Admit Policy Nexus public binding

WORK-RECORDS.md

@@ -11,7 +11,7 @@
 | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
-| workplan | REEF-RAILIANCE-WP-0004 | ready | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
+| workplan | REEF-RAILIANCE-WP-0004 | active | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
 | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
@@ -26,5 +26,5 @@
 | task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
-| task | REEF-RAILIANCE-WP-0004-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
-| task | REEF-RAILIANCE-WP-0004-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
+| task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |
+| task | REEF-RAILIANCE-WP-0004-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md |

bindings/rapps.yaml

@@ -6,6 +6,15 @@ bound_rapps:
     evidence:
       - ../rapp-qonto/docs/security-and-reliability-gates.md
       - ../rapp-qonto/evidence/live/2026-07-29-railiance01.json
+  - rapp_id: rapp-policy-nexus
+    rail_id: rail-kubernetes
+    readiness_state: production-approved
+    evidence:
+      - ../rapp-policy-nexus/declarations/rapp.yaml
+      - ../rapp-policy-nexus/docs/runtime-contract.md
+      - ../rapp-policy-nexus/bindings/reef-railiance.yaml
+      - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01.json
 notes:
   - The Qonto binding is verified for non-production operation; production approval remains separate.
+  - The policy-nexus binding is approved for production, but the package remains declared until its immutable image is published, deployed, and verified.
   - Add or promote bindings only when the substrate decision is explicit and source-backed.

declarations/reef.yaml

@@ -9,8 +9,6 @@ primary_rail: rail-kubernetes
 hosted_rails:
   - rail-kubernetes
   - rail-knative
-bound_rapps:
-  - rapp-qonto
 current_members:
   - Railiance01
 source_documents:
@@ -24,3 +22,18 @@ compatibility_notes:
   - Railiance01 is the first current member of the grouped home reef.
   - Additional Railiance home servers should join this reef when they share the same substrate boundary.
   - Split the grouped reef later if member lifecycle, access, or workload-placement policy diverges.
+exposure:
+  posture: public
+  grants:
+    - port: 80
+      reason: Public HTTP ingress, ACME challenges, and HTTPS redirects for approved application hostnames
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-infra
+    - port: 443
+      reason: Public TLS ingress for approved application hostnames
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-infra
+    - port: 2224
+      reason: HostEurope Nydus provider agent required by the platform
+      approved_on: "2026-08-15"
+      residual_risk_owner: railiance-infra

workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md

@@ -4,11 +4,11 @@ type: workplan
 title: "File exposure grants; keep new binds private"
 domain: financials
 repo: reef-railiance
-status: ready
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-15"
+updated: "2026-08-18"
 related:
   - RMASTER-WP-0023
   - ADR-0008
@@ -33,7 +33,7 @@ later writes `production-approved`.
 
 ```task
 id: REEF-RAILIANCE-WP-0004-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "52d14311-b1be-4d11-aa75-86042b8ba72b"
 ```
@@ -44,11 +44,16 @@ the snapshot.
 
 **Done when:** the declaration validates and names those surfaces.
 
+Completed 2026-08-18. `declarations/reef.yaml` now records the already-live
+80/443 ingress surface and the Nydus 2224 exception with dated grants and
+residual-risk ownership. The stale hand-maintained `bound_rapps` projection was
+removed; the family validator derives it from rApp declarations.
+
 ## T02 — Route rapp grants
 
 ```task
 id: REEF-RAILIANCE-WP-0004-T02
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d"
 ```
@@ -59,3 +64,8 @@ File or request grants on the owning declarations for
 until the rapps exist.
 
 **Done when:** each snapshot hostname has a grant home.
+
+2026-08-18: the newly approved `policy.coulomb.social` grant has a family home
+in `rapp-policy-nexus`, and its production binding is recorded in
+`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need
+their eventual rApp/layer declaration homes, so this task remains in progress.