policy-nexus/workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md

---
id: POLICY-NEXUS-WP-0001
type: workplan
title: "Stand up policy.coulomb.social as the permanent publication surface"
domain: government
repo: policy-nexus
status: proposed
owner: unassigned
topic_slug: policy-nexus
created: "2026-08-17"
updated: "2026-08-17"
---

# POLICY-NEXUS-WP-0001 — permanent publication surface

## Goal

Replace disposable artifact-page publication with permanent infrastructure at
`policy.coulomb.social` that keeps policy **available**, **addressable**,
**current**, and **honest about its own staleness**.

Done means: a governing document lives in its owning repo, is published
automatically, keeps its URL, shows its status and review date, retains its
superseded versions, and can be reached by someone outside the estate.

## The forcing case

Custodian ADR-008 (*Tenancy Posture*, draft-4) needs review from six repos —
`tenant-engine`, `flex-auth`, `rapp-postgres`, `railiance-platform`,
`adaptive-pricing`, `audit-core`. It is currently served from a private,
disposable artifact URL. Routing a document that governs six repos to a link
that may not resolve later is the problem this workplan exists to end.

ADR-008 is therefore the first publication and the acceptance test. If the site
cannot carry it correctly — five ladders, a threat matrix, an E×P grid, twelve
owner-attributed open questions — the site is not finished.

## Existing structure this workplan must respect

**The renderer already exists in prototype.**
`the-custodian/tools/render-artifact.py` generates the ADR-008 page from canon
markdown: stdlib only, no dependency tree, recognising conventions already
present in the document rather than requiring extra markup. It was written
because the page and the ADR had diverged. **Take it over and generalise it; do
not reimplement it.** Its companion `tools/artifact-style.css` carries the
design system.

**Source of truth stays upstream.** Canon lives in `the-custodian/canon`;
per-repo ADRs live in their own repos. This repo reads and never writes back.
A publication surface with write authority is a second source of truth, and the
estate has a standing rule against that.

**The adoption stance applies** (ADR-008 §14): adopt published standards and
structural patterns; build tooling ground-up unless it is an established
industry standard with broad application. A static-site generator with a
plugin ecosystem is exactly what this rule excludes.

**Platform packages are consumed, not rebuilt.** TLS, DNS, ingress, and any
credential come from the existing platform. If this repo needs storage it is a
`rapp-postgres` consumer and declares a posture vector like anyone else.

## Non-goals

- No editing surface. No CMS, no browser drafting, no comments.
- No ratification workflow. The site may *show* that a draft is in flight and
  for how long; advancing it is a canon-process decision.
- No authentication in this workplan. Everything published here is
  public-by-intent; anything that is not does not belong on this surface.
- No search index in this workplan. Deferred until there is enough content for
  search to beat a good index page.

## Tasks

### T01 — Addressing scheme and permanence contract

Decide, once, how a document maps to a URL, and write down what the estate is
promising about that URL.

- URL shape for a document, and for a specific revision of it.
- What happens on supersession: the old URL keeps resolving and gains a
  superseded banner pointing forward.
- What happens on withdrawal: distinguish *withdrawn* (kept, marked) from
  *deleted* (does not happen).
- Where the version history lives, given the source is git in another repo.
- The commitment being made — a URL published here is expected to resolve
  indefinitely, and what would have to happen for that to be broken.

**Output:** `docs/adr/ADR-0001-addressing-and-permanence.md`.

**Why first:** everything downstream bakes in the answer, and changing it later
breaks the one promise the repo exists to make.

### T02 — Generalise the renderer

Move `render-artifact.py` and `artifact-style.css` in, and lift them from
one-document to many.

- Multi-document: a manifest of sources rather than one path argument.
- Front-matter driven: title, status, revision, review date, owner from the
  source document rather than from command-line flags.
- Index generation: a landing page listing documents with status and currency.
- Keep the convention recognisers (level ladders, threat matrix, E×P grid,
  evidence chips, section rail) and keep it stdlib-only.
- Keep the "generated from canon — do not edit" marker on every page.

**Acceptance:** ADR-008 renders byte-identically in substance to the current
generated page, plus an index entry.

### T03 — Source ingestion

Define how a document gets from its owning repo to this one.

