coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement RMASTER-WP-0023 private-by-default exposure

Browse source 
Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.
This commit is contained in:
codex 2026-08-15 20:08:37 +02:00
parent 6301798fab
commit 4a664533d3
24 changed files with 998 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tools/testdata/family-declarations/bad-exposure/rail-kubernetes/declarations/rail.yaml vendored Normal file
View file

@ -0,0 +1,12 @@
kind: execution-rail
rail_id: rail-kubernetes
repo: rail-kubernetes
ownership_repo: railiance-cluster
contract_version: 1.0.0
composition_kind: base
execution_architecture: kubernetes
readiness_state: verified
required_substrate_capabilities:
- kubernetes-api
supported_rollout_modes:
- stage1-run

37
tools/testdata/family-declarations/bad-exposure/rapp-nogrant/declarations/rapp.yaml vendored Normal file
View file

@ -0,0 +1,37 @@
kind: managed-workload-package
repo_family: rapp
rapp_id: rapp-nogrant
repo: rapp-nogrant
ownership_repo: railiance-platform
contract_version: 1.0.0
readiness_state: declared
workload_identity:
name: nogrant
package_type: helm-managed-platform-service
data_classification: internal
criticality: medium
primary_rail: rail-kubernetes
supported_rails:
- rail-kubernetes
bound_reefs:
- reef-example
runtime_dependencies:
- kubernetes-api
composition:
purpose: Fixture rapp used to exercise exposure validation.
member_repos:
- repo: rapp-nogrant
role: package
deployables:
- nogrant
rollout_contract:
default_mode: helm-upgrade-install
smoke_contract:
required:
- example-status-ok
rollback_contract:
order:
- helm-rollback
exposure:
posture: public
binding_admission: production-approved

42
tools/testdata/family-declarations/bad-exposure/rapp-unapproved/declarations/rapp.yaml vendored Normal file
View file

@ -0,0 +1,42 @@
kind: managed-workload-package
repo_family: rapp
rapp_id: rapp-unapproved
repo: rapp-unapproved
ownership_repo: railiance-platform
contract_version: 1.0.0
readiness_state: declared
workload_identity:
name: unapproved
package_type: helm-managed-platform-service
data_classification: internal
criticality: medium
primary_rail: rail-kubernetes
supported_rails:
- rail-kubernetes
bound_reefs:
- reef-example
runtime_dependencies:
- kubernetes-api
composition:
purpose: Fixture rapp used to exercise exposure validation.
member_repos:
- repo: rapp-unapproved
role: package
deployables:
- unapproved
rollout_contract:
default_mode: helm-upgrade-install
smoke_contract:
required:
- example-status-ok
rollback_contract:
order:
- helm-rollback
exposure:
posture: public
binding_admission: verified
grant:
hostname: unapproved.example
reason: should fail
approved_on: "2026-08-15"
residual_risk_owner: railiance-platform

42
tools/testdata/family-declarations/bad-exposure/rapp-wrongreef/declarations/rapp.yaml vendored Normal file
View file

@ -0,0 +1,42 @@
kind: managed-workload-package
repo_family: rapp
rapp_id: rapp-wrongreef
repo: rapp-wrongreef
ownership_repo: railiance-platform
contract_version: 1.0.0
readiness_state: declared
workload_identity:
name: wrongreef
package_type: helm-managed-platform-service
data_classification: internal
criticality: medium
primary_rail: rail-kubernetes
supported_rails:
- rail-kubernetes
bound_reefs:
- reef-closed
runtime_dependencies:
- kubernetes-api
composition:
purpose: Fixture rapp used to exercise exposure validation.
member_repos:
- repo: rapp-wrongreef
role: package
deployables:
- wrongreef
rollout_contract:
default_mode: helm-upgrade-install
smoke_contract:
required:
- example-status-ok
rollback_contract:
order:
- helm-rollback
exposure:
posture: public
binding_admission: production-approved
grant:
hostname: closed.example
reason: reef has no public surface
approved_on: "2026-08-15"
residual_risk_owner: railiance-platform

12
tools/testdata/family-declarations/bad-exposure/reef-closed/declarations/reef.yaml vendored Normal file
View file

@ -0,0 +1,12 @@
kind: substrate-reef
reef_id: reef-closed
repo: reef-closed
ownership_repo: railiance-infra
substrate_kind: server-group
lifecycle_state: active
criticality: high
primary_rail: rail-kubernetes
hosted_rails:
- rail-kubernetes
current_members:
- Closed01

20
tools/testdata/family-declarations/bad-exposure/reef-example/declarations/reef.yaml vendored Normal file
View file

