---
id: RAIL-EN-WP-0001
type: workplan
title: "Templates emit private Services, never a public Ingress by default"
domain: financials
repo: railiance-enablement
status: ready
owner: codex
topic_slug: railiance
created: "2026-08-15"
updated: "2026-08-15"
related:
  - RMASTER-WP-0023
  - ADR-0008
---

# RAIL-EN-WP-0001 — private-by-default templates

Intake from `RMASTER-WP-0023-T05`.

## Goal

New-rapp and new-rail templates emit private Services and tunnel docs.
They never emit a public Ingress by default. If a template mentions
`exposure`, default to `private` or omit the field (fail-closed).

## T01 — Audit and fix templates

```task
id: RAIL-EN-WP-0001-T01
status: todo
priority: high
```

Find every template that creates a Service or Ingress. Make ClusterIP
the default. Replace public Ingress examples with a grant-gated snippet
that cites ADR-0008.

**Done when:** a new package from the paved path is private unless the
author adds an explicit grant.