44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
|
---
|
||
|
|
domain: capabilities
|
||
|
|
repo: policy-nexus
|
||
|
|
updated: "2026-10-19"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Scope
|
||
|
|
|
||
|
|
Policy Nexus publishes estate policy from its owning repositories at stable,
|
||
|
|
versioned addresses. It owns publication and currency; policy content and
|
||
|
|
ratification remain with the source owners (see `INTENT.md`).
|
||
|
|
|
||
|
|
## Provided capabilities
|
||
|
|
|
||
|
|
- Generate policy pages and indexes from `publication.json`, retaining source
|
||
|
|
revision, review status, superseded versions and immutable publication paths.
|
||
|
|
- Inventory canon and ADR sources and detect unpublished or changed source
|
||
|
|
documents with `tools/source_inventory.py` and `tools/check_currency.py`.
|
||
|
|
- Build and verify release artifacts with `make build` and `make release-check`;
|
||
|
|
verify source provenance before publishing a release.
|
||
|
|
- Extract the build-mode authorization rule from the Custodian canon YAML block
|
||
|
|
into `/guardrails/build-mode-change-authorization.json`, with visible lifetime
|
||
|
|
on the generated policy page. `tools/guardrails.py` validates and evaluates the
|
||
|
|
restricted rule format, failing closed for unknown categories and malformed
|
||
|
|
inputs. This is local lane classification, not a runtime authorization token.
|
||
|
|
|
||
|
|
The discovery declaration is
|
||
|
|
`registry/capabilities/capability.security.policy-publication.md`, indexed by
|
||
|
|
`registry/indexes/capabilities.yaml` for reuse-surface consumption. Consumers
|
||
|
|
should use the publication contract in `docs/publication-contract.md` rather
|
||
|
|
than copy policy into this repository.
|
||
|
|
|
||
|
|
## Boundaries and current acceptance
|
||
|
|
|
||
|
|
Policy Nexus does not author or ratify policy, interpret external regulations,
|
||
|
|
implement identity or credential custody, or enforce downstream authorization.
|
||
|
|
Workplans, evidence, runbooks and general documentation are not publication
|
||
|
|
content. Source owners retain control of publication disposition.
|
||
|
|
|
||
|
|
The build-mode guardrail implementation is available as source; public release
|
||
|
|
acceptance remains tracked in `PNEX-WP-0006`. That record requires founder batch
|
||
|
|
publication disposition and resolution of the source inventory gate. Source
|
||
|
|
availability and passing local checks do not establish live publication.
|