Finalize reef exposure grants

WORK-RECORDS.md

@@ -11,7 +11,7 @@
 | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
-| workplan | REEF-RAILIANCE-WP-0004 | active | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
+| workplan | REEF-RAILIANCE-WP-0004 | finished | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
 | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
@@ -27,4 +27,4 @@
 | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
-| task | REEF-RAILIANCE-WP-0004-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
+| task | REEF-RAILIANCE-WP-0004-T02 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |

declarations/reef.yaml

@@ -37,3 +37,15 @@ exposure:
       reason: HostEurope Nydus provider agent required by the platform
       approved_on: "2026-08-15"
       residual_risk_owner: railiance-infra
+    - hostname: forgejo.coulomb.social
+      reason: Canonical git forge, OCI registry, and npm registry for the estate
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-infra
+    - hostname: app.coulomb.social
+      reason: Public Coulomb Social web application on Railiance01
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-apps
+    - hostname: reuse.coulomb.social
+      reason: Public federation and reuse landing surface on Railiance01
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-apps

workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md

@@ -4,11 +4,15 @@ type: workplan
 title: "File exposure grants; keep new binds private"
 domain: financials
 repo: reef-railiance
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-18"
+updated: "2026-08-21"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-21"
+quality_dod_by: codex
+quality_dod_note: "Both tasks are done; declaration validation, tests, owner routing, and State Hub reconciliation passed."
 related:
   - RMASTER-WP-0023
   - ADR-0008
@@ -53,7 +57,7 @@ removed; the family validator derives it from rApp declarations.
 
 ```task
 id: REEF-RAILIANCE-WP-0004-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d"
 ```
@@ -65,7 +69,26 @@ until the rapps exist.
 
 **Done when:** each snapshot hostname has a grant home.
 
-2026-08-18: the newly approved `policy.coulomb.social` grant has a family home
-in `rapp-policy-nexus`, and its production binding is recorded in
-`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need
-their eventual rApp/layer declaration homes, so this task remains in progress.
+Completed 2026-08-21. The three pre-existing snapshot hostnames now have exact,
+dated grants in `declarations/reef.yaml`, which is their living substrate and
+public-DNS grant home while their family rApps do not yet exist. Residual-risk
+ownership remains with `railiance-infra` for `forgejo.coulomb.social` and with
+`railiance-apps` for `app.coulomb.social` and `reuse.coulomb.social`, matching
+the source snapshot. When those workloads gain `rapp-*` declarations, each
+public rApp must also carry its own binding grant before the reef-level grants
+can be treated as sufficient for that family declaration.
+
+The handoff is routed to `railiance-infra` in State Hub message
+`2438f29d-f9e0-4e58-bbbe-cd8445a7ae14` and to `railiance-apps` in message
+`85f0a3c7-306c-4a58-ab3b-9c847d3b11b1`.
+
+The separately approved `policy.coulomb.social` grant already has its family
+home in `rapp-policy-nexus`, and its production binding is recorded in
+`bindings/rapps.yaml`.
+
+## Outcome
+
+Finished 2026-08-21. Every public surface in the 2026-08-15 snapshot now has a
+living, source-backed grant: ports 80, 443, and 2224 plus the exact Forgejo,
+Coulomb Social, and reuse hostnames. New bindings remain private by default,
+and no grant was added for port 6443 or Qonto.