feat: publish custodian fleet standards batch

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md

@@ -0,0 +1,166 @@
+---
+id: PNEX-WP-0004
+type: workplan
+title: "Publish the first deferred fleet-standards batch and authenticate CI source acquisition"
+domain: infotech
+repo: policy-nexus
+status: active
+owner: the-custodian
+topic_slug: policy-nexus
+created: "2026-08-31"
+updated: "2026-08-31"
+depends_on_workplans:
+  - PNEX-WP-0003
+state_hub_workstream_id: "a4f65253-4aab-5a43-8a19-3d07c11da244"
+---
+
+# PNEX-WP-0004 — fleet standards publication and CI source authentication
+
+## Goal
+
+Publish the first coherent return from `CUST-IN-0016`: five reviewed,
+Custodian-owned fleet standards. At the same time, make the scheduled Forgejo
+candidate build capable of reading private source repositories through a
+dedicated least-privilege credential rather than anonymous HTTP or an admin
+token.
+
+Done means the five standards have permanent current and immutable URLs, the
+source inventory and ADR-review ledger reflect the Custodian rulings, the
+retained-history/currency/release gates pass, and the CI workflow fails closed
+with an actionable error when its dedicated source-read credential is absent.
+
+## Publication batch
+
+| id | Source | Address series |
+| --- | --- | --- |
+| `canon-autonomy-lanes` | `canon/standards/autonomy-lanes_v0.1.md` | `/standards/autonomy-lanes/v0.1/` |
+| `canon-contrib-convention` | `canon/standards/contribution-convention_v0.1.md` | `/standards/contribution-convention/v0.1/` |
+| `canon-project-repository-flavor` | `canon/standards/project-repository-flavor_v0.1.md` | `/standards/project-repository-flavor/v0.1/` |
+| `canon-work-record-types` | `canon/standards/work-record-types_v0.1.md` | `/standards/work-record-types/v0.1/` |
+| `canon-workplan-terminology-fleet` | `canon/standards/workplan-terminology-fleet_v0.1.md` | `/standards/workplan-terminology/v0.1/` |
+
+All five are owned by `the-custodian`, reviewed on 2026-08-31, use revision
+`accepted-1`, and retain a six-month review interval. Source-owner commit:
+`the-custodian@4b951be`.
+
+## Explicit exclusions and deferrals
+
+- `bootstrap-protocol_v0.1.md` and `custodian_constitution_v0.1.md` declare
+  `sensitivity: internal`; they must not be published on the public surface.
+- `repo-classification-standard_v1.0.md` remains deferred until its `active`
+  front-matter and body-level `Draft v1.0` statement are reconciled.
+- `sbom-convention_v0.1.md` remains deferred until its authority and operating
+  model are reviewed against current SBOM Nexus architecture.
+- The other owner repositories and all five conflict rows stay with
+  `CUST-IN-0016`; they are not pulled into this bounded batch.
+
+## CI credential boundary
+
+`fetch_sources.py` may accept a Forgejo token only through an environment
+variable or an explicit caller-provided value. It sends the token solely to the configured
+Forgejo origin over HTTPS, never prints it, never writes it to `source-lock`,
+and refuses a credential for a remote on another origin. The workflow uses a
+dedicated `FORGEJO_SOURCE_TOKEN` secret. Registry credentials remain confined
+to registry login and are not reused for repository reads.
+
+Provisioning the secret is an external Custodian/platform handoff: the token
+must have organization-private repository read access and no package write,
+admin, cluster, or deployment authority. Code and tests may land before that
+secret is installed; the scheduled workflow must fail closed until it is.
+
+## Tasks
+
+### T01 — Owner review and disclosure gate
+
+```task
+id: PNEX-WP-0004-T01
+status: done
+priority: high
+state_hub_task_id: "2301c729-841b-5c5c-a9dd-aa5d4390c36b"
+```
+
+Review the Custodian slice, add truthful publication metadata to the five
+public fleet standards, and record the internal/deferred sources explicitly in
+`CUST-IN-0016`.
+
+Completed 2026-08-31 in `the-custodian@4b951be`. No normative body text was
+changed.
+
+### T02 — Register and audit the five standards
+
+```task
+id: PNEX-WP-0004-T02
+status: done
+priority: high
+state_hub_task_id: "a4378f0b-cf58-5dac-9f8e-2a69b07ff6e3"
+```
+
+Add five explicit `publication.json` entries, refresh the source inventory and
+review ledger, and ensure the two internal constitution sources are never
+classified as publishable output.
+
+Completed 2026-08-31. The explicit registry contains 65 documents; the source
+audit reports 65 published and 79 metadata-pending sources. The two internal
+constitution records are ruled `local` and have no publication address.
+
+### T03 — Authenticate private source acquisition
+
+```task
+id: PNEX-WP-0004-T03
+status: done
+priority: high
+state_hub_task_id: "e0c0fa67-5a90-5990-a4e9-35e517816a7d"
+```
+
+Add same-origin Forgejo-token support to `fetch_sources.py`, cover header,
+redaction, and cross-origin refusal behavior with unit tests, and pass only the
+dedicated source token from the Forgejo workflow. Authenticate the workflow's
+own archive download as well as every declared owner-repository fetch.
+
+Completed 2026-08-31. Five authentication-boundary tests cover same-origin
+header injection, cross-origin refusal, paired token/origin configuration,
+anonymous mode, and full-revision archive addressing. The complete 22-test
+suite passes. Installing the read-only Forgejo Actions secret remains the
+credential-owner handoff and is not a code-completion gate.
+
+### T04 — Build and publish the immutable candidate
+
+```task
+id: PNEX-WP-0004-T04
+status: progress
+priority: high
+state_hub_task_id: "a6f789ea-5d90-55cf-b67b-5cf401b81e66"
+```
+
+Run `make check`, retained-history build, currency, and release verification.
+Publish the OCI candidate and record its image, publication-manifest,
+source-inventory, and source-set digests.
+
+2026-08-31: the local retained-history build, release verifier, and currency
+gate pass for all 65 documents. Pre-publication identities are publication
+manifest `c54efb4226f964b8af4e37cebcccda6d3becaa5db1cd9465c166392d2a87c842`,
+source inventory
+`b061ebc593f8e6353929eb795663d66278eca094429f139b6060e7b236e3d8d8`, and
+source set
+`7e0f0ee3fdf3bcdc8d34e7fc9ba12304ba84864b06c63e9226324e6aa0ea4e7f`.
+
+### T05 — Promote, smoke, and close
+
+```task
+id: PNEX-WP-0004-T05
+status: todo
+priority: medium
+state_hub_task_id: "07c9c18d-95cf-5b09-940a-40b5ff5828a7"
+```
+
+Update the paired `rapp-policy-nexus` and `railiance-apps` bindings, pass
+server-side admission, deploy atomically, and verify all five current and
+immutable `accepted-1` URLs before closing this workplan.
+
+## Residuals
+
+- Secret provisioning and rotation remain with the credential owner surfaced
+  by `warden route`; no token value enters this repository or State Hub.
+- `CUST-IN-0016` remains open for 26 other-owner metadata returns, two
+  substantive Custodian reviews, and five owner conflict rows. The two internal
+  constitutions are explicit local/excluded outcomes, not publication backlog.