Operational State Boundary. The line between reusable source and live operational state. Repositories may own source, examples, documentation, and deployment recipes; they must not become the home for credentials, generated client material, backup bundles, private keys, peer state, or host-specific facts.
The boundary exists so reusable scripts and docs can live in source control while tokens, generated client configs, OAuth secrets, downloaded backups, host exports, and peer state stay out of Git. A good boundary includes a regeneration path, so operators can replace sensitive material without moving it into source control. It also carries a compromised credential rule for the moment when the boundary is violated.