From 721398125ba24bba59de0c7ac0d28327aac3afa2 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 21 Aug 2026 01:35:28 +0200 Subject: [PATCH] Finalize reef exposure grants --- WORK-RECORDS.md | 4 +- declarations/reef.yaml | 12 ++++++ .../REEF-RAILIANCE-WP-0004-exposure-grants.md | 37 +++++++++++++++---- 3 files changed, 44 insertions(+), 9 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e7d4d67..8dcd28f 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| workplan | REEF-RAILIANCE-WP-0004 | active | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| workplan | REEF-RAILIANCE-WP-0004 | finished | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -27,4 +27,4 @@ | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | -| task | REEF-RAILIANCE-WP-0004-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0004-T02 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | diff --git a/declarations/reef.yaml b/declarations/reef.yaml index 76724ce..86d7499 100644 --- a/declarations/reef.yaml +++ b/declarations/reef.yaml @@ -37,3 +37,15 @@ exposure: reason: HostEurope Nydus provider agent required by the platform approved_on: "2026-08-15" residual_risk_owner: railiance-infra + - hostname: forgejo.coulomb.social + reason: Canonical git forge, OCI registry, and npm registry for the estate + approved_on: "2026-08-15" + residual_risk_owner: railiance-infra + - hostname: app.coulomb.social + reason: Public Coulomb Social web application on Railiance01 + approved_on: "2026-08-15" + residual_risk_owner: railiance-apps + - hostname: reuse.coulomb.social + reason: Public federation and reuse landing surface on Railiance01 + approved_on: "2026-08-15" + residual_risk_owner: railiance-apps diff --git a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md index 83a2c43..669235e 100644 --- a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md +++ b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md @@ -4,11 +4,15 @@ type: workplan title: "File exposure grants; keep new binds private" domain: financials repo: reef-railiance -status: active +status: finished owner: codex topic_slug: railiance created: "2026-08-15" -updated: "2026-08-18" +updated: "2026-08-21" +quality_dod: DoD-Ok +quality_dod_at: "2026-08-21" +quality_dod_by: codex +quality_dod_note: "Both tasks are done; declaration validation, tests, owner routing, and State Hub reconciliation passed." related: - RMASTER-WP-0023 - ADR-0008 @@ -53,7 +57,7 @@ removed; the family validator derives it from rApp declarations. ```task id: REEF-RAILIANCE-WP-0004-T02 -status: progress +status: done priority: medium state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d" ``` @@ -65,7 +69,26 @@ until the rapps exist. **Done when:** each snapshot hostname has a grant home. -2026-08-18: the newly approved `policy.coulomb.social` grant has a family home -in `rapp-policy-nexus`, and its production binding is recorded in -`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need -their eventual rApp/layer declaration homes, so this task remains in progress. +Completed 2026-08-21. The three pre-existing snapshot hostnames now have exact, +dated grants in `declarations/reef.yaml`, which is their living substrate and +public-DNS grant home while their family rApps do not yet exist. Residual-risk +ownership remains with `railiance-infra` for `forgejo.coulomb.social` and with +`railiance-apps` for `app.coulomb.social` and `reuse.coulomb.social`, matching +the source snapshot. When those workloads gain `rapp-*` declarations, each +public rApp must also carry its own binding grant before the reef-level grants +can be treated as sufficient for that family declaration. + +The handoff is routed to `railiance-infra` in State Hub message +`2438f29d-f9e0-4e58-bbbe-cd8445a7ae14` and to `railiance-apps` in message +`85f0a3c7-306c-4a58-ab3b-9c847d3b11b1`. + +The separately approved `policy.coulomb.social` grant already has its family +home in `rapp-policy-nexus`, and its production binding is recorded in +`bindings/rapps.yaml`. + +## Outcome + +Finished 2026-08-21. Every public surface in the 2026-08-15 snapshot now has a +living, source-backed grant: ports 80, 443, and 2224 plus the exact Forgejo, +Coulomb Social, and reuse hostnames. New bindings remain private by default, +and no grant was added for port 6443 or Qonto.