diff --git a/INTENT.md b/INTENT.md index acd3a1b..a134330 100644 --- a/INTENT.md +++ b/INTENT.md @@ -32,16 +32,33 @@ a path in as well as out. - **`policy.coulomb.social`** — the public publication surface: its infrastructure, deployment, availability and rollback. -- **Publication of estate policy.** Rendering governing documents from their - source repos into a durable, addressable, indexed site. The source of truth - stays in the owning repo; this repo owns the *publication*, not the content. +- **Publication of estate policy**, scoped to **canon and architecture decision + records**. Rendering governing documents from their source repos into a + durable, addressable, indexed site. The source of truth stays in the owning + repo; this repo owns the *publication*, not the content. + + The corpus in scope today is bounded and countable: two canon trees + (`the-custodian/canon`, `net-kingdom/canon`) and roughly 68 ADRs across 18 + repositories. Workplans, evidence, runbooks and general documentation are + **out of scope** — this is a policy site, not a documentation site. That line + is deliberate: a site that publishes everything publishes nothing in + particular, and the value here is that a reader knows what governs and what + merely describes. - **Stable addressing.** A published document keeps its URL. Superseded versions remain reachable and are marked superseded rather than removed. - **Currency.** Every published document carries its status, revision, and when it was last reviewed. A stale document is visibly stale rather than silently wrong. -- **Information gathering.** The intake path for external policy: what was - found, when, from where, and which internal decision it bears on. +- **Information gathering**, scoped to **regulation bearing on the estate**. + The intake path for external policy: what was found, when, from where, and + which internal decision it bears on. + + The test for inclusion is whether a rule constrains something the estate + actually does. A regulation that governs data the estate holds, a market it + sells into, or an obligation it takes on is in scope. Public policy that is + merely interesting is not. This is not a civic-information corpus; it is the + estate's own compliance surface, kept in one place so the same question is + not researched twice and its answer does not silently expire. - **The relevance loop.** Detecting when a published or gathered document has gone out of date, and surfacing that rather than waiting for someone to notice. diff --git a/README.md b/README.md index dc3edbc..2504bda 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,21 @@ # policy-nexus -A convergence and publication point for government policies. \ No newline at end of file +Permanent publication and regulatory intake for the estate's policy surface. +Serves `policy.coulomb.social`. + +Two halves: + +- **Outward** — publishes estate **canon and architecture decision records** + from the repositories that own them, at stable URLs, with visible status and + currency. Generated, never authored: the source of truth stays upstream and + this repo never writes back. +- **Inward** — records **regulation bearing on the estate**: rules that + constrain data it holds, markets it sells into, or obligations it has taken + on. A record says what a source said and when. It never says what the estate + must therefore do. + +Not a CMS, not a documentation site, not a civic-information corpus, and not a +source of legal advice. + +- Intent: `INTENT.md` +- Workplans: `workplans/` diff --git a/workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md b/workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md index 02cc293..09c597a 100644 --- a/workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md +++ b/workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md @@ -111,6 +111,14 @@ generated page, plus an index entry. Define how a document gets from its owning repo to this one. - Manifest format: source repo, path, publication URL, owner. +- **Scope is canon and ADRs only.** The corpus is bounded and countable today: + two canon trees (`the-custodian/canon`, `net-kingdom/canon`) and roughly 68 + ADRs across 18 repositories. Workplans, evidence and runbooks are out — a + site that publishes everything publishes nothing in particular. Enumerate the + actual list during T03; a glob over `docs/adr/*.md` plus the canon trees is + the starting point, but each canon subdirectory (`standards`, `architecture`, + `constitution`, `values`, `tpsc`, `projects`) needs a yes or no rather than a + wildcard. - Fetch mechanism for documents in other repositories, and how a fetch failure is surfaced rather than silently serving stale content. - Determinism: the same source commit must produce the same page. @@ -147,27 +155,56 @@ is quietly out of date is worse than no document. unratified since 2026-08-10; that fact should be visible on the site, because invisibility is precisely why it stalled. -### T06 — External policy intake +### T06 — Regulatory intake -The information-gathering half. Deliberately last: the publication path must -work before a second content type is added. +The information-gathering half, scoped to **regulation bearing on the estate**. +Deliberately last: the publication path must work before a second content type +is added. -- A record format for an external policy finding: what, source URL, date - retrieved, jurisdiction, which internal decision it bears on, and who - recorded it. -- Where records live and how they are published. -- The staleness question, which is sharper here than for internal documents: - external policy changes without telling us. A record must carry its retrieval - date prominently and be treated as a snapshot, never as current law. -- **A hard rule to write into the format:** a gathered record states what a - source says and when it said it. It does not state what the estate must - therefore do. That interpretation belongs to the repo making the decision. +**Inclusion test.