AGENTS.md: External Exposure Policy (MANDATORY); comfyui_rocm seam retargeted

Every Caddy-proxied service is now either behind the auth chain or
explicitly internal-only, with the provider-first flip procedure codified.
The comfyui GPU-access seam test now asserts the deployed contract
(group_add keep-groups + udev MODE 0666 on kfd/renderD*) instead of the
pre-fix 'video' group assumption.

AGENTS.md

@@ -204,6 +204,34 @@ planning/dispatch. See [serverAppConfigs-docs/Architecture/Testing Policy.md](se
   are the auth mechanism. Headless sudo passes the password via the
   `FRANK_SUDO_PW` environment variable. The value never enters the repo.
 
+
+## External Exposure Policy (MANDATORY)
+
+Every service reverse-proxied through Caddy is either behind the auth chain
+(Anubis :8923 → Authentik embedded outpost) or explicitly designated
+internal-only — no public DNS name, no vhost. New services default to
+internal-only until guarded.
+
+When guarding a new vhost, follow this order — provider first, then route:
+
+1. Create the outpost proxy provider FIRST (`external_host` = the exact vhost
+   URL including trailing slash; `internal_host = http://caddy:8017`). If the
+   vhost flips before the provider exists, authenticated traffic hits the
+   outpost error page instead of the app.
+2. Flip the vhost to `reverse_proxy anubis:8923` with
+   `header_up X-Real-Ip {remote_host}`, and add the post-auth
+   `@<svc> host <vhost>` handler on the `http://:8017` listener routing to the
+   real upstream.
+3. The Anubis guard set, the Caddy TLS edge, and the outpost provider list
+   must stay in lockstep — they change together in one deploy.
+4. Service-to-service traffic (e.g., Alloy → Loki push) targets internal
+   addresses (`loki:3100`), never the public hostname — non-browser clients
+   cannot solve challenges.
+
+Exempt-by-construction categories stay exempt with a documented reason in the
+vhost comment: the IdP itself (`auth.` — its login flow must never sit behind a
+challenge), git smart-HTTP endpoints (git clients cannot solve JS challenges),
+and services with their own complete auth.
 ## Deletion & Trash Policy (MANDATORY)
 
 Never run `rm` to delete files. The command deletes permanently. Move every