coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
policy-nexus/Makefile

34 lines
964 B
Makefile
Raw Normal View History

Build immutable policy publication artifact
2026-08-18 12:16:04 +02:00
.PHONY: build check currency clean release-build release-check image-build
Take over the renderer; defer controlled disclosure to a risk service The renderer and its stylesheet moved in from the-custodian with a make build target, so T02 generalises something that works rather than starting from scratch. Publication tooling belongs to the repo that owns publication. Disclosure is resolved for now: full public is fine in build mode, where there are no users to expose and no attacker with anything to gain. Recorded as deferred rather than closed, because it stops being true at production - the same blast-radius disclosure that a consumer must read becomes a map once real tenant data exists. Controlled disclosure is deliberately not this repo's job. Publication is about permanence and currency; embargo is about severity, remediation and timing, and building it here would put risk judgement in the repo least qualified to make it. It likely wants a service of its own - a risk-nexus - with this repo as its publication surface rather than its brain. The only cost today is one line in T01: the addressing scheme must not assume every document is public from birth, so that adding an embargo state later is a new status rather than a URL migration. First publication retargeted - the framework relocated to NetKingdom canon and is now tenancy-posture_v0.1, five axes rather than five planes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 15:42:00 +02:00
# Publication targets. Source of truth is always the upstream repo; pages here
# are generated and must never be hand-edited.
Build immutable policy publication artifact
2026-08-18 12:16:04 +02:00
SRC_NETKINGDOM ?= ../net-kingdom
Take over the renderer; defer controlled disclosure to a risk service The renderer and its stylesheet moved in from the-custodian with a make build target, so T02 generalises something that works rather than starting from scratch. Publication tooling belongs to the repo that owns publication. Disclosure is resolved for now: full public is fine in build mode, where there are no users to expose and no attacker with anything to gain. Recorded as deferred rather than closed, because it stops being true at production - the same blast-radius disclosure that a consumer must read becomes a map once real tenant data exists. Controlled disclosure is deliberately not this repo's job. Publication is about permanence and currency; embargo is about severity, remediation and timing, and building it here would put risk judgement in the repo least qualified to make it. It likely wants a service of its own - a risk-nexus - with this repo as its publication surface rather than its brain. The only cost today is one line in T01: the addressing scheme must not assume every document is public from birth, so that adding an embargo state later is a new status rather than a URL migration. First publication retargeted - the framework relocated to NetKingdom canon and is now tenancy-posture_v0.1, five axes rather than five planes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 15:42:00 +02:00
build:
Build immutable policy publication artifact
2026-08-18 12:16:04 +02:00
python3 tools/build_site.py publication.json --output build
check:
python3 -m unittest discover -s tests -p 'test_*.py'
python3 -m py_compile tools/render.py tools/build_site.py tools/check_currency.py tools/verify_release.py
git diff --check
currency:
python3 tools/check_currency.py publication.json
Take over the renderer; defer controlled disclosure to a risk service The renderer and its stylesheet moved in from the-custodian with a make build target, so T02 generalises something that works rather than starting from scratch. Publication tooling belongs to the repo that owns publication. Disclosure is resolved for now: full public is fine in build mode, where there are no users to expose and no attacker with anything to gain. Recorded as deferred rather than closed, because it stops being true at production - the same blast-radius disclosure that a consumer must read becomes a map once real tenant data exists. Controlled disclosure is deliberately not this repo's job. Publication is about permanence and currency; embargo is about severity, remediation and timing, and building it here would put risk judgement in the repo least qualified to make it. It likely wants a service of its own - a risk-nexus - with this repo as its publication surface rather than its brain. The only cost today is one line in T01: the addressing scheme must not assume every document is public from birth, so that adding an embargo state later is a new status rather than a URL migration. First publication retargeted - the framework relocated to NetKingdom canon and is now tenancy-posture_v0.1, five axes rather than five planes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 15:42:00 +02:00
clean:
rm -rf build
Build immutable policy publication artifact
2026-08-18 12:16:04 +02:00
release-check:
python3 tools/verify_release.py build
python3 tools/check_currency.py publication.json
release-build: clean build release-check
image-build: release-check
@test -n "$(IMAGE_REF)" || (echo "IMAGE_REF is required" >&2; exit 2)
docker build \
--file Containerfile \
--target local-artifact \
--build-arg VCS_REVISION=$$(git rev-parse HEAD) \
--tag $(IMAGE_REF) .
Reference in a new issue Copy permalink