From c3486be3c2dabdc93048f112e693798eebda4a4a Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Thu, 24 Sep 2026 00:57:34 +0200
Subject: [PATCH] RPF-WP-0047 done: bao.coulomb.social serves a trusted static
 notice

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
---
 .../2026-09-24-bao-coulomb-social-notice.json | 29 +++++++++++++++++++
 ...-WP-0047-bao-coulomb-social-notice-page.md | 26 +++++++++++++++--
 2 files changed, 52 insertions(+), 3 deletions(-)
 create mode 100644 docs/evidence/2026-09-24-bao-coulomb-social-notice.json

diff --git a/docs/evidence/2026-09-24-bao-coulomb-social-notice.json b/docs/evidence/2026-09-24-bao-coulomb-social-notice.json
new file mode 100644
index 0000000..80f2d21
--- /dev/null
+++ b/docs/evidence/2026-09-24-bao-coulomb-social-notice.json
@@ -0,0 +1,29 @@
+{
+  "schema": "railiance-platform.public-notice-check.v1",
+  "task": "RPF-WP-0047-T03",
+  "observed_at": "2026-09-23T22:57:11.782829+00:00",
+  "observed_from": "workstation (public internet path)",
+  "tls": {
+    "verify_ok": true,
+    "subject": "CN=bao.coulomb.social",
+    "issuer": "C=US; O=Let's Encrypt; CN=YR2",
+    "expire": "Dec 22 21:56:47 2026 GMT"
+  },
+  "responses": {
+    "/": "200",
+    "/v1/sys/health": "404",
+    "/ui/": "404",
+    "http_redirect": "301 https://bao.coulomb.social/"
+  },
+  "headers": {
+    "hsts": true,
+    "csp_default_none": true,
+    "server_version_disclosed": false
+  },
+  "body": {
+    "notice_present": true,
+    "internal_identifiers_present": [],
+    "login_form_or_redirect": false
+  },
+  "credential_values_emitted": false
+}
diff --git a/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md
index aebbc7a..d8240fa 100644
--- a/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md
+++ b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md
@@ -4,7 +4,7 @@ type: workplan
 title: "bao.coulomb.social: static not-publicly-available page with a trusted certificate"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: railiance-platform
 topic_slug: railiance
 created: "2026-09-24"
@@ -58,7 +58,7 @@ Verified on 2026-09-24:
 
 ```task
 id: RPF-WP-0047-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3af7f95f-4689-547e-90dc-529e65c7b9e2"
 ```
@@ -71,7 +71,7 @@ pinned to `960ed09`. Sync the root by hand to create it, then sync
 
 ```task
 id: RPF-WP-0047-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "26bf3291-e74e-51dd-89e5-c38169d471b0"
 ```
@@ -87,3 +87,23 @@ tell user-engine, railiance-infra (keep the A record) and railiance-master
 
 Delete the `bao-notice` Application with prune. That restores today's state:
 the Traefik default certificate and a 404.
+
+## Execution record — 2026-09-23/24 (founder go-ahead)
+
+- **T02 done.** The root and `bao-notice` were hand-synced; the app is
+  Synced/Healthy.
+- **First issuance returned 502 on the HTTP-01 challenge.** The isolation
+  NetworkPolicy also covered cert-manager's solver pod (port 8089). Fixed by a
+  narrow `bao-notice-acme-solver` policy, Traefik to solver pods on 8089 only,
+  and `bao-notice-tls` was issued.
+- **HSTS added** (`max-age=31536000`, this host only). The single-replica pod
+  swap caused a few seconds of 502 through Traefik.
+- **T03 done.** Checked from the workstation with no `-k`:
+  - Certificate `CN=bao.coulomb.social` from Let's Encrypt, verify ok, expires
+    2026-12-22 (cert-manager renews).
+  - `/` returns 200 with the notice; `/v1/sys/health` and `/ui/` return 404;
+    `http://` returns a 301 to https.
+  - HSTS and CSP `default-src 'none'` are set, and the `Server` header carries
+    no version.
+  - No internal identifiers, form or redirect in the body.
+  - Evidence: `docs/evidence/2026-09-24-bao-coulomb-social-notice.json`.