# RPF-WP-0035-T04: preflight signing key is API-only. path "platform/data/workloads/state-hub/repository-rename-preflight" { capabilities = ["deny"] } path "platform/metadata/workloads/state-hub/repository-rename-preflight" { capabilities = ["deny"] }