# Exposure enforcement intakes

Date: 2026-08-15
Source: `RMASTER-WP-0023-T05`
Back-link: `RMASTER-WP-0023`

These are intakes for the owning-repo agents. File a workplan in the
owning repo. Do not implement the controls from `railiance-master`.

Normative reading:

- [`docs/adr/ADR-0008-private-by-default-exposure.md`](adr/ADR-0008-private-by-default-exposure.md)
- [`docs/exposure-posture-contract.md`](exposure-posture-contract.md)
- Snapshot of already-public surfaces:
  [`docs/evidence/reef-railiance-exposure-snapshot-2026-08-15.md`](evidence/reef-railiance-exposure-snapshot-2026-08-15.md)

## Intake: `rail-kubernetes` (cc `railiance-cluster` until the rail owns networking)

Enforce the packet path for rapps on Kubernetes:

- default-deny NetworkPolicy
- ClusterIP as the paved Service
- no public Ingress class unless the rapp has `exposure.posture: public`
  and a grant, the binding is `production-approved`, and the reef has
  granted a public surface
- a rail `exposure: public` is permission to *emit* Ingress for those
  granted bindings, not a blanket public default

Do not define what "production-safe" means. That stays ADR-0006.

Suggested workplan id in the owning repo: a `RAIL-K8S-WP-*` or
`RAILIANCE-WP-*` that cites `RMASTER-WP-0023`.

## Intake: `reef-railiance`

First live admission of the family rule:

- new binds stay `private` (or `operator` only for a named admin path)
- add `exposure` to `declarations/reef.yaml` with substrate grants for
  the snapshot rows that belong on the reef (`80/443` DNS/Ingress
  surface, Nydus `2224`)
- do not take down Forgejo, Coulomb Social, reuse-surface, or Nydus
- do not re-public `6443`

Suggested workplan id: a `REEF-RAILIANCE-WP-*` that cites
`RMASTER-WP-0023`.

## Intake: `railiance-infra`

Host surface for **new** reefs:

- do not open 80/443 until the reef declaration carries a public
  substrate grant
- `6443` stays operator-only (RAIL-HO-WP-0009 / ADR-005). This contract
  is not a way to reopen it
- this is not the rapp admission desk. A rapp that shares Railiance01
  ingress is gated by the rail/reef grants, not by a new S1 UFW rule
  per rapp
- Nydus `2224` stays a named exception, already declared

Suggested workplan id: a `RAIL-HO-WP-*` that cites `RMASTER-WP-0023`.

## Intake: `railiance-enablement`

Templates and paved paths:

- emit private Services and tunnel docs by default
- never emit a public Ingress in a new-rapp or new-rail template
- if a template mentions `exposure`, default the field to `private` or
  omit it (fail-closed)

Suggested workplan id: an enablement workplan that cites
`RMASTER-WP-0023`.