Automate policy source freshness and inventory

workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Stand up policy.coulomb.social as the permanent publication surface"
 domain: infotech
 repo: policy-nexus
-status: active
+status: finished
 owner: the-custodian
 topic_slug: policy-nexus
 created: "2026-08-17"
@@ -134,7 +134,7 @@ immutability, lifecycle notices and currency.
 
 ```task
 id: POLICY-NEXUS-WP-0001-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "0b76e184-dcd2-4c12-92e1-49d1f2e0a431"
 ```
@@ -161,10 +161,22 @@ owning repo triggers on merge). Pull is simpler and keeps the direction of
 dependency clean; push is fresher. Recommend pull with a manual trigger, and
 record the choice.
 
-2026-08-18: the explicit pull manifest and exact source-revision recording are
-implemented, and missing or inconsistent sources fail the build. Tenancy
-Posture is the first entry. Enumerating the remaining in-scope canon and ADR
-corpus and connecting scheduled/manual checkout refresh remain open.
+Completed 2026-08-18. The pull model is now explicit and automated. A reviewed
+inventory enumerates 124 committed sources across 21 repositories: one is
+published, 113 await source-owner publication metadata/addressing, eight are
+non-Markdown formats without a renderer, and two are ADR directory indexes.
+The inventory also records the explicit exclusion of `values`, `tpsc`, and
+`projects`. New or removed matching sources fail the audit until their
+disposition is reviewed.
+
+The Forgejo workflow checks out every external source at an exact commit on a
+daily schedule and manual dispatch, records a deterministic source-set digest,
+and fails visibly on fetch, inventory, currency, or release verification
+errors. It publishes an immutable source-set candidate only. Promotion remains
+the separate paired OCI/publication-digest approval owned by
+`rapp-policy-nexus` and `railiance-apps`. Release builds also retain the prior
+generated tree so an unchanged semantic revision cannot acquire rewritten
+immutable provenance when an upstream repository advances for unrelated work.
 
 ### T04 — Deploy to policy.coulomb.social
 
@@ -223,7 +235,8 @@ is quietly out of date is worse than no document.
 
 Completed 2026-08-18 for the published corpus. Pages and the index expose
 review due dates and overdue state; `make currency` exits non-zero for stale or
-undeclared review metadata. Expansion follows T03 automatically.
+undeclared review metadata. The daily source-pull workflow is the delivery
+channel for that failure, and expansion follows the reviewed T03 inventory.
 
 ### T06 — withdrawn