- Manifest format: source repo, path, publication URL, owner.
- Fetch mechanism for documents in other repositories, and how a fetch failure
  is surfaced rather than silently serving stale content.
- Determinism: the same source commit must produce the same page.
- Record the source commit on the published page, so a reader can tell exactly
  what was rendered.

**Open decision for T03:** pull (this repo fetches on a schedule) or push (the
owning repo triggers on merge). Pull is simpler and keeps the direction of
dependency clean; push is fresher. Recommend pull with a manual trigger, and
record the choice.

### T04 — Deploy to policy.coulomb.social

- DNS, TLS, ingress via the existing platform packages.
- Static hosting — the output is static files by construction, so the serving
  layer should be the least interesting part of this workplan.
- Availability expectation stated plainly, with the honest caveat that a
  single-node rail gives restart recovery, not high availability. Do not claim
  an SLA the substrate cannot support.
- Rollback: republishing a previous build must be a single command.
- Smoke check after every deploy: the index resolves, ADR-008 resolves, and a
  known superseded URL still resolves.

### T05 — Currency and staleness

The relevance half of the repo's purpose. A permanently available document that
is quietly out of date is worse than no document.

- Every page shows status, revision, and last-reviewed date.
- A review interval per document, and a visible marker once exceeded.
- A report of documents past review, and where it is delivered.
- Drafts show how long they have been in flight. The
  `shared-platform-relational-storage_v0.1` draft has been routed and
  unratified since 2026-08-10; that fact should be visible on the site, because
  invisibility is precisely why it stalled.

### T06 — External policy intake

The information-gathering half. Deliberately last: the publication path must
work before a second content type is added.

- A record format for an external policy finding: what, source URL, date
  retrieved, jurisdiction, which internal decision it bears on, and who
  recorded it.
- Where records live and how they are published.
- The staleness question, which is sharper here than for internal documents:
  external policy changes without telling us. A record must carry its retrieval
  date prominently and be treated as a snapshot, never as current law.
- **A hard rule to write into the format:** a gathered record states what a
  source says and when it said it. It does not state what the estate must
  therefore do. That interpretation belongs to the repo making the decision.

**Worked example available:** the ADR-008 retention research already holds one
of these — whether key destruction satisfies an erasure obligation, where data
protection authorities have accepted it under conditions and the EDPB has not
formally endorsed it. That is exactly a finding that is true today, may not be
in a year, and must never be recorded as settled.

## Sequencing

T01 gates everything. T02 and T03 can proceed in parallel once addressing is
fixed. T04 needs both. T05 is additive. T06 is deliberately last.

The temporary artifact URL for ADR-008 stays live until T04 passes its smoke
check, and the review is routed to the permanent URL, not before.

## Risks

**This repo becomes a second source of truth.** The likeliest failure and the
most damaging. Mitigation: no editing surface, generated pages carry a
do-not-edit marker, and the manifest records the source commit for every page.

**Permanence is promised before it can be delivered.** A URL committed to in
T01 and broken in year two is worse than never having promised. Mitigation:
T01 states what would break the promise, and T04 declines to claim an
availability level the single-node rail cannot support.

**Scope drift toward a CMS.** Every publication surface attracts requests for
editing, comments, and workflow. Mitigation: the non-goals above are part of
the workplan, not a preface to it.

**The renderer grows a dependency tree.** The moment it needs a framework, it
becomes something only CI can run. Mitigation: stdlib-only is an acceptance
criterion on T02, not a preference.

## Open questions for the operator

1. **Owner.** This workplan is `unassigned`. It spans infrastructure and canon
   process and does not obviously belong to an existing repo's agent.
2. **Public by default?** INTENT assumes everything on this surface is
   public-by-intent. Confirm that no estate policy is sensitive enough to need
   an authenticated tier — if any is, that changes T04 substantially.
3. **Scope of "policy".** Canon and ADRs are clearly in. Are workplans,
   decision records, and evidence in scope, or is this a policy site rather
   than a general documentation site? Recommend starting narrow — canon and
   ADRs only — and widening on demand.
4. **Government policy scope** (T06). The README describes convergence for
   *government* policies. Is the intake scoped to regulation bearing on the
   estate, or is a broader public-interest corpus intended? These are very
   different repos, and T06 cannot be specified until this is answered.