Draft family workplan for review. Default reefs, rails, and rapps stay off the public internet until production-approved plus an explicit grant. Implementation is routed, not done here.
