From 35ddfa5f7875377eb532f454037810ff773e126c Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 12 Aug 2026 00:05:13 +0200 Subject: [PATCH] Refresh Current State: four-axis model, hosts supersession, open security work Corrects the '5-repo stack architecture' phrasing, which predates the four-axis repo-family model. Records that railiance-hosts is superseded by this repo with retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the honest status that the declarative allowlist is committed but not yet converged, so the live host still carries two stale grants. Co-Authored-By: Claude Opus 5 --- SCOPE.md | 17 ++++++++++++++--- WORK-RECORDS.md | 6 ++++++ ...-firewall-declared-state-and-api-exposure.md | 6 ++++++ 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/SCOPE.md b/SCOPE.md index 1be8039..8bffd39 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -75,12 +75,23 @@ higher layer (Kubernetes, platform, etc.) can run. - Status: maintained / productive - Implementation: HostEurope substrate baseline active for `Railiance01` and - `CoulombCore`; server spec + test suite active; 5-repo stack architecture in - place; first reef rollout source map now defined + `CoulombCore`; server spec + test suite active; first reef rollout source map + defined. Railiance is classified along four repo-family axes (`railiance-*`, + `rail-*`, `rapp-*`, `reef-*`), of which five `railiance-*` repos cover S1–S5; + this file previously said "5-repo stack architecture", which predates that + model - Stability: high for the current single-server and transitional two-server substrate reality; proven in production on `92.205.62.239` - Usage: foundation for all Railiance deployments; canonical S1 source for - higher-layer and future reef planning + higher-layer and future reef planning. `railiance-hosts` is **superseded** by + this repo and carries a banner saying so; its retirement is pending in + `railiance-master` +- **Open security work**: `RAIL-HO-WP-0009` — the base role declared the k3s API + open to Anywhere while the live host was source-restricted by hand, so + converging would have exposed the Kubernetes API. The allowlist is now + declarative (`k3s_api_allowed_sources` / `k3s_api_revoked_sources`) but + **has not yet been converged**, so the live host still carries two stale + grants to rotated operator addresses --- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 16c4f76..aecc7ec 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,6 +11,7 @@ | workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md | | workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md | | workplan | RAIL-HO-WP-0008 | ready | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | +| workplan | RAIL-HO-WP-0009 | active | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | | task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md | | task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md | | task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md | @@ -27,3 +28,8 @@ | task | RAIL-HO-WP-0008-T01 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | | task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | | task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md | +| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | +| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | +| task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | +| task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | +| task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md | diff --git a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md index 984ab11..4830ed8 100644 --- a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md +++ b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md @@ -13,6 +13,7 @@ related_repos: - railiance-cluster - railiance-platform - railiance-master +state_hub_workstream_id: "ebf3c8d1-9066-4f13-a2d5-1da0409f2162" --- # RAIL-HO-WP-0009 - Firewall declared-state integrity and k3s API exposure @@ -81,6 +82,7 @@ It must not: id: RAIL-HO-WP-0009-T01 status: done priority: high +state_hub_task_id: "9a000a00-7cfd-4798-803f-bf59359a09b7" ``` Make the allowlist declarative. Add `k3s_api_allowed_sources` (empty default — @@ -98,6 +100,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1). id: RAIL-HO-WP-0009-T02 status: todo priority: high +state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc" ``` Converge the base role against `railiance01` and confirm the resulting UFW state @@ -112,6 +115,7 @@ Verify SSH remains available throughout, and re-check `kubectl get nodes` after. id: RAIL-HO-WP-0009-T03 status: todo priority: high +state_hub_task_id: "3e835b96-736c-458c-91eb-04bfd4c7e0e7" ``` Audit the rest of the base role for the same class of defect: any place where @@ -129,6 +133,7 @@ remove it. id: RAIL-HO-WP-0009-T04 status: todo priority: medium +state_hub_task_id: "908630e8-e245-47f5-a060-3949250f522c" ``` Remove the k3s API from the public internet. Operator addresses rotate, so an @@ -144,6 +149,7 @@ and the tunnel becomes a dependency of every operator action. id: RAIL-HO-WP-0009-T05 status: todo priority: medium +state_hub_task_id: "81af8470-286c-440a-bbe7-b47a17ee6750" ``` Propose a declared-vs-live conformance check for firewall state, and route it to