Enforce private-by-default enablement templates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

workplans/RAIL-EN-WP-0001-private-by-default-templates.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Templates emit private Services, never a public Ingress by default"
 domain: financials
 repo: railiance-enablement
-status: ready
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-15"
+updated: "2026-08-22"
 related:
   - RMASTER-WP-0023
   - ADR-0008
@@ -29,7 +29,7 @@ They never emit a public Ingress by default. If a template mentions
 
 ```task
 id: RAIL-EN-WP-0001-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "ceea9e5a-385e-4f13-b8ea-0b1e72cddaee"
 ```
@@ -40,3 +40,13 @@ that cites ADR-0008.
 
 **Done when:** a new package from the paved path is private unless the
 author adds an explicit grant.
+
+**Outcome (2026-08-22):** all reusable workflow templates are checked by
+`tools/check_private_defaults.py`. The check rejects Ingress/IngressRoute,
+LoadBalancer/NodePort Services, and direct deployment commands. The documented
+template contract points public exposure through the rail-owned ADR-0008 gate.
+
+## Completion evidence
+
+- `make check`: 4 workflow templates passed.
+- `make test`: 4 regression tests passed.