coulomb/railiance-enablement
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

workplan: RAIL-EN-WP-0001 private-by-default templates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Intake from RMASTER-WP-0023. Adopt RAIL-EN-WP- so ids do not collide
with other RAILIANCE-WP- repos.
This commit is contained in:
tegwick 2026-08-15 20:52:04 +02:00
parent f910c7c873
commit 4ce0c85d20
2 changed files with 45 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
AGENTS.md
View file

@ -7,7 +7,7 @@
**Domain:** financials **Domain:** financials
**Repo slug:** railiance-enablement **Repo slug:** railiance-enablement
**Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38` **Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
**Workplan prefix:** `RAILIANCE-WP-` **Workplan prefix:** `RAIL-EN-WP-`
--- ---
@ -169,10 +169,10 @@ get wrong.
Work items originate as files in this repo — not in the hub. The hub is a Work items originate as files in this repo — not in the hub. The hub is a
read/cache/index layer that rebuilds from files. read/cache/index layer that rebuilds from files.
**File location:** `workplans/RAILIANCE-WP-NNNN-<slug>.md` **File location:** `workplans/RAIL-EN-WP-NNNN-<slug>.md`
**Archived location:** finished workplans may move to **Archived location:** finished workplans may move to
`workplans/archived/YYMMDD-RAILIANCE-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is `workplans/archived/YYMMDD-RAIL-EN-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
the completion/archive date; the frontmatter `id` does not change. the completion/archive date; the frontmatter `id` does not change.
**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use **Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
@ -184,7 +184,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
```yaml ```yaml
--- ---
id: RAILIANCE-WP-NNNN id: RAIL-EN-WP-NNNN
type: workplan type: workplan
title: "..." title: "..."
domain: financials domain: financials
@ -208,7 +208,7 @@ derived health labels, not frontmatter statuses.
## Task Title ## Task Title
` ` `task ` ` `task
id: RAILIANCE-WP-NNNN-T01 id: RAIL-EN-WP-NNNN-T01
status: wait | todo | progress | done | cancel status: wait | todo | progress | done | cancel
priority: high | medium | low priority: high | medium | low
state_hub_task_id: "<uuid>" # written by fix-consistency — do not edit state_hub_task_id: "<uuid>" # written by fix-consistency — do not edit

40
workplans/RAIL-EN-WP-0001-private-by-default-templates.md Normal file
View file

@ -0,0 +1,40 @@
---
id: RAIL-EN-WP-0001
type: workplan
title: "Templates emit private Services, never a public Ingress by default"
domain: financials
repo: railiance-enablement
status: ready
owner: codex
topic_slug: railiance
created: "2026-08-15"
updated: "2026-08-15"
related:
- RMASTER-WP-0023
- ADR-0008
---
# RAIL-EN-WP-0001 — private-by-default templates
Intake from `RMASTER-WP-0023-T05`.
## Goal
New-rapp and new-rail templates emit private Services and tunnel docs.
They never emit a public Ingress by default. If a template mentions
`exposure`, default to `private` or omit the field (fail-closed).
## T01 — Audit and fix templates
```task
id: RAIL-EN-WP-0001-T01
status: todo
priority: high
```
Find every template that creates a Service or Ingress. Make ClusterIP
the default. Replace public Ingress examples with a grant-gated snippet
that cites ADR-0008.
**Done when:** a new package from the paved path is private unless the
author adds an explicit grant.