# Factory k3s acceptance

Added `docs/factory-k3s-acceptance.md`, a concise developer-facing operational note documenting the verified Factory execution boundary: agent work runs in restricted k3s Jobs; a trusted laptop controller validates and applies results; Jobs receive repository-scoped, read-only GitHub deploy keys and no Git write credentials; k3s failure does not silently fall back to laptop execution; and `/factory` is the owner-facing trace.

Use the note at `docs/factory-k3s-acceptance.md` as the operational reference. Verify the change by reading that file and confirming it contains those five statements. No Factory machinery or other source files changed.