chore(spec): adopt the spec sync: registry parity and ADR cross-references

Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the
L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the
amended requirements. Point the VPN egress docs at ADR-0020; the drafted
"ADR-0016" number went to the Cloudflare Tunnel.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

conformance/requirements/registry.yaml

@@ -120,6 +120,14 @@ requirements:
     doc: docs/09-dns-and-ingress.md
     safety_critical: false
     summary: "Internal clients resolve to the internal Gateway (split-horizon)."
+  - id: R-DNS-04
+    doc: docs/09-dns-and-ingress.md
+    safety_critical: false
+    summary: "Public HTTP(S) reachable with no inbound 80/443 forward; LAN works whichever resolver answers."
+  - id: R-DNS-05
+    doc: docs/09-dns-and-ingress.md
+    safety_critical: false
+    summary: "Only declared-public names reachable through public ingress; LAN/VPN-only names are refused."
 
   # --- Automated updates ---
   - id: R-UPD-01
@@ -129,7 +137,7 @@ requirements:
   - id: R-UPD-02
     doc: docs/11-automated-updates.md
     safety_critical: true
-    summary: "Updates need no human/AI/hand-authored change; bad update auto-rolls-back."
+    summary: "Allowed-class updates need no human/AI/hand-authored change; bad update auto-rolls-back."
   - id: R-UPD-03
     doc: docs/11-automated-updates.md
     safety_critical: false
@@ -175,15 +183,15 @@ requirements:
   - id: R-ENV-01
     doc: docs/02-environments-and-provisioning.md
     safety_critical: false
-    summary: "dev/test provisioned as local KVMs via IaC (create/baseline/rebuild)."
+    summary: "Nodes baselined, cluster-joined and managed as code; bare-metal imaging is checklist-driven."
   - id: R-ENV-02
     doc: docs/02-environments-and-provisioning.md
     safety_critical: false
-    summary: "Same GitOps config promotes dev/test -> prod (authored once)."
+    summary: "GitOps config authored once as base plus overlay; a future environment needs overrides only."
   - id: R-ENV-03
     doc: docs/02-environments-and-provisioning.md
     safety_critical: false
-    summary: "prod is 3x mini-PC bare-metal k3s with local storage."
+    summary: "Production is 3x mini-PC bare metal; changes reach it only through the PR gate and Flux."
 
   # --- GitOps & delivery ---
   - id: R-GITOPS-01
@@ -212,6 +220,10 @@ requirements:
     doc: docs/07-security-and-secrets.md
     safety_critical: false
     summary: "All security properties demonstrable/auditable."
+  - id: R-SEC-04
+    doc: docs/07-security-and-secrets.md
+    safety_critical: false
+    summary: "Kubernetes API not reachable from the public internet by any path; LAN/VPN-only."
 
   # --- Identity & access ---
   - id: R-IDP-01

conformance/tests/l0-static/cloudflared-ingress-rules/chainsaw-test.yaml

@@ -22,8 +22,11 @@ metadata:
   labels:
     conformance.home.k3s/R-NET-01: "true"
     conformance.home.k3s/R-NET-02: "true"
+    conformance.home.k3s/R-DNS-04: "true"
+    conformance.home.k3s/R-DNS-05: "true"
+    conformance.home.k3s/R-SEC-04: "true"
   annotations:
-    conformance.home.k3s/requirements: "R-NET-01, R-NET-02"
+    conformance.home.k3s/requirements: "R-NET-01, R-NET-02, R-DNS-04, R-DNS-05, R-SEC-04"
     conformance.home.k3s/layer: "L0"
     conformance.home.k3s/scope: "whole-repo"
     conformance.home.k3s/safety-critical: "true"

conformance/tests/l0-static/internal-services-publish-no-public-dns/chainsaw-test.yaml

@@ -105,8 +105,9 @@ metadata:
   labels:
     conformance.home.k3s/R-DNS-02: "true"
     conformance.home.k3s/R-DNS-03: "true"
+    conformance.home.k3s/R-DNS-05: "true"
   annotations:
-    conformance.home.k3s/requirements: "R-DNS-02, R-DNS-03"
+    conformance.home.k3s/requirements: "R-DNS-02, R-DNS-03, R-DNS-05"
     conformance.home.k3s/layer: "L0"
     # WHOLE-REPO SCOPE — this invariant quantifies over every ServiceDefinition in catalog/, every
     # HTTPRoute in apps/wave-* and platform/* and runbooks/, and every external-dns-annotated

conformance/tests/l0-static/pihole-lan-names/chainsaw-test.yaml

@@ -20,8 +20,9 @@ metadata:
   name: pihole-lan-names
   labels:
     conformance.home.k3s/R-DNS-03: "true"
+    conformance.home.k3s/R-DNS-04: "true"
   annotations:
-    conformance.home.k3s/requirements: "R-DNS-03"
+    conformance.home.k3s/requirements: "R-DNS-03, R-DNS-04"
     conformance.home.k3s/layer: "L0"
     conformance.home.k3s/scope: "whole-repo"
     conformance.home.k3s/safety-critical: "true"