coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-infra/workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md
codex 9477319783
All checks were successful
CI Smoke / source-contract (push) Successful in 12s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): adopt ADR-007 derived identifiers for unregistered records 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 20:20:13 +02:00

1.8 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related state_hub_workstream_id
RAIL-HO-WP-0010 workplan New reefs do not get 80/443 until a substrate grant exists financials railiance-infra finished codex railiance 2026-08-15 2026-08-22
RMASTER-WP-0023
RAIL-HO-WP-0009
ADR-0008
226e81e2-2bed-5d3b-869f-0cec7940719c

RAIL-HO-WP-0010 — new-reef host ports

Intake from RMASTER-WP-0023-T05.

Goal

Host surface for new reefs: do not open 80/443 until the reef declaration carries a public substrate grant. 6443 stays operator-only (RAIL-HO-WP-0009). This is not the rapp admission desk. Nydus 2224 stays a named exception.

T01 — Fail-closed new-reef UFW

id: RAIL-HO-WP-0010-T01
status: done
priority: high
state_hub_task_id: "7935c941-269a-5827-a139-1b02c6b649f6"

Bootstrap / inventory for a new reef starts with SSH (and Nydus only if the provider requires it). 80/443 require a cited reef grant. Do not add per-rapp UFW rules on a shared ingress host.

Done when: a new reef playbook cannot open 80/443 without naming the grant, and 6443 cannot be opened by this path.

Outcome (2026-08-22): the base role now rejects 80/443 in generic UFW extras and delegates public-web admission to a reef declaration validator. Only ports 80 and 443 are accepted, each must have a matching public substrate grant with reason, approval date, and owner, and 6443 is unconditionally rejected. Goss receives only the resulting grant-backed port list.

Completion evidence

  • python3 -m unittest discover -s tests -v: 5 tests passed.
  • Live source validation against reef-railiance/declarations/reef.yaml for ports 80 and 443: passed.
  • Ansible syntax validation remains unavailable on this workstation because ansible-playbook is not installed; no live firewall change was applied.