user-engine/.claude/rules/repo-boundary.md

## Repo boundary

This repo owns **user-engine** only: user-domain facts, identity-context
mappings, projections, the optional portal, and the adapters that call
neighbors.

It does not own:

- OIDC login, tokens, passwords, MFA — key-cape / Keycloak
- authorization decisions and protected-system registry — flex-auth
- tenant identifier, grouping, and capability-role authority — tenant-engine
- application-owned first-login profiles and action step-up — consuming apps
- runtime secrets — OpenBao / railiance-platform
- platform audit store — audit-core
- transactional mail — email-connect
- State Hub — state-hub
- published policy site — policy-nexus
- SSH certificates — ops-warden
Normalize agent instructions and workplan frontmatter (STATE-WP-0067) - Align agent files with on-disk workplan prefixes (infer from workplan ids) - Set workplan domain to registered domain_slug; add topic_slug where applicable - Repair frontmatter delimiter formatting; migrate legacy task status literals - Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates 2026-06-22 23:16:28 +02:00			`## Repo boundary`

Update SCOPE to the finished USER-WP-0001–0023 surface Replace the WP-0015 planning note with the shipped in/out boundary, published NetKingdom contracts, operator residuals, and an INTENT assessment. Fill the repo-boundary neighbor list to match. 2026-08-19 14:42:28 +02:00			`This repo owns user-engine only: user-domain facts, identity-context`
			`mappings, projections, the optional portal, and the adapters that call`
			`neighbors.`
Normalize agent instructions and workplan frontmatter (STATE-WP-0067) - Align agent files with on-disk workplan prefixes (infer from workplan ids) - Set workplan domain to registered domain_slug; add topic_slug where applicable - Repair frontmatter delimiter formatting; migrate legacy task status literals - Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates 2026-06-22 23:16:28 +02:00
Update SCOPE to the finished USER-WP-0001–0023 surface Replace the WP-0015 planning note with the shipped in/out boundary, published NetKingdom contracts, operator residuals, and an INTENT assessment. Fill the repo-boundary neighbor list to match. 2026-08-19 14:42:28 +02:00			`It does not own:`

			`- OIDC login, tokens, passwords, MFA — key-cape / Keycloak`
			`- authorization decisions and protected-system registry — flex-auth`
			`- tenant identifier, grouping, and capability-role authority — tenant-engine`
			`- application-owned first-login profiles and action step-up — consuming apps`
			`- runtime secrets — OpenBao / railiance-platform`
			`- platform audit store — audit-core`
			`- transactional mail — email-connect`
			`- State Hub — state-hub`
			`- published policy site — policy-nexus`
			`- SSH certificates — ops-warden`