feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

roles/host-operator/protocols/load-workload-review.md

@@ -0,0 +1,103 @@
+---
+agent: host-operator
+slug: load-workload-review
+title: Load and Workload Review
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# Load and Workload Review
+
+## Purpose
+
+Regular review of system load and identification of workloads that are demanding
+or may overload the host. Establishes and updates the **load envelope** in memory.
+
+## Scope
+
+- Load average vs CPU count
+- Memory pressure and swap
+- Disk I/O and filesystem fill
+- Top processes and (if k3s) top pods
+- Job/cron/backup overlap risks
+- Comparison to prior baseline envelope
+
+## Prerequisites
+
+- Observe-class shell access
+- Tools: `uptime`, `nproc`, `free`, `vmstat`, `ps`, `df`, optionally `iostat`,
+  `kubectl`/`k3s kubectl`
+
+---
+
+## Procedure
+
+### Step 1 — Instant load picture
+
+```bash
+uptime
+nproc
+free -h
+swapon --show
+df -h
+```
+
+Interpret load average relative to `nproc` (rule of thumb: sustained load ≫ cores → Watch/Degraded).
+
+### Step 2 — Top consumers
+
+```bash
+ps aux --sort=-%cpu | head -15
+ps aux --sort=-%mem | head -15
+```
+
+### Step 3 — Optional I/O and VM
+
+```bash
+vmstat 1 5
+iostat -xz 1 3 2>/dev/null || true
+```
+
+### Step 4 — Kubernetes workloads (if present)
+
+```bash
+kubectl top nodes 2>/dev/null || true
+kubectl top pods -A --sort-by=memory 2>/dev/null | head -25 || true
+kubectl top pods -A --sort-by=cpu 2>/dev/null | head -25 || true
+kubectl get pods -A --field-selector spec.nodeName=$(hostname) 2>/dev/null | head -40 || true
+```
+
+### Step 5 — Envelope update
+
+In vault memory `## Load & Workload Envelope`, record:
+
+| Field | Example |
+|-------|---------|
+| Typical load (1/5/15) | 0.4 / 0.5 / 0.6 on 4 cores |
+| Peak seen | … |
+| Heavy workloads | forgejo runner, backups, … |
+| Saturation incidents | date · symptom · resolution |
+| Headroom notes | disk 40% free; mem OK |
+
+### Step 6 — Demand flags
+
+Flag as findings when:
+
+- Sustained load > cores without known batch job
+- Memory available critically low or swap thrash
+- Disk > 85% on critical mounts
+- Single pod/process dominating resources without request/limit awareness
+- Concurrent heavy jobs (backup + build + migrate)
+
+## Output template
+
+```markdown
+# Load & Workload Review — <hostname> — <date>
+
+## Summary
+## Load vs capacity
+## Top consumers
+## Envelope delta (vs last review)
+## Overload / demand risks
+## Recommended next steps (safe first)
+```

roles/host-operator/protocols/os-security-pass.md

@@ -0,0 +1,116 @@
+---
+agent: host-operator
+slug: os-security-pass
+title: OS and Security Pass
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# OS and Security Pass
+
+## Purpose
+
+Weekly (or on-demand) review of OS currency and basic security posture on a
+named Linux host. Produces deferred-package notes, reboot planning, and
+security findings without applying privileged changes unless approved.
+
+## Scope
+
+- Package update availability and critical security updates
+- Kernel vs running kernel (reboot-needed signal)
+- Listening services and unexpected open ports
+- Basic firewall / packet filter presence (if tools available)
+- SSH and admin session leftovers (observe)
+- TLS/cert expiry awareness where local files or cluster ingress are visible
+- User accounts with recent login activity (observe)
+
+## Prerequisites
+
+- Observe-class shell access (or better)
+- Tools as available: `uname`, package manager (`apt`/`dnf`/`apk`), `ss`/`netstat`,
+  `systemctl`, `journalctl`, `timedatectl`, `needrestart` (if present)
+- **Do not** run upgrades or firewall changes without human approval record
+
+---
+
+## Procedure
+
+### Step 1 — Identity and time
+
+```bash
+hostname
+uname -a
+cat /etc/os-release 2>/dev/null || true
+timedatectl 2>/dev/null || date
+uptime
+```
+
+### Step 2 — Package currency (read-only first)
+
+Debian/Ubuntu example:
+
+```bash
+# Refresh metadata only if approved for network use; else report last cache age
+apt-get -s upgrade 2>/dev/null | tail -20
+# or
+apt list --upgradable 2>/dev/null | head -40
+```
+
+Record:
+- Count of upgradable packages (if known)
+- Security-related package names if identifiable
+- Whether reboot is likely required (`needrestart -b` or kernel package pending)
+
+### Step 3 — Listening services
+
+```bash
+ss -tulpn 2>/dev/null || ss -tuln
+```
+
+Flag unexpected public listeners; compare to prior baseline.
+
+### Step 4 — Auth and session hygiene
+
+```bash
+who
+last -n 15 2>/dev/null || true
+# Failed auth samples (careful with log volume)
+journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30
+```
+
+### Step 5 — Local firewall signal
+
+```bash
+systemctl is-active ufw nftables firewalld 2>/dev/null || true
+nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true
+```
+
+Note presence/absence; do not rewrite rules in this pass without approval.
+
+### Step 6 — Cluster-adjacent security (if k3s)
+
+```bash
+# Node conditions only; no secret dumps
+kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true
+```
+
+### Step 7 — Report
+
+Update vault:
+
+- `## OS & Patch State`
+- `## Security Posture`
+- Findings with severity
+- Explicit list of **proposed** privileged actions (upgrades, reboots) awaiting approval
+
+## Output template
+
+```markdown
+# OS & Security Pass — <hostname> — <date>
+
+## Summary
+## OS currency
+## Security findings
+## Proposed privileged actions (awaiting approval)
+## Deferred / accepted risk
+```