# Repository operating rules

- Treat the Gitea `origin` as the canonical deployment repository.
- Production is disabled; do not create or enable production Applications
  without a complete production design and explicit approval.
- Never commit Terraform state, provider directories, plan files, tfvars,
  Vault init JSON, unseal/recovery material or plaintext credentials.
- A Vault API object may be owned by only one Terraform state.
- Keep secret payloads outside Terraform resources and data sources.
- Routine GitOps automation changes Git only; direct cluster mutation is
  reserved for documented bootstrap and recovery runbooks.
- Run `make validate` before handing off repository changes.
- Do not apply to a live cluster unless the user explicitly requests live
  deployment and the kube context has been verified.