Admit Policy Nexus public binding

workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md

@@ -4,11 +4,11 @@ type: workplan
 title: "File exposure grants; keep new binds private"
 domain: financials
 repo: reef-railiance
-status: ready
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-15"
+updated: "2026-08-18"
 related:
   - RMASTER-WP-0023
   - ADR-0008
@@ -33,7 +33,7 @@ later writes `production-approved`.
 
 ```task
 id: REEF-RAILIANCE-WP-0004-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "52d14311-b1be-4d11-aa75-86042b8ba72b"
 ```
@@ -44,11 +44,16 @@ the snapshot.
 
 **Done when:** the declaration validates and names those surfaces.
 
+Completed 2026-08-18. `declarations/reef.yaml` now records the already-live
+80/443 ingress surface and the Nydus 2224 exception with dated grants and
+residual-risk ownership. The stale hand-maintained `bound_rapps` projection was
+removed; the family validator derives it from rApp declarations.
+
 ## T02 — Route rapp grants
 
 ```task
 id: REEF-RAILIANCE-WP-0004-T02
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d"
 ```
@@ -59,3 +64,8 @@ File or request grants on the owning declarations for
 until the rapps exist.
 
 **Done when:** each snapshot hostname has a grant home.
+
+2026-08-18: the newly approved `policy.coulomb.social` grant has a family home
+in `rapp-policy-nexus`, and its production binding is recorded in
+`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need
+their eventual rApp/layer declaration homes, so this task remains in progress.