T04 done, and the answer changes the order. Item 10 was scored size 5 as a
greenfield build. It is not. railiance-infra already has a Goss baseline suite,
an ansible runner, a make verify target that runs it against all hosts and
commits TAP reports to git, and an evidence trail in reports/. The mechanism is
built and wired.
Two things are wrong with it and neither is a build. Nothing runs it - the last
TAP report is dated 2026-03-09, five months ago. And its firewall assertion
matches /6443\/tcp.*ALLOW/, which asserts the port is allowed but not from
whom - it passes identically whether 6443 is restricted to one operator address
or open to the internet, which is exactly the drift that went undetected. It
would however have caught the other finding, since it asserts Status: active and
UFW is inactive on CoulombCore.
Rescoped into slices: 10a (run it, tighten the assertion) is size 1-2 and rises
to WSJF 12.0, fourth overall and the highest-value item after the ratifications.
10b (schedule + alert path) is 7.0. Names the shared dependency - 10b and 9b are
the same plumbing, and building either of 9 or 10 without it produces logs
nobody reads.
The lesson recorded: the gap analysis correctly identified no-conformance-loop
as a capability gap, but the capability was two-thirds built and abandoned.
Before sizing a gap as a build, check whether it is actually an abandonment.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
efa39587e3