Publish railiance01 resource evidence and close RAIL-HO-WP-0008

Non-secret identity, a reproducible capacity observation, and host-ops
labor/exit inputs for resource:hosteurope:railiance01. Booked price and
contract dates stay unknown for their owners.

docs/evidence/resource-hosteurope-railiance01/labor-and-exit.yaml

@@ -0,0 +1,101 @@
+# Host-level operations labor and exit inputs for resource:hosteurope:railiance01
+# Consumer: resource-control forecasts that need to separate host infrastructure,
+# recurring host-ops labor, and replacement/exit effort.
+# Does not estimate workload, cluster, or platform labor.
+
+schema_version: "1.0"
+resource_id: resource:hosteurope:railiance01
+published_at: "2026-08-15"
+authority: railiance-infra
+workplan: RAIL-HO-WP-0008-T03
+
+scope:
+  includes:
+    - OS baseline convergence
+    - host firewall declared state
+    - host verification (Goss)
+    - SSH access and host identity
+    - host incident response
+    - replacement and cancellation of this virtual server
+  excludes:
+    - k3s / cluster operations (railiance-cluster)
+    - platform services (railiance-platform)
+    - application and tenant labor (those repos)
+    - booked Host Europe spend (fin-hub)
+
+recurring_activities:
+  - id: os-baseline-converge
+    description: Apply ansible/playbooks/bootstrap.yaml or a tagged subset
+    cadence: event-driven
+    typical_hours: 1.0
+    basis: estimated
+    note: One tagged run. Full untagged converge is deliberately not routine.
+  - id: firewall-declared-state
+    description: Review and apply UFW from inventory (make converge-firewall)
+    cadence: event-driven
+    typical_hours: 0.5
+    basis: estimated
+    note: Hourly Goss timer is unattended; this is operator time when it fails.
+  - id: host-verify
+    description: make verify-host HOST=Railiance01 and read TAP
+    cadence: monthly
+    typical_hours: 0.25
+    basis: estimated
+  - id: ssh-and-identity
+    description: SSH CA, authorized_keys, ops-bridge key, inventory IP
+    cadence: event-driven
+    typical_hours: 0.5
+    basis: estimated
+  - id: host-incident
+    description: Host-level outage, disk, SSH lockout, provider ticket
+    cadence: unscheduled
+    typical_hours: 2.0
+    basis: estimated
+    note: Not every month. Use as a rare-event allowance, not a measured mean.
+
+monthly_host_ops_hours:
+  value: 2.0
+  unit: hours
+  basis: estimated
+  method: Sum of typical_hours for monthly verify plus a share of event-driven work
+  uncertainty: No time records exist. This is a forecast placeholder, not a measurement.
+  owner: railiance-infra
+
+one_off_not_recurring:
+  - id: RAIL-HO-WP-0009
+    description: Firewall declared-state integrity and k3s API tunnel-only cutover
+    completed: "2026-08-15"
+    hours: null
+    basis: unknown
+    note: Do not amortise into the monthly host-ops figure until a time record exists.
+
+exit:
+  path:
+    - Provision replacement compute (manual Host Europe panel or another provider)
+    - Restore or redeploy k3s and stateful services from their owning repos
+    - Switch DNS and ingress
+    - Verify workloads
+    - Cancel the Host Europe virtual server in the panel
+    - Confirm disk wipe / instance destroy
+  replacement_cutover_hours:
+    value: 8.0
+    unit: hours
+    basis: estimated
+    uncertainty: Host-ops only. Cluster and workload cutover hours belong to those repos.
+  cancellation:
+    notice_period:
+      value: null
+      classification: unknown
+      owner: operator
+      source: Host Europe contract
+    panel: Host Europe / GoDaddy VPS control panel
+    provider_api: none
+  data_at_rest:
+    items:
+      - Ubuntu root filesystem (193 GiB provisioned class)
+      - local-path PVs for cluster workloads (failure domain host:railiance01)
+    note: PV contents are not S1-owned; list them only as correlated-exit risk.
+
+cadence_for_consumers:
+  republish_labor: when the activity catalog changes, or after a quarter of time records
+  republish_exit: when replacement procedure or cancel terms become known