ops: complete host-operator ramp-up on railiance01 (WP-0009 T10)

Live observe session verified SSH access, captured baseline and Critical
health/load findings (memory pressure, k3s API unavailable). RU checklist
closed; engagement phase operating; schedule enabled; no privileged changes.

engagements/pilots/eng-coulomb-railiance01-ho-001/vault/session-log/2026-07-16-privileged-proposal-dry-run.md

@@ -0,0 +1,62 @@
+# RU-08 — Privileged action proposal (DRY RUN — not executed)
+
+**Engagement:** eng-coulomb-railiance01-ho-001
+**Date:** 2026-07-16
+**Author:** host-operator (grok session)
+**Status:** proposal only — **no human approval recorded; no changes applied**
+
+## Purpose
+
+Prove the privilege gate path: agent may **propose** privileged work; execution requires recorded human approval.
+
+## Proposed actions (optional, priority order)
+
+### P1 — Emergency swap file (if OOM imminent)
+
+| Field | Value |
+|-------|--------|
+| Class | `privileged_ops` |
+| Blast radius | Host-wide; disk for swapfile; may pause I/O briefly |
+| Rollback | `swapoff` + remove swapfile |
+| Command sketch | create 2–4G swapfile on root FS (exact steps only after approval) |
+| Risk | Disk wear; masks capacity problem |
+
+### P2 — journald vacuum
+
+| Field | Value |
+|-------|--------|
+| Class | `privileged_ops` |
+| Blast radius | Historical logs discarded |
+| Rollback | none (logs gone) |
+| Command sketch | `journalctl --vacuum-size=500M` |
+| Risk | Loss of forensic depth |
+
+### P3 — Package security upgrades
+
+| Field | Value |
+|-------|--------|
+| Class | `package_upgrade` |
+| Blast radius | Service restarts; possible brief downtime |
+| Rollback | package-specific; may need restore |
+| Command sketch | `apt-get update && apt-get upgrade` (or unattended security only) |
+| Risk | Regression on production single-node |
+
+### P4 — Restrict UFW sources for 6443/8472
+
+| Field | Value |
+|-------|--------|
+| Class | `firewall_change` |
+| Blast radius | May lock out nodes/agents if mis-scoped |
+| Rollback | re-add rules |
+| Risk | High on single-node misconfiguration |
+
+## Approval record
+
+| Approver | Decision | Date | Notes |
+|----------|----------|------|-------|
+| _none_ | pending | | Dry-run only for RU-08 |
+
+## Gate test result
+
+- Proposal written to vault without executing changes: **PASS (RU-08)**
+- Access class used this session: **host_observe** only