## Repo boundary

This repo owns **ops-hub** only. It does not own:

- Generic Inter-Hub framework, API substrate, auth → `inter-hub/`
- State Hub workstream/task/decision implementation → `state-hub/`
- SSH CA, credential routing catalog, bootstrap SSH envelope → `ops-warden/`
- OpenBao mounts, platform secret paths, ESO → `railiance-platform/`
- Cluster desired state, host principals, force-command wrappers → `railiance-infra/`
- HelixForge architecture handoff canon → `helix-forge/` (linked, not duplicated)
- Identity/OIDC/MFA → `key-cape/` / Keycloak