coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: publish reviewed architecture and ADR batch
Some checks failed
Build and publish policy-nexus image / build-and-push (push) Failing after 19s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-08-31 21:34:23 +02:00
parent 023badb512
commit 93608c1f17
120 changed files with 17791 additions and 727 deletions
Download patch file Download diff file Expand all files Collapse all files

11
build/adr/railiance-reef-production-admission/v1/index.html
View file

@ -1,7 +1,7 @@
<!doctype html>
<html lang="en"><meta charset="utf-8">
<meta name="policy-source-revision" content="468a52af2b14eba08e05be69c4d2866bfd8d9d7d">
<meta name="policy-source-digest" content="d9fbd9d21d86e461334abc24060c39127f2158ba25317b3d3dc326c4f7eaf08c">
<meta name="policy-source-revision" content="5ffd7d1b40d56249f490a318e728047fd3517c4c">
<meta name="policy-source-digest" content="9839d8a4a4617b745cfacab6a0fb72157e88cddf53f40226d8246a64864de533">
<title>Reef Production Admission</title>
<style>
:root{
@ -191,7 +191,7 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
</style>
<div class="wrap"><header><div class="eyebrow"><span>RMASTER-ADR-0006</span> <span class="stat">accepted · accepted-1</span> <span>railiance-master</span> <span>reviewed 2026-08-15</span><span>generated from canonical source — do not edit</span></div><h1>Reef Production Admission</h1><p class="sub">Source: <code>railiance-master · docs/adr/ADR-0006-reef-production-admission.md · 468a52af2b14eba08e05be69c4d2866bfd8d9d7d</code></p><p class="sub">Review due: 2027-02-15</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li></ol></nav><main><p>Date: 2026-07-26 Status: Accepted</p>
<div class="wrap"><header><div class="eyebrow"><span>RMASTER-ADR-0006</span> <span class="stat">accepted · accepted-2</span> <span>railiance-master</span> <span>reviewed 2026-08-29</span><span>generated from canonical source — do not edit</span></div><h1>Reef Production Admission</h1><p class="sub">Source: <code>railiance-master · docs/adr/ADR-0006-reef-production-admission.md · 5ffd7d1b40d56249f490a318e728047fd3517c4c</code></p><p class="sub">Review due: 2027-02-28</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li></ol></nav><main><p>Date: 2026-07-26 Status: Accepted</p>
<section id="context"><h2>Context</h2>
<p>Fabric topology can say that a reef hosts a rail or binds a workload, but that does not demonstrate capacity, isolation, recoverability, or approval for a critical internet-facing service.</p>
</section>
@ -200,7 +200,8 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
<p>Critical workloads require machine-readable conformance evidence plus explicit acceptance of residual risks that cannot be automated. Mixed-rail reefs use defined split triggers.</p>
<p>The detailed contract is <a href="../reef-production-readiness-contract.md"><code>docs/reef-production-readiness-contract.md</code></a>.</p>
<p>Who may reach a listener is a different axis: <a href="ADR-0008-private-by-default-exposure.md"><code>ADR-0008</code></a>. Production admission does not imply a public surface. A public surface requires this admission <strong>and</strong> an exposure grant.</p>
<p>Neither admission nor exposure is an authorization decision. Whether an actor may perform an action on a resource is <code>access-engine</code> (<a href="ADR-0009-netkingdom-security-layer-interaction.md"><code>ADR-0009</code></a>). <code>production-approved</code> MUST NOT be read as permission to act.</p>
</section>
<section id="consequences"><h2>Consequences</h2>
<ul><li><code>hosts_rail</code> and <code>binds_rapp</code> no longer imply deployability.</li><li><code>reef-railiance</code> may host Knative in wave 2, but Qonto cannot be called production-approved solely from that declaration.</li><li>Repeated evidence collection should become functional automation.</li><li><code>production-approved</code> is not permission to publish a listener. See ADR-0008.</li></ul>
</section><footer><span>RMASTER-ADR-0006 · accepted-1 · accepted</span><span>railiance-master · docs/adr/ADR-0006-reef-production-admission.md · 468a52af2b14eba08e05be69c4d2866bfd8d9d7d</span></footer></main></div></div></html>
<ul><li><code>hosts_rail</code> and <code>binds_rapp</code> no longer imply deployability.</li><li><code>reef-railiance</code> may host Knative in wave 2, but Qonto cannot be called production-approved solely from that declaration.</li><li>Repeated evidence collection should become functional automation.</li><li><code>production-approved</code> is not permission to publish a listener. See ADR-0008.</li><li><code>production-approved</code> is not an authorization decision. See ADR-0009.</li></ul>
</section><footer><span>RMASTER-ADR-0006 · accepted-2 · accepted</span><span>railiance-master · docs/adr/ADR-0006-reef-production-admission.md · 5ffd7d1b40d56249f490a318e728047fd3517c4c</span></footer></main></div></div></html>