Add login alias and record CoulombCore DNS inventory

workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-27"
+updated: "2026-07-28"
 depends_on:
   - USER-WP-0020
   - NK-WP-0023
@@ -38,7 +38,7 @@ before state migration or retirement begins.
 
 ```task
 id: NK-WP-0022-T01
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "fe55a2c2-8613-4190-a0b9-07eff4a58146"
 ```
@@ -54,6 +54,15 @@ Done when every component and state owner has a source, destination,
 verification method, rollback source, and explicit decision on whether
 railiance01 is already equivalent or requires migration.
 
+2026-07-28 DNS inventory: public resolvers show `auth.coulomb.social` and the
+new `login.coulomb.social` alias at railiance01 (`92.205.62.239`). The
+following names remain explicitly on CoulombCore (`92.205.130.254`):
+`bao`, `gitea`, `hub`, `lldap`, `pink-account`, and `pink` under
+`coulomb.social`. The last three are identity-cutover scope; Bao, Gitea, and
+Hub must be handed to their owning workload cutovers before CoulombCore host
+retirement. Local resolver caches may temporarily retain the former
+`auth.coulomb.social` address.
+
 ## T02 - Prove recoverable backups before changing state
 
 ```task
@@ -132,7 +141,7 @@ machine-readable.
 
 ```task
 id: NK-WP-0022-T06
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "00bfa48b-28de-4b8e-b3da-715c797beae5"
 ```
@@ -147,6 +156,11 @@ window. Roll back DNS if critical authentication or MFA gates fail.
 Done when normal DNS consistently resolves to railiance01 and the observation
 window passes without fallback traffic or state divergence.
 
+2026-07-28: authoritative/public recursive DNS now returns railiance01 for
+`auth.coulomb.social`; `login.coulomb.social` was added as an Authelia ingress
+and certificate alias. LLDAP and both privacyIDEA names remain intentionally
+on CoulombCore pending the state and conformance gates above.
+
 ## T07 - Retire CoulombCore identity workloads reversibly
 
 ```task