feat: accept ADR-0008 private-by-default exposure (WP-0023 T01)

Operator ratified the recommended table. Record the sibling ADR,
point ADR-0006 at it, and open T02.

workplans/RMASTER-WP-0023-private-by-default-exposure.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Private-by-default exposure until production admission"
 domain: financials
 repo: railiance-master
-status: ready
+status: active
 owner: bernd
 topic_slug: railiance
 planning_priority: high
@@ -13,6 +13,7 @@ created: "2026-08-15"
 updated: "2026-08-15"
 related:
   - ADR-0006
+  - ADR-0008
   - RMASTER-WP-0017
   - RMASTER-WP-0019
   - RMASTER-WP-0021
@@ -93,10 +94,10 @@ It does **not** belong as the system owner in:
   provider API on the internet. That is a different category from a
   listener we open.
 
-## Decision to ratify (T01)
+## Decision (T01, accepted 2026-08-15)
 
-Recommended default, for review. T01 may amend; it should not start from
-a blank page.
+Ratified as written. Recorded in
+[`docs/adr/ADR-0008-private-by-default-exposure.md`](../docs/adr/ADR-0008-private-by-default-exposure.md).
 
 | Posture | Meaning | Who may reach it |
 | --- | --- | --- |
@@ -187,7 +188,7 @@ It must not:
 
 ```task
 id: RMASTER-WP-0023-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "40d50848-d59e-4f7c-98df-a442dce90439"
 ```
@@ -202,11 +203,16 @@ substrate grant. Confirm `6443` is not grantable as `public`.
 distinct on purpose, and the per-family meaning of `public` is written
 down.
 
+Completed 2026-08-15: operator accepted the recommended table as
+written. ADR-0008 records the postures, the per-family meaning of
+`public`, the grant shape, and the 6443 exclusion. Readiness enums stay
+distinct.
+
 ### T02 — Write the exposure contract
 
 ```task
 id: RMASTER-WP-0023-T02
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "96db2a2d-670c-4b98-b6f3-860f9b3009b3"
 ```
@@ -322,6 +328,6 @@ with a back-link to this ID.
 
 ## Outcome
 
-Reviewed 2026-08-15 against current repo state (`status: ready`). T01
-still needs human ratification of ADR-0008. Implementation stays out of
-this repo.
+T01 accepted 2026-08-15 (`status: active`). ADR-0008 is the record.
+Next: T02 contract and T04 exception snapshot. Implementation stays out
+of this repo.