Scope: canon and ADRs outward, estate-bearing regulation inward

Operator answered the two blocking questions, so T06 is now specifiable and
T03 has a bounded corpus: two canon trees and roughly 68 ADRs across 18
repositories. Workplans, evidence and runbooks are out - a site that publishes
everything publishes nothing in particular.

T06 gains an inclusion test (does the rule constrain something the estate
actually does), a record format, and a candidate register drawn from what the
estate demonstrably touches rather than from a list of well-known regulations -
data protection and erasure, residency, procurement via vergabe-teilnahme,
identity assurance via the aal2 class, and the agentic tenant grouping. The
register is to confirm, not to assume.

The hard rule is now in the format itself: a record states what a source said
and when. Interpretation belongs to the repo making the decision. The estate
has no legal function and this repo must not grow one by accident.

Rewrote the README, which described a broader civic corpus than the repo is
scoped to and would have attracted the wrong contributions.

One question got sharper rather than resolved: publishing every ADR across 18
repos puts the estate's architecture, known gaps and residual risks in one
indexed public place. That is right for a document consumers must read, and it
is a decision to take deliberately rather than inherit from a default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

INTENT.md

@@ -32,16 +32,33 @@ a path in as well as out.
 
 - **`policy.coulomb.social`** — the public publication surface: its
   infrastructure, deployment, availability and rollback.
-- **Publication of estate policy.** Rendering governing documents from their
-  source repos into a durable, addressable, indexed site. The source of truth
-  stays in the owning repo; this repo owns the *publication*, not the content.
+- **Publication of estate policy**, scoped to **canon and architecture decision
+  records**. Rendering governing documents from their source repos into a
+  durable, addressable, indexed site. The source of truth stays in the owning
+  repo; this repo owns the *publication*, not the content.
+
+  The corpus in scope today is bounded and countable: two canon trees
+  (`the-custodian/canon`, `net-kingdom/canon`) and roughly 68 ADRs across 18
+  repositories. Workplans, evidence, runbooks and general documentation are
+  **out of scope** — this is a policy site, not a documentation site. That line
+  is deliberate: a site that publishes everything publishes nothing in
+  particular, and the value here is that a reader knows what governs and what
+  merely describes.
 - **Stable addressing.** A published document keeps its URL. Superseded
   versions remain reachable and are marked superseded rather than removed.
 - **Currency.** Every published document carries its status, revision, and when
   it was last reviewed. A stale document is visibly stale rather than silently
   wrong.
-- **Information gathering.** The intake path for external policy: what was
-  found, when, from where, and which internal decision it bears on.
+- **Information gathering**, scoped to **regulation bearing on the estate**.
+  The intake path for external policy: what was found, when, from where, and
+  which internal decision it bears on.
+
+  The test for inclusion is whether a rule constrains something the estate
+  actually does. A regulation that governs data the estate holds, a market it
+  sells into, or an obligation it takes on is in scope. Public policy that is
+  merely interesting is not. This is not a civic-information corpus; it is the
+  estate's own compliance surface, kept in one place so the same question is
+  not researched twice and its answer does not silently expire.
 - **The relevance loop.** Detecting when a published or gathered document has
   gone out of date, and surfacing that rather than waiting for someone to
   notice.

README.md

@@ -1,3 +1,21 @@
 # policy-nexus
 
-A convergence and publication point for government policies.
+Permanent publication and regulatory intake for the estate's policy surface.
+Serves `policy.coulomb.social`.
+
+Two halves:
+
+- **Outward** — publishes estate **canon and architecture decision records**
+  from the repositories that own them, at stable URLs, with visible status and
+  currency. Generated, never authored: the source of truth stays upstream and
+  this repo never writes back.
+- **Inward** — records **regulation bearing on the estate**: rules that
+  constrain data it holds, markets it sells into, or obligations it has taken
+  on. A record says what a source said and when. It never says what the estate
+  must therefore do.
+
+Not a CMS, not a documentation site, not a civic-information corpus, and not a
+source of legal advice.
+
+- Intent: `INTENT.md`
+- Workplans: `workplans/`

workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md

@@ -111,6 +111,14 @@ generated page, plus an index entry.
 Define how a document gets from its owning repo to this one.
 
 - Manifest format: source repo, path, publication URL, owner.
+- **Scope is canon and ADRs only.** The corpus is bounded and countable today:
+  two canon trees (`the-custodian/canon`, `net-kingdom/canon`) and roughly 68
+  ADRs across 18 repositories. Workplans, evidence and runbooks are out — a
+  site that publishes everything publishes nothing in particular. Enumerate the
+  actual list during T03; a glob over `docs/adr/*.md` plus the canon trees is
+  the starting point, but each canon subdirectory (`standards`, `architecture`,
+  `constitution`, `values`, `tpsc`, `projects`) needs a yes or no rather than a
+  wildcard.
 - Fetch mechanism for documents in other repositories, and how a fetch failure
   is surfaced rather than silently serving stale content.
 - Determinism: the same source commit must produce the same page.
@@ -147,27 +155,56 @@ is quietly out of date is worse than no document.
   unratified since 2026-08-10; that fact should be visible on the site, because
   invisibility is precisely why it stalled.
 
-### T06 — External policy intake
+### T06 — Regulatory intake
 
-The information-gathering half. Deliberately last: the publication path must
-work before a second content type is added.
+The information-gathering half, scoped to **regulation bearing on the estate**.
+Deliberately last: the publication path must work before a second content type
+is added.
 
