coulomb/railiance-enablement
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce private-by-default enablement templates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
tegwick 2026-08-22 12:34:25 +02:00
parent abe1865877
commit 27ac54b32d
9 changed files with 138 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/private-by-default-template-contract.md Normal file
View file

@ -0,0 +1,16 @@
# Private-by-default template contract
Railiance enablement templates produce build and promotion evidence; they do
not create a public listener. ADR-0008 is enforced by the execution rail:
- Kubernetes workload scaffolding is owned by `rail-kubernetes`.
- Its default Service is `ClusterIP`, its generated ingress policy is
default-deny, and its Stage 2 values do not enable Ingress.
- A public Ingress requires matching rapp and reef declarations at the rail's
deploy gate. An Ingress object or successful deployment is not a grant.
- Operator access uses the named tunnel documented by the owning rail or rapp.
`make check` rejects enablement workflow templates that embed Ingress,
LoadBalancer, NodePort, or direct Kubernetes/Helm deployment commands. This
keeps reusable build workflows from becoming an accidental application or
cluster deployment owner.