railiance-infra/WORK-RECORDS.md

# Work Records — railiance-infra

> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]

| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | ADHOC-2026-08-22 | finished | — | workplans/ADHOC-2026-08-22.md |
| workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| workplan | RAIL-HO-WP-0008 | finished | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| workplan | RAIL-HO-WP-0009 | finished | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| workplan | RAIL-HO-WP-0010 | finished | — | workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md |
| workplan | RAIL-HO-WP-0011 | active | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| workplan | RAIL-HO-WP-0012 | active | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | ADHOC-2026-08-22-T01 | done | — | workplans/ADHOC-2026-08-22.md |
| task | ADHOC-2026-08-22-T02 | done | — | workplans/ADHOC-2026-08-22.md |
| task | ADHOC-2026-08-22-T03 | done | — | workplans/ADHOC-2026-08-22.md |
| task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T04 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T05 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T06 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T07 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T08 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T09 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0007-T01 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T02 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T03 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T04 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0008-T01 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T02 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T03 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T02 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T03 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T04 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T05 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T06 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0010-T01 | done | — | workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md |
| task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T04 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T05 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T08 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0012-T01 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T02 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T03 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T04 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T05 | progress | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T06 | wait | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
Add first reef rollout workplan 2026-07-25 10:54:29 +02:00			`# Work Records — railiance-infra`

			> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
			`> stage 3). Do not edit by hand — edit the source file/block listed for`
			`> each record and re-run fix-consistency to refresh this index. Archived`
			`> workplans are omitted; closed decisions/intakes/engagements stay listed`
			`> so recently-resolved work is still visible. [auto]`

			`\| Kind \| ID \| Status \| Lane \| Source \|`
			`\| --- \| --- \| --- \| --- \| --- \|`
Resolve repository owner requests Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-22 15:14:01 +02:00			`\| workplan \| ADHOC-2026-08-22 \| finished \| — \| workplans/ADHOC-2026-08-22.md \|`
Add first reef rollout workplan 2026-07-25 10:54:29 +02:00			`\| workplan \| RAIL-HO-WP-0006 \| finished \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
Define S1 reef rollout handoff 2026-07-25 15:13:41 +02:00			`\| workplan \| RAIL-HO-WP-0007 \| finished \| — \| workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md \|`
chore(consistency): mark RAIL-HO-WP-0008 finished in work-records 2026-08-15 19:05:11 +02:00			`\| workplan \| RAIL-HO-WP-0008 \| finished \| — \| workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md \|`
chore(consistency): mark RAIL-HO-WP-0009 finished in work-records 2026-08-15 17:58:32 +02:00			`\| workplan \| RAIL-HO-WP-0009 \| finished \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
Gate reef web ports on exposure grants Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa 2026-08-22 12:34:25 +02:00			`\| workplan \| RAIL-HO-WP-0010 \| finished \| — \| workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md \|`
Implement reproducible S1 handoff contracts Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-23 12:02:23 +02:00			`\| workplan \| RAIL-HO-WP-0011 \| active \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
chore(registrar): assign State Hub identifiers Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 2026-08-25 17:46:22 +02:00			`\| workplan \| RAIL-HO-WP-0012 \| active \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
Resolve repository owner requests Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-22 15:14:01 +02:00			`\| task \| ADHOC-2026-08-22-T01 \| done \| — \| workplans/ADHOC-2026-08-22.md \|`
			`\| task \| ADHOC-2026-08-22-T02 \| done \| — \| workplans/ADHOC-2026-08-22.md \|`
			`\| task \| ADHOC-2026-08-22-T03 \| done \| — \| workplans/ADHOC-2026-08-22.md \|`
Add first reef rollout workplan 2026-07-25 10:54:29 +02:00			`\| task \| RAIL-HO-WP-0006-T01 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T02 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T03 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T04 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T05 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T06 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T07 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T08 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
			`\| task \| RAIL-HO-WP-0006-T09 \| done \| — \| workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md \|`
Define S1 reef rollout handoff 2026-07-25 15:13:41 +02:00			`\| task \| RAIL-HO-WP-0007-T01 \| done \| — \| workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md \|`
			`\| task \| RAIL-HO-WP-0007-T02 \| done \| — \| workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md \|`
			`\| task \| RAIL-HO-WP-0007-T03 \| done \| — \| workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md \|`
			`\| task \| RAIL-HO-WP-0007-T04 \| done \| — \| workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md \|`
chore(consistency): mark RAIL-HO-WP-0008 finished in work-records 2026-08-15 19:05:11 +02:00			`\| task \| RAIL-HO-WP-0008-T01 \| done \| — \| workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md \|`
			`\| task \| RAIL-HO-WP-0008-T02 \| done \| — \| workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md \|`
			`\| task \| RAIL-HO-WP-0008-T03 \| done \| — \| workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md \|`
Refresh Current State: four-axis model, hosts supersession, open security work Corrects the '5-repo stack architecture' phrasing, which predates the four-axis repo-family model. Records that railiance-hosts is superseded by this repo with retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the honest status that the declarative allowlist is committed but not yet converged, so the live host still carries two stale grants. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-12 00:05:13 +02:00			`\| task \| RAIL-HO-WP-0009-T01 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
chore(consistency): mark RAIL-HO-WP-0009 finished in work-records 2026-08-15 17:58:32 +02:00			`\| task \| RAIL-HO-WP-0009-T02 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01. 2026-08-15 15:41:59 +02:00			`\| task \| RAIL-HO-WP-0009-T03 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
			`\| task \| RAIL-HO-WP-0009-T04 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
			`\| task \| RAIL-HO-WP-0009-T05 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
			`\| task \| RAIL-HO-WP-0009-T06 \| done \| — \| workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md \|`
Gate reef web ports on exposure grants Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa 2026-08-22 12:34:25 +02:00			`\| task \| RAIL-HO-WP-0010-T01 \| done \| — \| workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md \|`
Implement reproducible S1 handoff contracts Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-23 12:02:23 +02:00			`\| task \| RAIL-HO-WP-0011-T01 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
			`\| task \| RAIL-HO-WP-0011-T02 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
			`\| task \| RAIL-HO-WP-0011-T03 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
Record green S1 source contract CI Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-23 12:09:01 +02:00			`\| task \| RAIL-HO-WP-0011-T04 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
Implement reproducible S1 handoff contracts Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-23 12:02:23 +02:00			`\| task \| RAIL-HO-WP-0011-T05 \| wait \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
			`\| task \| RAIL-HO-WP-0011-T06 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
			`\| task \| RAIL-HO-WP-0011-T07 \| done \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
			`\| task \| RAIL-HO-WP-0011-T08 \| wait \| — \| workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md \|`
chore(registrar): assign State Hub identifiers Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 2026-08-25 17:46:22 +02:00			`\| task \| RAIL-HO-WP-0012-T01 \| done \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
			`\| task \| RAIL-HO-WP-0012-T02 \| done \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
			`\| task \| RAIL-HO-WP-0012-T03 \| done \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
			`\| task \| RAIL-HO-WP-0012-T04 \| done \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
			`\| task \| RAIL-HO-WP-0012-T05 \| progress \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`
Make S1 handoff read-only by default Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018 2026-08-23 12:41:23 +02:00			`\| task \| RAIL-HO-WP-0012-T06 \| wait \| — \| workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md \|`