-- A record format for an external policy finding: what, source URL, date
-  retrieved, jurisdiction, which internal decision it bears on, and who
-  recorded it.
-- Where records live and how they are published.
-- The staleness question, which is sharper here than for internal documents:
-  external policy changes without telling us. A record must carry its retrieval
-  date prominently and be treated as a snapshot, never as current law.
-- **A hard rule to write into the format:** a gathered record states what a
-  source says and when it said it. It does not state what the estate must
-  therefore do. That interpretation belongs to the repo making the decision.
+**Inclusion test.** A rule is in scope when it constrains something the estate
+actually does — governs data it holds, a market it sells into, or an obligation
+it has taken on. Public policy that is merely interesting is out. This is a
+compliance surface, not a civic-information corpus.
 
-**Worked example available:** the ADR-008 retention research already holds one
-of these — whether key destruction satisfies an erasure obligation, where data
-protection authorities have accepted it under conditions and the EDPB has not
-formally endorsed it. That is exactly a finding that is true today, may not be
-in a year, and must never be recorded as settled.
+**Record format.** What the source says; the source URL; the date retrieved;
+the jurisdiction; the instrument and article or section; which internal
+document or decision it bears on; who recorded it; when it should next be
+checked.
+
+**The hard rule, written into the format itself:** a record states what a
+source said and when it said it. It does **not** state what the estate must
+therefore do. Interpretation belongs to the repo making the decision, and a
+record that reads as a ruling has failed. The estate has no legal function and
+this repo must not grow one by accident.
+
+**Staleness is sharper here than for internal documents.** External policy
+changes without telling us, so a record is a dated snapshot, never current law.
+The retrieval date is displayed as prominently as the content, and a record
+past its check date is visibly stale rather than quietly wrong.
+
+**Candidate register, to confirm rather than assume.** These are the domains
+the estate's own activity implies; T06 should verify which actually apply
+before treating any as in scope:
+
+| Area | Why the estate touches it | Already live in |
+|---|---|---|
+| Data protection / erasure and retention | Tenant personal data, the erasure horizon, whether key destruction satisfies an erasure obligation | ADR-008 plane R; `rapp-postgres` ADR-0002 |
+| Data residency | The `P4` placement level exists for exactly this and has no occupants yet | ADR-008 plane P |
+| Public procurement | `vergabe-teilnahme` is a procurement-participation app and the delivery-lane reference implementation | `business-app-service-contract` |
+| Identity assurance | The IAM Profile's `aal2` class drives live re-query rather than cached claims | `iam-profile_v0.3`; ADR-008 plane I |
+| Sector and cybersecurity obligations | Whether the estate is an in-scope entity at all is itself an open question worth recording once | — |
+| AI and agentic entities | The tenant taxonomy has an `agentic` grouping for financially enabled AI entities | ADR-0013 |
+
+**Worked example already in hand.** The ADR-008 retention research holds a
+finding of exactly this shape: data protection authorities have accepted key
+destruction as erasure where physical deletion is disproportionate, under
+conditions, and the EDPB has not formally endorsed it. True as recorded, likely
+to move, and dangerous if ever restated as settled. Migrating that finding into
+the T06 format is the acceptance test for the format.
+
+**Acceptance:** the format holds that finding without distortion; the record
+displays its retrieval date as prominently as its content; and a reader can get
+from a record to the internal document it bears on, and back.
 
 ## Sequencing
 
@@ -196,18 +233,31 @@ the workplan, not a preface to it.
 becomes something only CI can run. Mitigation: stdlib-only is an acceptance
 criterion on T02, not a preference.
 
+## Resolved by the operator, 2026-08-17
+
+- **Publication scope is canon and ADRs.** Not workplans, evidence, runbooks or
+  general documentation. Folded into T03 and INTENT.
+- **Intake scope is regulation bearing on the estate.** Not a broader
+  public-interest corpus. T06 is specified accordingly, with an inclusion test
+  and a candidate register to confirm.
+
+The README's one-line description — "a convergence and publication point for
+government policies" — reads broader than this. Worth updating so the repo does
+not attract the wrong contributions.
+
 ## Open questions for the operator
 
 1. **Owner.** This workplan is `unassigned`. It spans infrastructure and canon
    process and does not obviously belong to an existing repo's agent.
 2. **Public by default?** INTENT assumes everything on this surface is
    public-by-intent. Confirm that no estate policy is sensitive enough to need
-   an authenticated tier — if any is, that changes T04 substantially.
-3. **Scope of "policy".** Canon and ADRs are clearly in. Are workplans,
-   decision records, and evidence in scope, or is this a policy site rather
-   than a general documentation site? Recommend starting narrow — canon and
-   ADRs only — and widening on demand.
-4. **Government policy scope** (T06). The README describes convergence for
-   *government* policies. Is the intake scoped to regulation bearing on the
-   estate, or is a broader public-interest corpus intended? These are very
-   different repos, and T06 cannot be specified until this is answered.
+   an authenticated tier — if any is, that changes T04 substantially. Now
+   sharper than when first asked: publishing every ADR across 18 repositories
+   exposes the estate's architecture, its known gaps and its residual risks in
+   one indexed place. `rapp-postgres` ADR-0001 §5 publishes a blast radius by
+   design, and that is the right call for a document its consumers must read —
+   but the same disclosure discipline applied estate-wide, publicly, is a
+   decision worth taking deliberately rather than inheriting from a default.
+3. **Canon subdirectory scope.** `standards` and `architecture` are clearly
+   policy. Are `constitution`, `values`, `tpsc` and `projects` in or out? T03
+   needs a yes or no per directory rather than a wildcard.