coulomb/railiance-enablement
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-enablement/workplans/RAIL-EN-WP-0001-private-by-default-templates.md
tegwick 27ac54b32d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Enforce private-by-default enablement templates 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
2026-08-22 12:34:25 +02:00

1.5 KiB
Raw Permalink Blame History

id type title domain repo status owner topic_slug created updated related state_hub_workstream_id
RAIL-EN-WP-0001 workplan Templates emit private Services, never a public Ingress by default financials railiance-enablement finished codex railiance 2026-08-15 2026-08-22
RMASTER-WP-0023
ADR-0008
0070cc66-e5e5-42fc-a4cb-bbcc78451ea6

RAIL-EN-WP-0001 — private-by-default templates

Intake from RMASTER-WP-0023-T05.

Goal

New-rapp and new-rail templates emit private Services and tunnel docs. They never emit a public Ingress by default. If a template mentions exposure, default to private or omit the field (fail-closed).

T01 — Audit and fix templates

id: RAIL-EN-WP-0001-T01
status: done
priority: high
state_hub_task_id: "ceea9e5a-385e-4f13-b8ea-0b1e72cddaee"

Find every template that creates a Service or Ingress. Make ClusterIP the default. Replace public Ingress examples with a grant-gated snippet that cites ADR-0008.

Done when: a new package from the paved path is private unless the author adds an explicit grant.

Outcome (2026-08-22): all reusable workflow templates are checked by tools/check_private_defaults.py. The check rejects Ingress/IngressRoute, LoadBalancer/NodePort Services, and direct deployment commands. The documented template contract points public exposure through the rail-owned ADR-0008 gate.

Completion evidence

  • make check: 4 workflow templates passed.
  • make test: 4 regression tests passed.