coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deliver ADR cleanup packets and publish first-wave arc42 stubs
Some checks failed
Build and publish policy-nexus image / build-and-push (push) Failing after 48s
Details

Browse source 
Packets go to seven owning repos by inbox and checklist. Railiance,
NetKingdom, and State Hub now have published architecture stubs.
This commit is contained in:
tegwick 2026-08-18 22:36:39 +02:00
parent b93928330e
commit af9f5996e2
34 changed files with 1891 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

6
build/adr/railiance-private-by-default-exposure/v1/index.html
View file

@ -1,6 +1,6 @@
<!doctype html>
<html lang="en"><meta charset="utf-8">
<meta name="policy-source-revision" content="debbc13b4018f20db0997516b99afc1cc21084d7">
<meta name="policy-source-revision" content="883533ed8af1703cc9bb4a2b24137e325bbbda47">
<meta name="policy-source-digest" content="276ea38233413f1e23670bbf57c486abc361b0a275ca67efea7d677103713b32">
<title>Private-by-default Exposure</title>
<style>
@ -191,7 +191,7 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
</style>
<div class="wrap"><header><div class="eyebrow"><span>RMASTER-ADR-0008</span> <span class="stat">accepted · accepted-1</span> <span>railiance-master</span> <span>reviewed 2026-08-15</span><span>generated from canonical source — do not edit</span></div><h1>Private-by-default Exposure</h1><p class="sub">Source: <code>railiance-master · docs/adr/ADR-0008-private-by-default-exposure.md · debbc13b4018f20db0997516b99afc1cc21084d7</code></p><p class="sub">Review due: 2027-02-15</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li></ol></nav><main><p>Date: 2026-08-15 Status: Accepted</p>
<div class="wrap"><header><div class="eyebrow"><span>RMASTER-ADR-0008</span> <span class="stat">accepted · accepted-1</span> <span>railiance-master</span> <span>reviewed 2026-08-15</span><span>generated from canonical source — do not edit</span></div><h1>Private-by-default Exposure</h1><p class="sub">Source: <code>railiance-master · docs/adr/ADR-0008-private-by-default-exposure.md · 883533ed8af1703cc9bb4a2b24137e325bbbda47</code></p><p class="sub">Review due: 2027-02-15</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li></ol></nav><main><p>Date: 2026-08-15 Status: Accepted</p>
<section id="context"><h2>Context</h2>
<p>ADR-0006 says a topology binding is not permission to run a workload in production. It does not say who may reach a listener. A working deploy, a <code>hosts_rail</code> / <code>binds_rapp</code> line, or an Ingress object has been enough to put something on the public internet.</p>
<p>Family readiness vocabularies are deliberately not unified (<code>schemas/README.md</code>). Reef <code>lifecycle_state</code> has no <code>production-approved</code>. Rapp <code>readiness_state</code> has no <code>production-approved</code> either. Exposure cannot be derived from those enums.</p>
@ -215,4 +215,4 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
</section>
<section id="consequences"><h2>Consequences</h2>
<ul><li>ADR-0006 still answers "may this binding run in production?" This ADR answers "who may reach the listener?" Do not merge the axes.</li><li>The three readiness enums stay distinct on purpose.</li><li>Family schemas grow an additive <code>exposure</code> field. Rapp <code>data_classification: public</code> is a different field and must not be reused as the posture name.</li><li>Implementation stays in the owning repos. This ADR does not install NetworkPolicy, UFW, Ingress, or tunnels.</li><li>Existing public surfaces on <code>reef-railiance</code> remain up until named as grants. This ADR is not a shutdown plan.</li><li>CoulombCore host inventory and Q7 / Goss reaction stay outside this decision.</li></ul>
</section><footer><span>RMASTER-ADR-0008 · accepted-1 · accepted</span><span>railiance-master · docs/adr/ADR-0008-private-by-default-exposure.md · debbc13b4018f20db0997516b99afc1cc21084d7</span></footer></main></div></div></html>
</section><footer><span>RMASTER-ADR-0008 · accepted-1 · accepted</span><span>railiance-master · docs/adr/ADR-0008-private-by-default-exposure.md · 883533ed8af1703cc9bb4a2b24137e325bbbda47</span></footer></main></div></div></html>