## Repo boundary

This repo owns **user-engine** only: user-domain facts, identity-context
mappings, projections, the optional portal, and the adapters that call
neighbors.

It does not own:

- OIDC login, tokens, passwords, MFA — key-cape / Keycloak
- authorization decisions and protected-system registry — flex-auth
- tenant identifier, grouping, and capability-role authority — tenant-engine
- application-owned first-login profiles and action step-up — consuming apps
- runtime secrets — OpenBao / railiance-platform
- platform audit store — audit-core
- transactional mail — email-connect
- State Hub — state-hub
- published policy site — policy-nexus
- SSH certificates — ops-warden