chore: narrow Qonto gates and file exposure-grant workplan

WP-0003 only updates the binding. WP-0004 takes the RMASTER-WP-0023
grants. Production approval does not make Qonto public.

workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md

@@ -8,12 +8,24 @@ status: blocked
 owner: codex
 topic_slug: railiance
 created: "2026-07-26"
-updated: "2026-08-08"
+updated: "2026-08-15"
+related:
+  - RAIL-BS-WP-0007
+  - RMASTER-WP-0023
+  - ADR-0006
+  - ADR-0008
 state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
 ---
 
 # REEF-RAILIANCE-WP-0003 - rapp-qonto production gates
 
+This reef records the `rapp-qonto` binding and refuses
+`production-approved` without ADR-0006 evidence. It does not implement
+HA (`RAIL-BS-WP-0007`), Knative packaging (`rapp-qonto`), or public
+listeners. Production approval does not make Qonto public (ADR-0008).
+New binds stay `private`. Exposure grants for already-public surfaces
+are `REEF-RAILIANCE-WP-0004`, not this file.
+
 ## T01 - Verify workload identity and secret delivery
 
 ```task
@@ -131,3 +143,7 @@ absent, proving the service path, restricted egress, identity/secret delivery,
 dependency behavior, and restoration on the surviving cluster. The alternate
 closure remains explicit founder acceptance of the single-node production
 availability risk.
+
+This repo only updates `bindings/rapps.yaml` when those conditions hold.
+Do not implement the three-node topology here. Do not add an exposure
+grant for Qonto as a side effect of `production-approved`.

workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md

@@ -0,0 +1,58 @@
+---
+id: REEF-RAILIANCE-WP-0004
+type: workplan
+title: "File exposure grants; keep new binds private"
+domain: financials
+repo: reef-railiance
+status: ready
+owner: codex
+topic_slug: railiance
+created: "2026-08-15"
+updated: "2026-08-15"
+related:
+  - RMASTER-WP-0023
+  - ADR-0008
+  - REEF-RAILIANCE-WP-0003
+---
+
+# REEF-RAILIANCE-WP-0004 — exposure grants
+
+Intake from `RMASTER-WP-0023-T05`. Snapshot:
+`railiance-master/docs/evidence/reef-railiance-exposure-snapshot-2026-08-15.md`.
+
+## Goal
+
+First live admission of the family rule. New binds stay `private` (or
+`operator` only for a named admin path). Existing public surfaces get
+named grants. Do not take down Forgejo, Coulomb Social, reuse-surface,
+or Nydus. Do not re-public `6443`. Qonto stays private even if WP-0003
+later writes `production-approved`.
+
+## T01 — Add reef exposure grants
+
+```task
+id: REEF-RAILIANCE-WP-0004-T01
+status: todo
+priority: high
+```
+
+Add `exposure` to `declarations/reef.yaml` with substrate grants for the
+80/443 DNS/Ingress surface and Nydus `2224`. Residual-risk owners as in
+the snapshot.
+
+**Done when:** the declaration validates and names those surfaces.
+
+## T02 — Route rapp grants
+
+```task
+id: REEF-RAILIANCE-WP-0004-T02
+status: todo
+priority: medium
+```
+
+File or request grants on the owning declarations for
+`forgejo.coulomb.social`, `app.coulomb.social`, and
+`reuse.coulomb.social`. Layer repos may hold residual-risk ownership
+until the rapps exist.
+
+**Done when:** each snapshot hostname has a grant home.