workplan: RAIL-EN-WP-0001 private-by-default templates

Intake from RMASTER-WP-0023. Adopt RAIL-EN-WP- so ids do not collide
with other RAILIANCE-WP- repos.

AGENTS.md

@@ -7,7 +7,7 @@
 **Domain:** financials
 **Repo slug:** railiance-enablement
 **Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
-**Workplan prefix:** `RAILIANCE-WP-`
+**Workplan prefix:** `RAIL-EN-WP-`
 
 ---
 
@@ -169,10 +169,10 @@ get wrong.
 Work items originate as files in this repo — not in the hub. The hub is a
 read/cache/index layer that rebuilds from files.
 
-**File location:** `workplans/RAILIANCE-WP-NNNN-<slug>.md`
+**File location:** `workplans/RAIL-EN-WP-NNNN-<slug>.md`
 
 **Archived location:** finished workplans may move to
-`workplans/archived/YYMMDD-RAILIANCE-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
+`workplans/archived/YYMMDD-RAIL-EN-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
 the completion/archive date; the frontmatter `id` does not change.
 
 **Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
@@ -184,7 +184,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 
 ```yaml
 ---
-id: RAILIANCE-WP-NNNN
+id: RAIL-EN-WP-NNNN
 type: workplan
 title: "..."
 domain: financials
@@ -208,7 +208,7 @@ derived health labels, not frontmatter statuses.
 ## Task Title
 
 ` ` `task
-id: RAILIANCE-WP-NNNN-T01
+id: RAIL-EN-WP-NNNN-T01
 status: wait | todo | progress | done | cancel
 priority: high | medium | low
 state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit

workplans/RAIL-EN-WP-0001-private-by-default-templates.md

@@ -0,0 +1,40 @@
+---
+id: RAIL-EN-WP-0001
+type: workplan
+title: "Templates emit private Services, never a public Ingress by default"
+domain: financials
+repo: railiance-enablement
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-15"
+updated: "2026-08-15"
+related:
+  - RMASTER-WP-0023
+  - ADR-0008
+---
+
+# RAIL-EN-WP-0001 — private-by-default templates
+
+Intake from `RMASTER-WP-0023-T05`.
+
+## Goal
+
+New-rapp and new-rail templates emit private Services and tunnel docs.
+They never emit a public Ingress by default. If a template mentions
+`exposure`, default to `private` or omit the field (fail-closed).
+
+## T01 — Audit and fix templates
+
+```task
+id: RAIL-EN-WP-0001-T01
+status: todo
+priority: high
+```
+
+Find every template that creates a Service or Ingress. Make ClusterIP
+the default. Replace public Ingress examples with a grant-gated snippet
+that cites ADR-0008.
+
+**Done when:** a new package from the paved path is private unless the
+author adds an explicit grant.