Repository operating rules

Treat the Gitea origin as the canonical deployment repository.
Production is disabled; do not create or enable production Applications without a complete production design and explicit approval.
Never commit Terraform state, provider directories, plan files, tfvars, Vault init JSON, unseal/recovery material or plaintext credentials.
A Vault API object may be owned by only one Terraform state.
Keep secret payloads outside Terraform resources and data sources.
Routine GitOps automation changes Git only; direct cluster mutation is reserved for documented bootstrap and recovery runbooks.
Run make validate before handing off repository changes.
Do not apply to a live cluster unless the user explicitly requests live deployment and the kube context has been verified.