Define S1 reef rollout handoff

SCOPE.md

@@ -14,7 +14,14 @@ S1 Infrastructure Substrate of the Railiance OAS Stack — Git-driven OS provisi
 
 ## Core Idea
 
-Railiance is structured as five independent repos per OAS Stack layer. This repo is S1 — the foundation. It provisions bare-metal/cloud servers (Hetzner, HostEurope), hardens the OS, manages secrets (SOPS/age), and validates the resulting baseline with Goss tests. S1 must be converged and verified before any higher layer (Kubernetes, platform, etc.) can run.
+Railiance is structured as five independent repos per OAS Stack layer. This repo
+is S1 — the foundation and the canonical ownership home for infrastructure
+substrate facts. It provisions bare-metal or cloud servers (Hetzner,
+HostEurope), hardens the OS, manages secrets (SOPS/age), and validates the
+resulting baseline with Goss tests. Future `reef-*` repos will model
+purpose-bound substrates, but the source-backed OS baseline, inventory, and
+server identity facts start here. S1 must be converged and verified before any
+higher layer (Kubernetes, platform, etc.) can run.
 
 ---
 
@@ -28,6 +35,9 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 - Goss specification and test suite for OS baseline validation
 - Server inventory management (`inventory/servers.yaml` — source of truth)
 - SSH access management
+- Canonical S1 identity and substrate-fact base for future `reef-*` repos
+- Source-backed server and workstation substrate facts needed by higher-layer
+  architecture work
 
 ---
 
@@ -37,6 +47,9 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 - Platform services → railiance-platform (S3)
 - Developer tooling → railiance-enablement (S4)
 - Application deployments → railiance-apps (S5)
+- Workload execution semantics or rail contracts → `rail-*` repos
+- Purpose-specific reef repo ownership and workload-placement policy beyond the
+  S1 source-backed substrate facts
 - No cross-layer re-configuration from higher layers
 
 ---
@@ -47,6 +60,7 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 - OS hardening, Ansible convergence, or Goss verification
 - Managing server inventory or SSH access
 - Rotating SOPS/age keys or updating secrets
+- Preparing or validating first-wave `reef-*` rollout identity facts
 
 ---
 
@@ -59,10 +73,14 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 
 ## Current State
 
-- Status: active / productive
-- Implementation: single-server HostEurope baseline complete (RAIL-HO-WP-0001); server spec + test suite active (WP-0002); 5-repo stack restructure active (WP-0003)
-- Stability: high for single-server bootstrap; proven in production (92.205.62.239)
-- Usage: foundation for all Railiance deployments; used daily for convergence and verification
+- Status: maintained / productive
+- Implementation: HostEurope substrate baseline active for `Railiance01` and
+  `CoulombCore`; server spec + test suite active; 5-repo stack architecture in
+  place; first reef rollout source map now defined
+- Stability: high for the current single-server and transitional two-server
+  substrate reality; proven in production on `92.205.62.239`
+- Usage: foundation for all Railiance deployments; canonical S1 source for
+  higher-layer and future reef planning
 
 ---
 
@@ -70,6 +88,8 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 
 - Upstream dependencies: Terraform, Ansible, SOPS/age (external tools); cloud provider APIs
 - Downstream consumers: railiance-cluster (S2) depends on a converged, verified OS from this layer; all higher layers transitively depend on S1
+- Future substrate-boundary consumers: first-wave `reef-*` repos should project
+  from the source-backed facts here rather than creating a second S1 inventory
 - Often used with: railiance-cluster (next layer), ops-bridge (SSH tunnel for remote State Hub access)
 
 ---
@@ -84,6 +104,8 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 ## Related / Overlapping
 
 - `railiance-cluster` (S2) — consumes the OS baseline provided by S1
+- `railiance-hosts` — predecessor or migration-duplicate S1 line; not the
+  canonical repo for new architecture work
 - `ops-bridge` — used to reach local State Hub from remote HostEurope server
 
 ---
@@ -91,7 +113,10 @@ Railiance is structured as five independent repos per OAS Stack layer. This repo
 ## Getting Oriented
 
 - Start with: `CLAUDE.md` (session protocol, remote execution), `README.md` (provisioning workflow)
-- Key files / directories: `inventory/servers.yaml` (authoritative server list), `ansible/` (playbooks/roles), `terraform/` (provider configs), `goss/` (spec + tests), `docs/adr/ADR-003-railiance-5repo-stack-architecture.md`
+- Key files / directories: `inventory/servers.yaml` (authoritative server
+  list), `ansible/` (playbooks/roles), `terraform/` (provider configs), `goss/`
+  (spec + tests), `docs/reef-first-wave-source-map.md`,
+  `docs/adr/ADR-003-railiance-5repo-stack-architecture.md`
 - Entry points: `make tf-plan`, `make tf-apply`, `make converge`, `make verify`
 
 ---
@@ -123,4 +148,8 @@ keywords: [sops, age, secrets, encryption, gitops, key-rotation, credential]
 
 ## Notes
 
-Targets two servers: COULOMBCORE (92.205.130.254) and Railiance01 (92.205.62.239). State Hub access via ops-bridge — `bridge up state-hub-coulombcore` or `bridge up state-hub-railiance01` from the workstation (see ADR-004).
+Targets two current server substrates: `CoulombCore` (`92.205.130.254`) and
+`Railiance01` (`92.205.62.239`). The first-wave reef rollout also recognizes a
+grouped operator workstation substrate. State Hub access uses ops-bridge —
+`bridge up state-hub-coulombcore` or `bridge up state-hub-railiance01` from the
+workstation (see ADR-004).