coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Park the BYOD / inner-zone access tension as an open question.
All checks were successful
CI Smoke / host-smoke (push) Successful in 2s
Details
CI Smoke / container-smoke (push) Successful in 11s
Details

Browse source 
Raised by the founder from the bao.coulomb.social retraction: ADR-0008's
operator posture assumes a company-network-shaped device, which this estate
does not have. Written down, not solved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-09-23 22:30:12 +02:00
parent edb95db8fe
commit a3e85d766d
2 changed files with 65 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/agent-environment-orientation.md
View file

@ -31,7 +31,7 @@ Services are private by default (railiance-master ADR-0008) and are reached thro
| OpenBao | `http://127.0.0.1:18200` (in-cluster: `openbao.openbao.svc:8200`) | `openbao-ui-railiance01` |
| k3s API | `https://127.0.0.1:16444` (`~/.kube/config` → `config-railiance01`) | `k3s-api-railiance01` |
**Retired name:** `bao.coulomb.social` is **retired**, not a trap to work around. Its public Ingress was retracted on 2026-09-15 (railiance-master RMASTER-WP-0020-T09); the self-signed Traefik cert and the 404 are leftovers of a dangling DNS record, and DNS withdrawal sits with railiance-infra. No certificate or route will be restored (railiance-platform RPF-WP-0025-T03). Operators use the tunnel `http://127.0.0.1:18200`, which `~/.bashrc` has exported as `BAO_ADDR`/`VAULT_ADDR` since 2026-09-22; workloads use `openbao.openbao.svc:8200`. A shell opened before that change still needs the prefix.
**Retired name:** `bao.coulomb.social` is **retired**, not a trap to work around. Its public Ingress was retracted on 2026-09-15 (railiance-master RMASTER-WP-0020-T09); the self-signed Traefik cert and the 404 are leftovers of a dangling DNS record, and DNS withdrawal sits with railiance-infra. No certificate or route will be restored (railiance-platform RPF-WP-0025-T03). Operators use the tunnel `http://127.0.0.1:18200`, which `~/.bashrc` has exported as `BAO_ADDR`/`VAULT_ADDR` since 2026-09-22; workloads use `openbao.openbao.svc:8200`. A shell opened before that change still needs the prefix. Whether operators should be able to reach management surfaces at all from a device without an SSH certificate is an open question, parked in [`inner-zone-access-without-a-company-network.md`](inner-zone-access-without-a-company-network.md).
## 3. Permissions and the agent harness (Claude Code)