@ -0,0 +1,20 @@
kind: substrate-reef
reef_id: reef-example
repo: reef-example
ownership_repo: railiance-infra
substrate_kind: server-group
lifecycle_state: active
criticality: high
primary_rail: rail-kubernetes
hosted_rails:
- rail-kubernetes
current_members:
- Example01
exposure:
posture: public
grants:
- hostname: example.coulomb.social
port: 443
reason: fixture public DNS surface
approved_on: "2026-08-15"
residual_risk_owner: railiance-infra

19
tools/testdata/family-declarations/bad-exposure/reef-k3s/declarations/reef.yaml vendored Normal file
View file

@ -0,0 +1,19 @@
kind: substrate-reef
reef_id: reef-k3s
repo: reef-k3s
ownership_repo: railiance-infra
substrate_kind: server-group
lifecycle_state: active
criticality: high
primary_rail: rail-kubernetes
hosted_rails:
- rail-kubernetes
current_members:
- K3s01
exposure:
posture: public
grants:
- port: 6443
reason: must be rejected
approved_on: "2026-08-15"
residual_risk_owner: railiance-infra

15
tools/testdata/family-declarations/bad-exposure/reef-storage-example/declarations/reef.yaml vendored Normal file
View file

@ -0,0 +1,15 @@
kind: substrate-reef
reef_id: reef-storage-example
repo: reef-storage-example
ownership_repo: railiance-platform
substrate_kind: object-storage
lifecycle_state: planned
criticality: high
current_members: []
exposure:
posture: public
grants:
- hostname: s3.example
reason: provider API is not a listener we open
approved_on: "2026-08-15"
residual_risk_owner: railiance-platform

8
tools/testdata/family-declarations/good-exposure/inventory.json vendored Normal file
View file

@ -0,0 +1,8 @@
{
"source": "fixture",
"captured_at": "2026-08-15T00:00:00Z",
"reef": "reef-example",
"deployables": [
{"name": "example", "namespace": "example", "kind": "helm-release"}
]
}

21
tools/testdata/family-declarations/good-exposure/rail-knative/declarations/rail.yaml vendored Normal file
View file

@ -0,0 +1,21 @@
kind: execution-rail
rail_id: rail-knative
repo: rail-knative
ownership_repo: railiance-cluster
contract_version: 1.0.0
composition_kind: derived
base_rail: rail-kubernetes
base_rail_contract: 1.0.0
execution_architecture: knative-serving-on-kubernetes
readiness_state: verified
required_substrate_capabilities:
- kubernetes-api
- knative-serving
supported_rollout_modes:
- revision-canary
inherited_semantics:
- workload-identity
overridden_semantics:
- request-activation
compatibility_constraints:
- rail-kubernetes contract must equal 1.0.0

12
tools/testdata/family-declarations/good-exposure/rail-kubernetes/declarations/rail.yaml vendored Normal file
View file

@ -0,0 +1,12 @@
kind: execution-rail
rail_id: rail-kubernetes
repo: rail-kubernetes
ownership_repo: railiance-cluster
contract_version: 1.0.0
composition_kind: base
execution_architecture: kubernetes
readiness_state: verified
required_substrate_capabilities:
- kubernetes-api
supported_rollout_modes:
- stage1-run

42
tools/testdata/family-declarations/good-exposure/rapp-example/declarations/rapp.yaml vendored Normal file
View file

@ -0,0 +1,42 @@
kind: managed-workload-package
repo_family: rapp
rapp_id: rapp-example
repo: rapp-example
ownership_repo: railiance-platform
contract_version: 1.0.0
readiness_state: declared
workload_identity:
name: example
package_type: helm-managed-platform-service
data_classification: internal
criticality: medium
primary_rail: rail-kubernetes
supported_rails:
- rail-kubernetes
bound_reefs:
- reef-example
runtime_dependencies:
- kubernetes-api
composition:
purpose: Fixture rapp used to exercise exposure validation.
member_repos:
- repo: rapp-example
role: package
deployables:
- example
rollout_contract:
default_mode: helm-upgrade-install
smoke_contract:
required:
- example-status-ok
rollback_contract:
order:
- helm-rollback
exposure:
posture: public
binding_admission: production-approved
grant:
hostname: example.coulomb.social
reason: fixture public rapp
approved_on: "2026-08-15"
residual_risk_owner: railiance-platform

21
tools/testdata/family-declarations/good-exposure/reef-example/declarations/reef.yaml vendored Normal file
View file

@ -0,0 +1,21 @@
kind: substrate-reef
reef_id: reef-example
repo: reef-example
ownership_repo: railiance-infra
substrate_kind: server-group
lifecycle_state: active
criticality: high
primary_rail: rail-kubernetes
hosted_rails:
- rail-kubernetes
- rail-knative
current_members:
- Example01
exposure:
posture: public
grants:
- hostname: example.coulomb.social
port: 443
reason: fixture public DNS surface
approved_on: "2026-08-15"
residual_risk_owner: railiance-infra