide governance: the CNPG operator,
Kubernetes access, storage-class policy, monitoring substrate, approved S3
backup target and its credentials, and the OpenBao credential-broker grant
catalog. It configures the OpenBao database secrets engine from the creation
and revocation statements owned in the rapp-postgres playbook; it does not copy
those procedures into this repo.

The package never commits credentials. A consumer request is declared and
provisioned by rapp-postgres, while the workload receives a short-lived lease
through the platform broker. The upstream backup target and database-engine
bootstrap are governance prerequisites, not package-owned secret material.