These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.
Records central already holds were deliberately left untouched.
Refs CUST-WP-0068-T06
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
The conformance checker existed but had not run since 2026-03-09, and its
firewall assertion matched /6443\/tcp.*ALLOW/ - asserting the port was allowed
but not from whom. It passed identically whether the API was restricted to one
operator address or open to the entire internet, which is precisely the drift
that went undetected.
goss/baseline.yaml is now a template rendered per host from the same inventory
declaration that converges the host, so the assertion cannot drift from what it
checks. It asserts each declared source is present, that no revoked source
retains access, and that 6443 is never ALLOW Anywhere. verify.yaml gained the
vars_files the bootstrap play already had - without it the firewall assertions
rendered empty and silently asserted nothing, which is worse than no check.
Result on Railiance01: 32 assertions, 31 pass. The one failure is a real find
and is recorded as T06 - Flannel VXLAN is declared open to Anywhere with no
source restriction, the same defect pattern as the k3s rule. It is currently
absent from the host, so converging would INTRODUCE the exposure rather than
fix drift. Must be resolved before RAIL-BS-WP-0007 multi-node HA needs working
VXLAN.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
UFW is entirely inactive on CoulombCore - no firewall on a host running ArgoCD,
the registry and databases - while the declared baseline says UFW active with
default deny. Same defect class as the k3s finding but in the opposite
direction: the declaration is stronger than reality, and equally undetected.
Not an emergency (6443 unreachable from outside, 22/443/80 the expected
surface), but converging that host would enable UFW on a frozen production
system and needs its own decision.
Full convergence of Railiance01 carries 11 changes, most unrelated to the
firewall and none ever applied, including a user-slice memory cap that could OOM
running agent workloads. The base role has no tags, so convergence cannot be
scoped - adding tags folded into this task.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
89.244.90.255 appeared in the live allowlist mid-session. Verified legitimate:
SSH pubkey auth as tegwick from that address on 2026-08-02, and UFW BLOCK
entries on 6443 immediately before it was granted. Now declared.
Both stale grants are deleted from the live host, so the security goal of T02 is
met and the live 6443 allowlist matches the declaration exactly.
Full convergence deliberately held: --check reports 11 changes, mostly unrelated
to the firewall, including MemoryMax=1500M on user-1000.slice which could OOM
running agent workloads, plus an sshd restart. That is a separate decision, and
the base role has no tags so convergence cannot be scoped to UFW alone. Records
both follow-ons.
The allowlist drifting again by hand during the session that was fixing
allowlist drift is now recorded as the strongest argument for T04, removing the
API from the public internet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Records the security defect found 2026-08-11: this repo declared 6443/tcp open
to Anywhere while the live host was source-restricted by hand, so converging the
base role would have exposed the Kubernetes API to the internet. A hardening run
that de-hardens, undetected because nothing compares declared UFW state to live
UFW state.
T01 (declarative allowlist) is done. T02 converges it - production action,
approval required, and until it runs the host still carries two stale grants to
addresses the ISP may have reassigned. T03 audits the role for the same class of
defect and asks about the undeclared 2224/tcp open to Anywhere. T04 proposes
removing the API from the public internet via the ops-bridge tunnel pattern
already documented for CoulombCore. T05 routes a declared-vs-live conformance
check to the unowned Q7 loop.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
