coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-master/docs/exposure-enforcement-intakes.md
codex 4a664533d3 feat: implement RMASTER-WP-0023 private-by-default exposure 
Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.
2026-08-15 20:08:37 +02:00

2.6 KiB
Raw Blame History

Exposure enforcement intakes

Date: 2026-08-15 Source: RMASTER-WP-0023-T05 Back-link: RMASTER-WP-0023

These are intakes for the owning-repo agents. File a workplan in the owning repo. Do not implement the controls from railiance-master.

Normative reading:

Intake: rail-kubernetes (cc railiance-cluster until the rail owns networking)

Enforce the packet path for rapps on Kubernetes:

  • default-deny NetworkPolicy
  • ClusterIP as the paved Service
  • no public Ingress class unless the rapp has exposure.posture: public and a grant, the binding is production-approved, and the reef has granted a public surface
  • a rail exposure: public is permission to emit Ingress for those granted bindings, not a blanket public default

Do not define what "production-safe" means. That stays ADR-0006.

Suggested workplan id in the owning repo: a RAIL-K8S-WP-* or RAILIANCE-WP-* that cites RMASTER-WP-0023.

Intake: reef-railiance

First live admission of the family rule:

  • new binds stay private (or operator only for a named admin path)
  • add exposure to declarations/reef.yaml with substrate grants for the snapshot rows that belong on the reef (80/443 DNS/Ingress surface, Nydus 2224)
  • do not take down Forgejo, Coulomb Social, reuse-surface, or Nydus
  • do not re-public 6443

Suggested workplan id: a REEF-RAILIANCE-WP-* that cites RMASTER-WP-0023.

Intake: railiance-infra

Host surface for new reefs:

  • do not open 80/443 until the reef declaration carries a public substrate grant
  • 6443 stays operator-only (RAIL-HO-WP-0009 / ADR-005). This contract is not a way to reopen it
  • this is not the rapp admission desk. A rapp that shares Railiance01 ingress is gated by the rail/reef grants, not by a new S1 UFW rule per rapp
  • Nydus 2224 stays a named exception, already declared

Suggested workplan id: a RAIL-HO-WP-* that cites RMASTER-WP-0023.

Intake: railiance-enablement

Templates and paved paths:

  • emit private Services and tunnel docs by default
  • never emit a public Ingress in a new-rapp or new-rail template
  • if a template mentions exposure, default the field to private or omit it (fail-closed)

Suggested workplan id: an enablement workplan that cites RMASTER-WP-0023.