feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

roles/host-operator/protocols/os-security-pass.md

@@ -0,0 +1,116 @@
+---
+agent: host-operator
+slug: os-security-pass
+title: OS and Security Pass
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# OS and Security Pass
+
+## Purpose
+
+Weekly (or on-demand) review of OS currency and basic security posture on a
+named Linux host. Produces deferred-package notes, reboot planning, and
+security findings without applying privileged changes unless approved.
+
+## Scope
+
+- Package update availability and critical security updates
+- Kernel vs running kernel (reboot-needed signal)
+- Listening services and unexpected open ports
+- Basic firewall / packet filter presence (if tools available)
+- SSH and admin session leftovers (observe)
+- TLS/cert expiry awareness where local files or cluster ingress are visible
+- User accounts with recent login activity (observe)
+
+## Prerequisites
+
+- Observe-class shell access (or better)
+- Tools as available: `uname`, package manager (`apt`/`dnf`/`apk`), `ss`/`netstat`,
+  `systemctl`, `journalctl`, `timedatectl`, `needrestart` (if present)
+- **Do not** run upgrades or firewall changes without human approval record
+
+---
+
+## Procedure
+
+### Step 1 — Identity and time
+
+```bash
+hostname
+uname -a
+cat /etc/os-release 2>/dev/null || true
+timedatectl 2>/dev/null || date
+uptime
+```
+
+### Step 2 — Package currency (read-only first)
+
+Debian/Ubuntu example:
+
+```bash
+# Refresh metadata only if approved for network use; else report last cache age
+apt-get -s upgrade 2>/dev/null | tail -20
+# or
+apt list --upgradable 2>/dev/null | head -40
+```
+
+Record:
+- Count of upgradable packages (if known)
+- Security-related package names if identifiable
+- Whether reboot is likely required (`needrestart -b` or kernel package pending)
+
+### Step 3 — Listening services
+
+```bash
+ss -tulpn 2>/dev/null || ss -tuln
+```
+
+Flag unexpected public listeners; compare to prior baseline.
+
+### Step 4 — Auth and session hygiene
+
+```bash
+who
+last -n 15 2>/dev/null || true
+# Failed auth samples (careful with log volume)
+journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30
+```
+
+### Step 5 — Local firewall signal
+
+```bash
+systemctl is-active ufw nftables firewalld 2>/dev/null || true
+nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true
+```
+
+Note presence/absence; do not rewrite rules in this pass without approval.
+
+### Step 6 — Cluster-adjacent security (if k3s)
+
+```bash
+# Node conditions only; no secret dumps
+kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true
+```
+
+### Step 7 — Report
+
+Update vault:
+
+- `## OS & Patch State`
+- `## Security Posture`
+- Findings with severity
+- Explicit list of **proposed** privileged actions (upgrades, reboots) awaiting approval
+
+## Output template
+
+```markdown
+# OS & Security Pass — <hostname> — <date>
+
+## Summary
+## OS currency
+## Security findings
+## Proposed privileged actions (awaiting approval)
+## Deferred / accepted risk
+```