Refresh Current State: four-axis model, hosts supersession, open security work

Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

SCOPE.md

@@ -75,12 +75,23 @@ higher layer (Kubernetes, platform, etc.) can run.
 
 - Status: maintained / productive
 - Implementation: HostEurope substrate baseline active for `Railiance01` and
-  `CoulombCore`; server spec + test suite active; 5-repo stack architecture in
+  `CoulombCore`; server spec + test suite active; first reef rollout source map
-  place; first reef rollout source map now defined
+  defined. Railiance is classified along four repo-family axes (`railiance-*`,
+  `rail-*`, `rapp-*`, `reef-*`), of which five `railiance-*` repos cover S1–S5;
+  this file previously said "5-repo stack architecture", which predates that
+  model
 - Stability: high for the current single-server and transitional two-server
   substrate reality; proven in production on `92.205.62.239`
 - Usage: foundation for all Railiance deployments; canonical S1 source for
-  higher-layer and future reef planning
+  higher-layer and future reef planning. `railiance-hosts` is **superseded** by
+  this repo and carries a banner saying so; its retirement is pending in
+  `railiance-master`
+- **Open security work**: `RAIL-HO-WP-0009` — the base role declared the k3s API
+  open to Anywhere while the live host was source-restricted by hand, so
+  converging would have exposed the Kubernetes API. The allowlist is now
+  declarative (`k3s_api_allowed_sources` / `k3s_api_revoked_sources`) but
+  **has not yet been converged**, so the live host still carries two stale
+  grants to rotated operator addresses
 
 ---
 

WORK-RECORDS.md

@@ -11,6 +11,7 @@
 | workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
 | workplan | RAIL-HO-WP-0008 | ready | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
+| workplan | RAIL-HO-WP-0009 | active | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
 | task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
@@ -27,3 +28,8 @@
 | task | RAIL-HO-WP-0008-T01 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
 | task | RAIL-HO-WP-0008-T02 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
 | task | RAIL-HO-WP-0008-T03 | todo | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
+| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
+| task | RAIL-HO-WP-0009-T02 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
+| task | RAIL-HO-WP-0009-T03 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
+| task | RAIL-HO-WP-0009-T04 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
+| task | RAIL-HO-WP-0009-T05 | todo | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |

workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md

@@ -13,6 +13,7 @@ related_repos:
   - railiance-cluster
   - railiance-platform
   - railiance-master
+state_hub_workstream_id: "ebf3c8d1-9066-4f13-a2d5-1da0409f2162"
 ---
 
 # RAIL-HO-WP-0009 - Firewall declared-state integrity and k3s API exposure
@@ -81,6 +82,7 @@ It must not:
 id: RAIL-HO-WP-0009-T01
 status: done
 priority: high
+state_hub_task_id: "9a000a00-7cfd-4798-803f-bf59359a09b7"
 ```
 
 Make the allowlist declarative. Add `k3s_api_allowed_sources` (empty default —
@@ -98,6 +100,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
 id: RAIL-HO-WP-0009-T02
 status: todo
 priority: high
+state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
 ```
 
 Converge the base role against `railiance01` and confirm the resulting UFW state
@@ -112,6 +115,7 @@ Verify SSH remains available throughout, and re-check `kubectl get nodes` after.
 id: RAIL-HO-WP-0009-T03
 status: todo
 priority: high
+state_hub_task_id: "3e835b96-736c-458c-91eb-04bfd4c7e0e7"
 ```
 
 Audit the rest of the base role for the same class of defect: any place where
@@ -129,6 +133,7 @@ remove it.
 id: RAIL-HO-WP-0009-T04
 status: todo
 priority: medium
+state_hub_task_id: "908630e8-e245-47f5-a060-3949250f522c"
 ```
 
 Remove the k3s API from the public internet. Operator addresses rotate, so an
@@ -144,6 +149,7 @@ and the tunnel becomes a dependency of every operator action.
 id: RAIL-HO-WP-0009-T05
 status: todo
 priority: medium
+state_hub_task_id: "81af8470-286c-440a-bbe7-b47a17ee6750"
 ```
 
 Propose a declared-vs-live conformance check for firewall state, and route it to