** A rule is in scope when it constrains something the estate +actually does — governs data it holds, a market it sells into, or an obligation +it has taken on. Public policy that is merely interesting is out. This is a +compliance surface, not a civic-information corpus. -**Worked example available:** the ADR-008 retention research already holds one -of these — whether key destruction satisfies an erasure obligation, where data -protection authorities have accepted it under conditions and the EDPB has not -formally endorsed it. That is exactly a finding that is true today, may not be -in a year, and must never be recorded as settled. +**Record format.** What the source says; the source URL; the date retrieved; +the jurisdiction; the instrument and article or section; which internal +document or decision it bears on; who recorded it; when it should next be +checked. + +**The hard rule, written into the format itself:** a record states what a +source said and when it said it. It does **not** state what the estate must +therefore do. Interpretation belongs to the repo making the decision, and a +record that reads as a ruling has failed. The estate has no legal function and +this repo must not grow one by accident. + +**Staleness is sharper here than for internal documents.** External policy +changes without telling us, so a record is a dated snapshot, never current law. +The retrieval date is displayed as prominently as the content, and a record +past its check date is visibly stale rather than quietly wrong. + +**Candidate register, to confirm rather than assume.** These are the domains +the estate's own activity implies; T06 should verify which actually apply +before treating any as in scope: + +| Area | Why the estate touches it | Already live in | +|---|---|---| +| Data protection / erasure and retention | Tenant personal data, the erasure horizon, whether key destruction satisfies an erasure obligation | ADR-008 plane R; `rapp-postgres` ADR-0002 | +| Data residency | The `P4` placement level exists for exactly this and has no occupants yet | ADR-008 plane P | +| Public procurement | `vergabe-teilnahme` is a procurement-participation app and the delivery-lane reference implementation | `business-app-service-contract` | +| Identity assurance | The IAM Profile's `aal2` class drives live re-query rather than cached claims | `iam-profile_v0.3`; ADR-008 plane I | +| Sector and cybersecurity obligations | Whether the estate is an in-scope entity at all is itself an open question worth recording once | — | +| AI and agentic entities | The tenant taxonomy has an `agentic` grouping for financially enabled AI entities | ADR-0013 | + +**Worked example already in hand.** The ADR-008 retention research holds a +finding of exactly this shape: data protection authorities have accepted key +destruction as erasure where physical deletion is disproportionate, under +conditions, and the EDPB has not formally endorsed it. True as recorded, likely +to move, and dangerous if ever restated as settled. Migrating that finding into +the T06 format is the acceptance test for the format. + +**Acceptance:** the format holds that finding without distortion; the record +displays its retrieval date as prominently as its content; and a reader can get +from a record to the internal document it bears on, and back. ## Sequencing @@ -196,18 +233,31 @@ the workplan, not a preface to it. becomes something only CI can run. Mitigation: stdlib-only is an acceptance criterion on T02, not a preference. +## Resolved by the operator, 2026-08-17 + +- **Publication scope is canon and ADRs.** Not workplans, evidence, runbooks or + general documentation. Folded into T03 and INTENT. +- **Intake scope is regulation bearing on the estate.** Not a broader + public-interest corpus. T06 is specified accordingly, with an inclusion test + and a candidate register to confirm. + +The README's one-line description — "a convergence and publication point for +government policies" — reads broader than this. Worth updating so the repo does +not attract the wrong contributions. + ## Open questions for the operator 1. **Owner.** This workplan is `unassigned`. It spans infrastructure and canon process and does not obviously belong to an existing repo's agent. 2. **Public by default?** INTENT assumes everything on this surface is public-by-intent. Confirm that no estate policy is sensitive enough to need - an authenticated tier — if any is, that changes T04 substantially. -3. **Scope of "policy".** Canon and ADRs are clearly in. Are workplans, - decision records, and evidence in scope, or is this a policy site rather - than a general documentation site? Recommend starting narrow — canon and - ADRs only — and widening on demand. -4. **Government policy scope** (T06). The README describes convergence for - *government* policies. Is the intake scoped to regulation bearing on the - estate, or is a broader public-interest corpus intended? These are very - different repos, and T06 cannot be specified until this is answered. + an authenticated tier — if any is, that changes T04 substantially. Now + sharper than when first asked: publishing every ADR across 18 repositories + exposes the estate's architecture, its known gaps and its residual risks in + one indexed place. `rapp-postgres` ADR-0001 §5 publishes a blast radius by + design, and that is the right call for a document its consumers must read — + but the same disclosure discipline applied estate-wide, publicly, is a + decision worth taking deliberately rather than inheriting from a default. +3. **Canon subdirectory scope.** `standards` and `architecture` are clearly + policy. Are `constitution`, `values`, `tpsc` and `projects` in or out? T03 + needs a yes or no per directory rather than a wildcard.