Records the security defect found 2026-08-11: this repo declared 6443/tcp open
to Anywhere while the live host was source-restricted by hand, so converging the
base role would have exposed the Kubernetes API to the internet. A hardening run
that de-hardens, undetected because nothing compares declared UFW state to live
UFW state.
T01 (declarative allowlist) is done. T02 converges it - production action,
approval required, and until it runs the host still carries two stale grants to
addresses the ISP may have reassigned. T03 audits the role for the same class of
defect and asks about the undeclared 2224/tcp open to Anywhere. T04 proposes
removing the API from the public internet via the ops-bridge tunnel pattern
already documented for CoulombCore. T05 routes a declared-vs-live conformance
check to the unowned Q7 loop.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
