## Repo boundary

This repo owns the **secrets-engine** workflow/interaction layer only. It does
not own:

- Secret custody, policy, lease, and audit backend → OpenBao / railiance-platform
- SSH certificate issuance → ops-warden (`warden sign`)
- Tunnels and remote transport → ops-bridge
- Authorization decisions → flex-auth
- Identity and claim lifecycle → user-engine / key-cape
- Cross-system security boundary doc → net-kingdom/docs/
- Request history and progress index → State Hub (read model)