[Gerrrt]

Closes #102.

ADR-0008's sensitive tier was tracked by a single line in Decided but not
built — and that line repeated the exact claim the issue exists to correct:
"its two new firewall rules". The count was retired by ADR-0013, and the
additions turned out not to be additions.

What changed in docs/roadmap.md

The tier moves to Infrastructure, beside #95. The two ADR-0008 tiers now
read together, sensitive first, and the entry carries the build's shape: the
nine services, the unmade purchase, and four firewall rules rather than two.
Three of the four are ADR-0016's and are carried by #95 with the hardware,
because a pass to an address with no NAS behind it is untestable. A pointer
stays in Decided but not built so the accepted ADR is still visible there.

The fourth rule was read before being written down. The issue asked for
exactly this. pfctl -sr on morpheus, 2026-09-04, interface tables resolved:

• Winterfell blocks every other VLAN explicitly above its egress pass, and
  Block access to Skids (10.0.99.0/24 → 10.0.20.0/24, id 1760994422) is one
  of them. 99→20 is an insertion above a deny, like the other three — it
  goes beside the two SNMP passes that already sit above that block stack, not
  appended next to Allow internet.
• Skids as a source is untouched: it blocks all five other VLANs, carries TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223's
  tripwire (evaluations 280711, packets 0), then egresses. Return traffic
  for a session Home Assistant opens is carried by state and never reaches the
  ruleset. Skids stops being terminal inbound and stays terminal outbound —
  the same trade ADR-0016 made for CasaBonita, with the same test.
• What the ruleset cannot settle is the rule's width. The other three are
  host- and port-scoped; this one has a source host that does not exist yet and
  a destination that is a whole segment unless the IoT devices get statics. Also
  flagged: Home Assistant discovers over mDNS, which is link-local and does not
  cross a VLAN boundary, so nothing on 20 appears by itself however the pass is
  written.

Two findings the same read turned up

#228's premise is stale, and the roadmap entry now says so. The Hicks tab
was narrowed on 2026-09-02 — the day after ADR-0013 was committed. It now
carries ten host- and port-scoped passes into Winterfell (SSH, the pfSense
management UI, the resolver, NTP, ping, the wiki ×2, Grafana, mjolnir ×2)
above a logged Block access to Winterfell, plus a logged Block access to
LAN, and only then the catch-all. The block is enforcing — 22 packets dropped —
and every pass above it is matching. So:

• Hicks no longer reaches all of Winterfell. ImaginationLAN is the half
  still open; nothing blocks it, and the catch-all still grants it entire.
• Allow Hicks access to ImaginationLAN was recreated on the Hicks
  interface in the same batch. ADR-0013's dead rule is fixed — it matches now,
  and grants nothing the catch-all was not already granting.
• The issue's ordering argument ("the first rule granting that segment a
  destination narrowly and on purpose") no longer holds; ten such rules exist.
  Decide whether Hicks should reach all of Winterfell and ImaginationLAN #228 is still worth settling first, but for position rather than precedent.
• network.md's segment table still says Hicks reaches "Internet, 99, 30",
  which is now wrong in the direction of too wide. Recorded on Decide whether Hicks should reach all of Winterfell and ImaginationLAN #228, not fixed
  here — narrowing the description is Decide whether Hicks should reach all of Winterfell and ImaginationLAN #228's work, not this issue's.

Two of the three orderings the issue asserts have been retired since it was
filed. #67's watcher went to oracle under ADR-0015 and needs no self-hosted
ntfy; #97's host override was never downstream of AdGuard, per ADR-0018 and
ADR-0010. #98 is the one that stands. The entry also names what moving ntfy
in-house does change — the heartbeat's whole value is that it leaves the
house, and an endpoint with no external exposure cannot reach a phone that is
not on the network.

Not done here

No ADR is written or amended (per ADR-0001, ADR-0016's now-stale aside about "a
catch-all nobody wrote" is left as written), no firewall rule is created, and
nothing is bought.

make lint and make check-docs pass.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Documentation-only changes with validated internal links and no apparent formatting or consistency issues in the updated roadmap entries.

Pull request overview

Updates the HomeLab roadmap documentation to more accurately reflect ADR-0008’s “sensitive tier” work items and their concrete prerequisites, and to correct the previously-stated firewall-rule shape/order based on an actual ruleset read.

Changes:

• Rewrites the #228 roadmap entry to record the now-enforcing Winterfell/Hicks rule posture (with dates and observed behavior) and clarify what remains open (ImaginationLAN).
• Moves #102’s roadmap representation into a detailed Infrastructure entry that captures the tier’s service set, purchase dependency, and the four firewall-rule insertions (including the newly-verified 99→20 ordering note).
• Retains a brief “Decided but not built” pointer for #102 that now references the Infrastructure entry rather than repeating the outdated “two rules” claim.

File summaries

File	Description
docs/roadmap.md	Refines roadmap entries for #228 and #102 to reflect the updated firewall reality and the ADR-0008 sensitive-tier work shape, keeping an abbreviated pointer under “Decided but not built”.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.