---
id: RAIL-EN-WP-0001
type: workplan
title: "Templates emit private Services, never a public Ingress by default"
domain: financials
repo: railiance-enablement
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-15"
updated: "2026-08-22"
related:
  - RMASTER-WP-0023
  - ADR-0008
state_hub_workstream_id: "0070cc66-e5e5-42fc-a4cb-bbcc78451ea6"
---

# RAIL-EN-WP-0001 — private-by-default templates

Intake from `RMASTER-WP-0023-T05`.

## Goal

New-rapp and new-rail templates emit private Services and tunnel docs.
They never emit a public Ingress by default. If a template mentions
`exposure`, default to `private` or omit the field (fail-closed).

## T01 — Audit and fix templates

```task
id: RAIL-EN-WP-0001-T01
status: done
priority: high
state_hub_task_id: "ceea9e5a-385e-4f13-b8ea-0b1e72cddaee"
```

Find every template that creates a Service or Ingress. Make ClusterIP
the default. Replace public Ingress examples with a grant-gated snippet
that cites ADR-0008.

**Done when:** a new package from the paved path is private unless the
author adds an explicit grant.

**Outcome (2026-08-22):** all reusable workflow templates are checked by
`tools/check_private_defaults.py`. The check rejects Ingress/IngressRoute,
LoadBalancer/NodePort Services, and direct deployment commands. The documented
template contract points public exposure through the rail-owned ADR-0008 gate.

## Completion evidence

- `make check`: 4 workflow templates passed.
- `make test`: 4 regression tests passed.