Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md

@@ -4,11 +4,11 @@ type: workplan
 title: "New reefs do not get 80/443 until a substrate grant exists"
 domain: financials
 repo: railiance-infra
-status: ready
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-15"
+updated: "2026-08-22"
 related:
   - RMASTER-WP-0023
   - RAIL-HO-WP-0009
@@ -31,7 +31,7 @@ stays a named exception.
 
 ```task
 id: RAIL-HO-WP-0010-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f4cc01f8-5b5e-4693-b389-9bd81e26a799"
 ```
@@ -42,3 +42,17 @@ add per-rapp UFW rules on a shared ingress host.
 
 **Done when:** a new reef playbook cannot open 80/443 without naming the
 grant, and `6443` cannot be opened by this path.
+
+**Outcome (2026-08-22):** the base role now rejects 80/443 in generic UFW
+extras and delegates public-web admission to a reef declaration validator.
+Only ports 80 and 443 are accepted, each must have a matching public substrate
+grant with reason, approval date, and owner, and 6443 is unconditionally
+rejected. Goss receives only the resulting grant-backed port list.
+
+## Completion evidence
+
+- `python3 -m unittest discover -s tests -v`: 5 tests passed.
+- Live source validation against `reef-railiance/declarations/reef.yaml` for
+  ports 80 and 443: passed.
+- Ansible syntax validation remains unavailable on this workstation because
+  `ansible-playbook` is not installed; no live firewall change was applied.