Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-12"
-updated: "2026-08-12"
+updated: "2026-08-15"
 related_repos:
   - railiance-cluster
   - railiance-platform
@@ -98,7 +98,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
 
 ```task
 id: RAIL-HO-WP-0009-T02
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
 ```
@@ -141,9 +141,22 @@ That is worth recording as evidence rather than as a footnote: the allowlist
 drifted again, by hand, *during the very session that was fixing allowlist
 drift*. It is the strongest available argument for T04.
 
+**Progress 2026-08-15.** Tags now exist (`make converge-firewall HOST=Railiance01`).
+Live 6443 grants on this date: `.236`, `.255`, and an undeclared `.248`. T04
+emptied the declared allowlist, so this task's remaining work is the
+operator-approved prune of those three grants. SSH stays; kubectl goes via
+`k3s-api-railiance01` (`:16444`). CoulombCore is not touched
+(`ufw_manage: false`).
+
+Waiting on operator approval. Command:
+
+```bash
+make converge-firewall HOST=Railiance01
+```
+
 ```task
 id: RAIL-HO-WP-0009-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3e835b96-736c-458c-91eb-04bfd4c7e0e7"
 ```
@@ -179,9 +192,24 @@ ever applied — an sshd restart, `MemoryMax=1500M` / `MemorySwapMax=512M` on
 cap in particular could OOM running agent workloads. The base role has **no
 tags**, so convergence cannot be scoped. Add tags as part of this task.
 
+**Done 2026-08-15.** Full audit:
+`docs/evidence/RAIL-HO-WP-0009-T03-declared-vs-live-audit.md`.
+
+- sshd / fail2ban / HISTCONTROL / sudoers match on both hosts.
+- 2224/tcp is HostEurope Nydus; declared as `ufw_extra_allowed`.
+- CoulombCore UFW is inactive; live filter is iptables INPUT DROP (6443/8472
+  not accepted). Set `ufw_manage: false` so a converge cannot enable UFW there.
+- Base role and sibling bootstrap roles now have tags (`firewall`, `ssh`,
+  `packages`, `fail2ban`, `swap`, `resource_limits`, `sops`). sshd restart is
+  a handler. Routed-allow applies only when VXLAN peers are declared.
+- Inventory script now loads `ansible/inventory/host_vars/` (it was looking at
+  a path that does not exist).
+- Not in this workplan: Railiance01 resource limits, CoulombCore UFW enable,
+  etcd/kubelet bind addresses, the `0.0.0.0:18081` issue-core proxy.
+
 ```task
 id: RAIL-HO-WP-0009-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "908630e8-e245-47f5-a060-3949250f522c"
 ```
@@ -195,10 +223,18 @@ the same pattern to `railiance01` and reduce the public allowlist to nothing.
 Decide explicitly rather than by default: this trades convenience for exposure,
 and the tunnel becomes a dependency of every operator action.
 
+**Done 2026-08-15.** Decision recorded in
+`docs/adr/ADR-005-k3s-api-tunnel-only.md`. `k3s_api_allowed_sources` is empty;
+former public grants (including the undeclared `.248` and the 2026-08-15
+workstation lease `.102`) are in `k3s_api_revoked_sources`. Operator access
+is `bridge up k3s-api-railiance01` (local 16444). Live prune of the three
+remaining grants is T02.
+
 ```task
 id: RAIL-HO-WP-0009-T06
-status: todo
+status: done
 priority: high
+state_hub_task_id: "764adf9e-cb60-4edd-86bf-f0c170e65cd2"
 ```
 
 **Flannel VXLAN is declared open to Anywhere.** Found 2026-08-12 by the newly
@@ -219,9 +255,15 @@ Note the sequencing risk: `RAIL-BS-WP-0007` (ThreePhoenix HA, multi-node) will
 need working VXLAN between nodes. Resolve this before that lands, or the fix
 will be made under delivery pressure.
 
+**Done 2026-08-15.** `flannel_vxlan_allowed_sources` defaults to empty; the
+role no longer adds a blanket 8472/udp allow and deletes one if present.
+Goss asserts 8472 is never `ALLOW Anywhere` and that the non-Anywhere count
+equals the declared peer list. When ThreePhoenix adds a second node, put its
+address in that list before converging firewall.
+
 ```task
 id: RAIL-HO-WP-0009-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "81af8470-286c-440a-bbe7-b47a17ee6750"
 ```
@@ -251,6 +293,21 @@ Result on `Railiance01`: 32 assertions, 31 pass, one genuine failure (T06). What
 remains for this task is the *loop* — scheduling it and routing failures
 somewhere they are seen.
 
+**Done 2026-08-15.** The check now also asserts exact allowlist *size*, so an
+extra hand grant fails. The loop:
+
+- hourly `railiance-goss-baseline.timer` on each host after `make verify`
+- TAP + `/var/lib/railiance/goss/last.status` + `FAILED` flag
+- optional State Hub POST on pass↔fail via `RAILIANCE_GOSS_NOTIFY_URL`
+- `make goss-status` / `make verify-host`
+
+Routed to `railiance-master` (ArchitectureBlueprint §5.3, Q7 owner) in
+`docs/conformance-loop.md`. Family-level reaction (page a human, block a
+rollout) is not this repo.
+
 ## Outcome
 
-Pending. T01 done; the live host is reachable but not yet converged.
+T01, T03, T04, T05, T06 done. T02 waits on operator approval to run
+`make converge-firewall HOST=Railiance01`, which will delete the three live
+6443 grants and make the host match ADR-005. CoulombCore UFW is intentionally
+not enabled.