The Four Planes — Operator training

Which of these listeners may face the internet? You can answer that without reading a firewall diagram: every goca listener belongs to exactly one plane, and the port tells you which.

Management plane (:8081, console :8085) — CAs, templates, config, identities, audit. Never exposed beyond the management network; the shipped compose bundle publishes it on loopback only.
Issuance plane (:8080) — the machine-facing enrollment surface that registered RAs and the protocol heads call.
Protocol heads (ACME on :8087 today) — standard enrollment protocols served by keyless, database-credential-free processes. Compromising one yields a bounded RA credential, never a CA key.
Validation plane (:8083 CRL/AIA distribution) — what relying parties fetch. Anonymous by nature, secret-free by design. :8084 is the OCSP listener; serving OCSP responses is roadmap — validation is CRL-first today.

Metaphor: an airport — staff corridors (management), check-in desks (issuance and heads), and the arrivals board anyone may read (validation).

Where it breaks: an airport has one security perimeter; here each plane draws its own, and mixing them is the mistake the ports exist to prevent.

Now I can tell from a port number which plane I'm looking at — and who belongs there.