42 lines
1.1 KiB
Markdown
42 lines
1.1 KiB
Markdown
---
|
|
id: RAIL-EN-WP-0001
|
|
type: workplan
|
|
title: "Templates emit private Services, never a public Ingress by default"
|
|
domain: financials
|
|
repo: railiance-enablement
|
|
status: ready
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-15"
|
|
updated: "2026-08-15"
|
|
related:
|
|
- RMASTER-WP-0023
|
|
- ADR-0008
|
|
state_hub_workstream_id: "0070cc66-e5e5-42fc-a4cb-bbcc78451ea6"
|
|
---
|
|
|
|
# RAIL-EN-WP-0001 — private-by-default templates
|
|
|
|
Intake from `RMASTER-WP-0023-T05`.
|
|
|
|
## Goal
|
|
|
|
New-rapp and new-rail templates emit private Services and tunnel docs.
|
|
They never emit a public Ingress by default. If a template mentions
|
|
`exposure`, default to `private` or omit the field (fail-closed).
|
|
|
|
## T01 — Audit and fix templates
|
|
|
|
```task
|
|
id: RAIL-EN-WP-0001-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "ceea9e5a-385e-4f13-b8ea-0b1e72cddaee"
|
|
```
|
|
|
|
Find every template that creates a Service or Ingress. Make ClusterIP
|
|
the default. Replace public Ingress examples with a grant-gated snippet
|
|
that cites ADR-0008.
|
|
|
|
**Done when:** a new package from the paved path is private unless the
|
|
author adds an explicit grant.
|