nexxo 9e485efe87 Write the firewall's running order into the plan, not just the commit ... The previous commit moved the nftables lockdown out of Task 5 and explained why in its message. A commit message is not where the next person looks. Task 5 now carries it: the bridge is normally already there because the ISO installer writes it, the lockdown belongs in Task 9 because SecureHostFirewall ran last for a reason, and "check from outside" cannot mean what it says before the tunnel exists — so the script checks inside-out and says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-07-30 20:06:48 +02:00
..
plans	Write the firewall's running order into the plan, not just the commit	2026-07-30 20:06:48 +02:00
specs	Write down the network boundary, the subdomain, and two decided follow-ups	2026-07-30 19:05:23 +02:00