tegwick
27ac54b32d
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
52 lines
1.5 KiB
Markdown
52 lines
1.5 KiB
Markdown
---
|
|
id: RAIL-EN-WP-0001
|
|
type: workplan
|
|
title: "Templates emit private Services, never a public Ingress by default"
|
|
domain: financials
|
|
repo: railiance-enablement
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-15"
|
|
updated: "2026-08-22"
|
|
related:
|
|
- RMASTER-WP-0023
|
|
- ADR-0008
|
|
state_hub_workstream_id: "0070cc66-e5e5-42fc-a4cb-bbcc78451ea6"
|
|
---
|
|
|
|
# RAIL-EN-WP-0001 — private-by-default templates
|
|
|
|
Intake from `RMASTER-WP-0023-T05`.
|
|
|
|
## Goal
|
|
|
|
New-rapp and new-rail templates emit private Services and tunnel docs.
|
|
They never emit a public Ingress by default. If a template mentions
|
|
`exposure`, default to `private` or omit the field (fail-closed).
|
|
|
|
## T01 — Audit and fix templates
|
|
|
|
```task
|
|
id: RAIL-EN-WP-0001-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ceea9e5a-385e-4f13-b8ea-0b1e72cddaee"
|
|
```
|
|
|
|
Find every template that creates a Service or Ingress. Make ClusterIP
|
|
the default. Replace public Ingress examples with a grant-gated snippet
|
|
that cites ADR-0008.
|
|
|
|
**Done when:** a new package from the paved path is private unless the
|
|
author adds an explicit grant.
|
|
|
|
**Outcome (2026-08-22):** all reusable workflow templates are checked by
|
|
`tools/check_private_defaults.py`. The check rejects Ingress/IngressRoute,
|
|
LoadBalancer/NodePort Services, and direct deployment commands. The documented
|
|
template contract points public exposure through the rail-owned ADR-0008 gate.
|
|
|
|
## Completion evidence
|
|
|
|
- `make check`: 4 workflow templates passed.
|
|
- `make test`: 4 regression tests passed.
|