Non-secret identity, a reproducible capacity observation, and host-ops
labor/exit inputs for resource:hosteurope:railiance01. Booked price and
contract dates stay unknown for their owners.
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
Corrects the '5-repo stack architecture' phrasing, which predates the four-axis
repo-family model. Records that railiance-hosts is superseded by this repo with
retirement pending in railiance-master, and surfaces RAIL-HO-WP-0009 with the
honest status that the declarative allowlist is committed but not yet converged,
so the live host still carries two stale grants.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
