Reconcile infrastructure workplans and retire stale flex-auth references

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e77d-47a4-7771-8e34-7339c7fac0e4

workplans/NK-WP-0027-reef-placement-reconciliation.md

@@ -10,7 +10,7 @@ owner: net-kingdom
 topic_slug: netkingdom
 planning_priority: P1
 created: "2026-08-19"
-updated: "2026-08-22"
+updated: "2026-09-28"
 state_hub_workstream_id: "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4"
 ---
 
@@ -250,3 +250,20 @@ ordinary next input.
   authoritative workload ids and fail-safe exception evaluation
 - `docs/reef-posture-provider-contract.md` — concrete T02/T03 carrier and join
   proposal awaiting reef-owner agreement
+
+## Infrastructure review — 2026-09-28
+
+The current `reef-railiance/declarations/reef.yaml` still has no
+`posture_provider` block. Its `ownership_repo` is `railiance-infra`: involve
+that substrate owner alongside repo-manager (carrier/schema) in T02. The live
+cluster has one Ready node; all eight CNPG clusters report one instance. This
+supports retaining the single-failure-domain constraint, not assigning a new
+V level from replica counts. T02/T03 stay `wait`.
+
+InfoTechCanon Data Model §11.23 explicitly lists `public`; ops-warden
+`registry/policy/security-posture.yaml` still has no public maturity floor.
+The missing artifact is an owner-agreed mapping separating disclosure class
+from synthetic provenance, not proof that public exists. T06 stays `wait`;
+no `public -> synthetic` alias or guessed M1 floor is permitted.
+
+Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).