From 3ef4a35284a87fb46c971d2e0577d41603514754 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Thu, 24 Sep 2026 00:52:26 +0200
Subject: [PATCH] RPF-WP-0047: workplan and railiance01 Application (pinned
 960ed09)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
---
 .../applications/bao-notice.application.yaml  | 26 ++++++
 ...-WP-0047-bao-coulomb-social-notice-page.md | 85 +++++++++++++++++++
 2 files changed, 111 insertions(+)
 create mode 100644 argocd/railiance01/applications/bao-notice.application.yaml
 create mode 100644 workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md

diff --git a/argocd/railiance01/applications/bao-notice.application.yaml b/argocd/railiance01/applications/bao-notice.application.yaml
new file mode 100644
index 0000000..7d9f375
--- /dev/null
+++ b/argocd/railiance01/applications/bao-notice.application.yaml
@@ -0,0 +1,26 @@
+# railiance01 child Application (RPF-WP-0047, founder request 2026-09-23 via
+# user-engine 7d8982c2). Static notice only; OpenBao stays non-public.
+# No automated sync, no finalizer; targetRevision is the reviewed commit.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bao-notice
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: public-notice
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: railiance-tenants
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: 960ed0914f9e1ca3d51989d6e51a8fe6b5248b76
+    path: argocd/platform-addons/bao-notice
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: bao-notice
+  syncPolicy:
+    syncOptions:
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true
diff --git a/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md
new file mode 100644
index 0000000..845bae3
--- /dev/null
+++ b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md
@@ -0,0 +1,85 @@
+---
+id: RPF-WP-0047
+type: workplan
+title: "bao.coulomb.social: static not-publicly-available page with a trusted certificate"
+domain: financials
+repo: railiance-platform
+status: active
+owner: railiance-platform
+topic_slug: railiance
+created: "2026-09-24"
+updated: "2026-09-24"
+related: [RPF-WP-0025, RMASTER-WP-0020]
+---
+
+## Why
+
+The founder decided on 2026-09-23 (relayed by user-engine, hub message
+`7d8982c2`) that OpenBao stays non-public. The RMASTER-WP-0020-T09 /
+RPF-WP-0025-T03 retraction stands. But the published name must not present a
+self-signed Traefik certificate and a bare 404. **Requested end state:** a
+static page saying the resource is not publicly available, over a trusted
+certificate. It names no internal host, port, tunnel or version, offers no
+login form or redirect, and proxies nothing to OpenBao. This reverses the DNS
+withdrawal handed to railiance-infra on 2026-09-22; a hold was sent
+(`a4bca724`). A static notice is not an exposure grant under ADR-0008.
+
+## T01 Build the page and manifests
+
+```task
+id: RPF-WP-0047-T01
+status: done
+priority: high
+```
+
+`argocd/platform-addons/bao-notice/` holds:
+
+- A namespace `bao-notice` with a NetworkPolicy: ingress only from Traefik
+  (kube-system) on 8080, no egress at all, so there is no path to OpenBao.
+- Nginx `nginxinc/nginx-unprivileged` pinned by digest (already running in
+  the cluster), running non-root with a read-only root filesystem and all
+  capabilities dropped.
+- `/` returns 200 with the notice. Every other path returns 404 with the same
+  notice, so a probe of `/v1/sys/health` is never a false 200.
+- `server_tokens off`, CSP `default-src 'none'`, `noindex`, `no-store`.
+- An Ingress on `websecure` with `letsencrypt-prod`, and an HTTP→HTTPS
+  redirect at priority 1, so ACME HTTP-01 still wins.
+
+Verified on 2026-09-24:
+- Local container probe: `/` 200, `/v1/sys/health` and `/ui/` 404 with the
+  notice, `Server: nginx` with no version.
+- Server-side dry run on railiance01: all eight objects valid.
+- No existing Ingress claims the host.
+- The `railiance-tenants` AppProject already whitelists every kind.
+
+## T02 Adopt through ArgoCD (live, founder go-ahead)
+
+```task
+id: RPF-WP-0047-T02
+status: todo
+priority: high
+```
+
+The Application is `argocd/railiance01/applications/bao-notice.application.yaml`,
+pinned to `960ed09`. Sync the root by hand to create it, then sync
+`bao-notice` by hand. cert-manager issues `bao-notice-tls` over HTTP-01.
+
+## T03 Verify from outside and close the loop
+
+```task
+id: RPF-WP-0047-T03
+status: todo
+priority: high
+```
+
+From the workstation: `curl -sv https://bao.coulomb.social/` must show a
+trusted chain with no `-k`, HTTP 200 and the notice.
+`https://bao.coulomb.social/v1/sys/health` must return 404, and
+`http://bao.coulomb.social/` must redirect to https. Record the evidence, then
+tell user-engine, railiance-infra (keep the A record) and railiance-master
+(T09 posture unchanged).
+
+## Rollback
+
+Delete the `bao-notice` Application with prune. That restores today's state:
+the Traefik default certificate and a 404.