4a664533d3
Add the exposure contract, additive family schema fields, validator checks and fixtures, the reef-railiance exception snapshot, and routed intakes. Enforcement stays in the owning repos.
73 lines
2.6 KiB
Markdown
73 lines
2.6 KiB
Markdown
# Exposure enforcement intakes
|
|
|
|
Date: 2026-08-15
|
|
Source: `RMASTER-WP-0023-T05`
|
|
Back-link: `RMASTER-WP-0023`
|
|
|
|
These are intakes for the owning-repo agents. File a workplan in the
|
|
owning repo. Do not implement the controls from `railiance-master`.
|
|
|
|
Normative reading:
|
|
|
|
- [`docs/adr/ADR-0008-private-by-default-exposure.md`](adr/ADR-0008-private-by-default-exposure.md)
|
|
- [`docs/exposure-posture-contract.md`](exposure-posture-contract.md)
|
|
- Snapshot of already-public surfaces:
|
|
[`docs/evidence/reef-railiance-exposure-snapshot-2026-08-15.md`](evidence/reef-railiance-exposure-snapshot-2026-08-15.md)
|
|
|
|
## Intake: `rail-kubernetes` (cc `railiance-cluster` until the rail owns networking)
|
|
|
|
Enforce the packet path for rapps on Kubernetes:
|
|
|
|
- default-deny NetworkPolicy
|
|
- ClusterIP as the paved Service
|
|
- no public Ingress class unless the rapp has `exposure.posture: public`
|
|
and a grant, the binding is `production-approved`, and the reef has
|
|
granted a public surface
|
|
- a rail `exposure: public` is permission to *emit* Ingress for those
|
|
granted bindings, not a blanket public default
|
|
|
|
Do not define what "production-safe" means. That stays ADR-0006.
|
|
|
|
Suggested workplan id in the owning repo: a `RAIL-K8S-WP-*` or
|
|
`RAILIANCE-WP-*` that cites `RMASTER-WP-0023`.
|
|
|
|
## Intake: `reef-railiance`
|
|
|
|
First live admission of the family rule:
|
|
|
|
- new binds stay `private` (or `operator` only for a named admin path)
|
|
- add `exposure` to `declarations/reef.yaml` with substrate grants for
|
|
the snapshot rows that belong on the reef (`80/443` DNS/Ingress
|
|
surface, Nydus `2224`)
|
|
- do not take down Forgejo, Coulomb Social, reuse-surface, or Nydus
|
|
- do not re-public `6443`
|
|
|
|
Suggested workplan id: a `REEF-RAILIANCE-WP-*` that cites
|
|
`RMASTER-WP-0023`.
|
|
|
|
## Intake: `railiance-infra`
|
|
|
|
Host surface for **new** reefs:
|
|
|
|
- do not open 80/443 until the reef declaration carries a public
|
|
substrate grant
|
|
- `6443` stays operator-only (RAIL-HO-WP-0009 / ADR-005). This contract
|
|
is not a way to reopen it
|
|
- this is not the rapp admission desk. A rapp that shares Railiance01
|
|
ingress is gated by the rail/reef grants, not by a new S1 UFW rule
|
|
per rapp
|
|
- Nydus `2224` stays a named exception, already declared
|
|
|
|
Suggested workplan id: a `RAIL-HO-WP-*` that cites `RMASTER-WP-0023`.
|
|
|
|
## Intake: `railiance-enablement`
|
|
|
|
Templates and paved paths:
|
|
|
|
- emit private Services and tunnel docs by default
|
|
- never emit a public Ingress in a new-rapp or new-rail template
|
|
- if a template mentions `exposure`, default the field to `private` or
|
|
omit it (fail-closed)
|
|
|
|
Suggested workplan id: an enablement workplan that cites
|
|
`RMASTER-WP-0023`.
|