Take over the renderer; defer controlled disclosure to a risk service

The renderer and its stylesheet moved in from the-custodian with a make build
target, so T02 generalises something that works rather than starting from
scratch. Publication tooling belongs to the repo that owns publication.

Disclosure is resolved for now: full public is fine in build mode, where there
are no users to expose and no attacker with anything to gain. Recorded as
deferred rather than closed, because it stops being true at production - the
same blast-radius disclosure that a consumer must read becomes a map once real
tenant data exists.

Controlled disclosure is deliberately not this repo's job. Publication is about
permanence and currency; embargo is about severity, remediation and timing, and
building it here would put risk judgement in the repo least qualified to make
it. It likely wants a service of its own - a risk-nexus - with this repo as its
publication surface rather than its brain.

The only cost today is one line in T01: the addressing scheme must not assume
every document is public from birth, so that adding an embargo state later is a
new status rather than a URL migration.

First publication retargeted - the framework relocated to NetKingdom canon and
is now tenancy-posture_v0.1, five axes rather than five planes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md

@@ -25,7 +25,8 @@ superseded versions, and can be reached by someone outside the estate.
 
 ## The forcing case
 
-Custodian ADR-008 (*Tenancy Posture*, draft-4) needs review from six repos —
+`net-kingdom/canon/standards/tenancy-posture_v0.1.md` (*Tenancy Posture*,
+draft-5) needs review from six repos —
 `tenant-engine`, `flex-auth`, `rapp-postgres`, `railiance-platform`,
 `adaptive-pricing`, `audit-core`. It is currently served from a private,
 disposable artifact URL. Routing a document that governs six repos to a link
@@ -37,13 +38,12 @@ owner-attributed open questions — the site is not finished.
 
 ## Existing structure this workplan must respect
 
-**The renderer already exists in prototype.**
-`the-custodian/tools/render-artifact.py` generates the ADR-008 page from canon
-markdown: stdlib only, no dependency tree, recognising conventions already
-present in the document rather than requiring extra markup. It was written
-because the page and the ADR had diverged. **Take it over and generalise it; do
-not reimplement it.** Its companion `tools/artifact-style.css` carries the
-design system.
+**The renderer is already here.** `tools/render.py` and `tools/style.css`
+arrived from `the-custodian` on 2026-08-17, along with `make build`. Stdlib
+only, no dependency tree, recognising conventions already present in the
+document rather than requiring extra markup. It was written because the page
+and the source had diverged. T02 generalises it from one document to many; it
+does not start from scratch.
 
 **Source of truth stays upstream.** Canon lives in `the-custodian/canon`;
 per-repo ADRs live in their own repos. This repo reads and never writes back.
@@ -249,15 +249,38 @@ not attract the wrong contributions.
 
 1. **Owner.** This workplan is `unassigned`. It spans infrastructure and canon
    process and does not obviously belong to an existing repo's agent.
-2. **Public by default?** INTENT assumes everything on this surface is
-   public-by-intent. Confirm that no estate policy is sensitive enough to need
-   an authenticated tier — if any is, that changes T04 substantially. Now
-   sharper than when first asked: publishing every ADR across 18 repositories
-   exposes the estate's architecture, its known gaps and its residual risks in
-   one indexed place. `rapp-postgres` ADR-0001 §5 publishes a blast radius by
-   design, and that is the right call for a document its consumers must read —
-   but the same disclosure discipline applied estate-wide, publicly, is a
-   decision worth taking deliberately rather than inheriting from a default.
-3. **Canon subdirectory scope.** `standards` and `architecture` are clearly
+2. **Canon subdirectory scope.** `standards` and `architecture` are clearly
    policy. Are `constitution`, `values`, `tpsc` and `projects` in or out? T03
    needs a yes or no per directory rather than a wildcard.
+
+## Deferred: controlled disclosure
+
+**Resolved for now (operator, 2026-08-17): full public disclosure is fine.** The
+estate is in build mode, not production. Publishing architecture, known gaps and
+residual risks openly costs little while there are no users to expose and no
+attacker with anything to gain.
+
+**That stops being true at production.** ADR-0001 §5 publishes a blast radius
+because its consumers must read it; the same discipline applied publicly, once
+real tenant data exists, hands an attacker a map. The estate will then need a
+**controlled-disclosure scheme**: a way to hold a finding while it is fixed, and
+publish it once it is — embargo, coordinated timing, and a record that the delay
+was deliberate rather than a document quietly going missing.
+
+This workplan does **not** build that, and should not. Two reasons:
+
+1. It is a different problem. Publication is about permanence and currency;
+   embargo is about risk assessment, severity and timing. Building embargo into
+   a publication surface would put risk judgement in the repo least qualified to
+   make it.
+2. It likely belongs to a service of its own — a **`risk-nexus`**, by analogy —
+   owning finding intake, severity, remediation tracking and disclosure timing,
+   with this repo as its publication surface rather than its brain.
+
+**What T01 must do about it now:** nothing more than leave room. The addressing
+scheme should not assume every document is public from the moment it exists, so
+that adding an embargo state later is a new status rather than a URL migration.
+Recording that constraint costs nothing today and is expensive to retrofit.
+
+**Trigger to revisit:** the first real tenant, or the first finding that would
+be dangerous to publish before it is fixed — whichever comes first.