Enforce private-by-default rail exposure

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

tools/create_railiance_overlay_repo.sh

@@ -479,6 +479,7 @@ metadata:
   annotations:
 {{ include "railiance.prometheusAnnotations" . | nindent 4 }}
 spec:
+  type: ClusterIP
   selector:
 {{ include "railiance.selectorLabels" . | nindent 4 }}
   ports:
@@ -487,6 +488,30 @@ spec:
       targetPort: http
 EOF
 
+cat > "${OUT_DIR}/charts/${APP_ID}/templates/networkpolicy.yaml" <<'EOF'
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "railiance.releaseName" . }}-default-deny
+  labels:
+{{ include "railiance.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+{{ include "railiance.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector: {}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+EOF
+
 cat > "${OUT_DIR}/charts/${APP_ID}/templates/ingress.yaml" <<'EOF'
 {{- if and .Values.ingress.enabled (ne .Values.railiance.traffic.mode "weighted") }}
 apiVersion: networking.k8s.io/v1
@@ -631,8 +656,10 @@ image:
   tag: ${UPSTREAM_REVISION}
 replicaCount: 2
 ingress:
-  enabled: true
-  host: ${APP_ID}.local
+  # ADR-0008: Stage 2 is private unless the rapp and reef declarations carry
+  # matching public grants and the binding is production-approved.
+  enabled: false
+  host: ""
   path: /
   annotations:
     railiance.coulomb.social/stage: stable
@@ -664,6 +691,7 @@ for rel in ('${APP_ID}', '${APP_ID}-canary'):
 required_paths = [
     'charts/${APP_ID}/templates/deployment.yaml',
     'charts/${APP_ID}/templates/service.yaml',
+    'charts/${APP_ID}/templates/networkpolicy.yaml',
     'charts/${APP_ID}/templates/ingress.yaml',
     'charts/${APP_ID}/templates/traefik-weighted.yaml',
     'values/stage2-canary.yaml',
@@ -685,7 +713,9 @@ if command -v helm >/dev/null 2>&1; then
   helm template ${APP_ID}-canary charts/${APP_ID} -f values/stage2-canary.yaml >/tmp/${APP_ID}-stage2-canary-render.yaml
   grep -q 'kind: Deployment' /tmp/${APP_ID}-stage2-canary-render.yaml
   grep -q 'kind: Service' /tmp/${APP_ID}-stage2-canary-render.yaml
-  grep -q 'kind: Ingress' /tmp/${APP_ID}-stage2-canary-render.yaml
+  grep -q 'type: ClusterIP' /tmp/${APP_ID}-stage2-canary-render.yaml
+  grep -q 'kind: NetworkPolicy' /tmp/${APP_ID}-stage2-canary-render.yaml
+  ! grep -q 'kind: Ingress' /tmp/${APP_ID}-stage2-canary-render.yaml
   echo 'stage2 helm template ok'
 else
   echo 'helm unavailable; verified stage2 canary scaffold files only'