Automate policy source freshness and inventory

README.md

@@ -28,6 +28,20 @@ make currency
 
 `publication.json` is the explicit source and address registry. A build fails
 closed when a source is unavailable or an immutable revision would change.
+`source-inventory.config.json` defines the bounded canon/ADR discovery scope,
+while `source-inventory.json` records an explicit reviewed disposition for every
+matching source. `make source-audit` fails when a source appears or disappears
+without that review. Working-tree-only files in sibling repos do not affect the
+audit; local checks inspect committed Git trees.
+
+The Forgejo workflow pulls exact `main` revisions for all inventoried source
+repos every day at 04:17 UTC and on manual dispatch. It fails visibly on an
+unavailable source, unreviewed inventory drift, invalid release, or overdue
+published document. Successful runs publish immutable `source-<source-set-digest>`
+candidates and a moving discovery tag, but never deploy them. Production
+promotion remains an explicit review of the registry-resolved OCI digest and
+publication-manifest digest together in `rapp-policy-nexus` and
+`railiance-apps`.
 
 Production publication is split from runtime ownership. This repository builds
 and publishes the immutable OCI site image; `rapp-policy-nexus` owns the Helm