diff --git a/workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md b/workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md
new file mode 100644
index 0000000..22e4ae4
--- /dev/null
+++ b/workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md
@@ -0,0 +1,42 @@
+---
+id: RAIL-HO-WP-0010
+type: workplan
+title: "New reefs do not get 80/443 until a substrate grant exists"
+domain: financials
+repo: railiance-infra
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-15"
+updated: "2026-08-15"
+related:
+  - RMASTER-WP-0023
+  - RAIL-HO-WP-0009
+  - ADR-0008
+---
+
+# RAIL-HO-WP-0010 — new-reef host ports
+
+Intake from `RMASTER-WP-0023-T05`.
+
+## Goal
+
+Host surface for **new** reefs: do not open 80/443 until the reef
+declaration carries a public substrate grant. `6443` stays operator-only
+(RAIL-HO-WP-0009). This is not the rapp admission desk. Nydus `2224`
+stays a named exception.
+
+## T01 — Fail-closed new-reef UFW
+
+```task
+id: RAIL-HO-WP-0010-T01
+status: todo
+priority: high
+```
+
+Bootstrap / inventory for a new reef starts with SSH (and Nydus only if
+the provider requires it). 80/443 require a cited reef grant. Do not
+add per-rapp UFW rules on a shared ingress host.
+
+**Done when:** a new reef playbook cannot open 80/443 without naming the
+grant, and `6443` cannot be opened by this path.