coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: publish Risk Nexus findings and methods
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 1m10s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 01:56:46 +02:00
parent 4c8a7b9666
commit c1b60f322e
70 changed files with 3888 additions and 198 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/publication-contract.md
View file

@ -16,8 +16,13 @@ not write back.
| `architecture` | One arc42 document per system | `docs/architecture/<system>_v0.1.md` or `canon/architecture/<system>_v0.1.md` |
| `constitution` | Estate constitution | `canon/constitution/` |
| `adr` | Architecture decision record | `docs/adr/<file>.md` |
| `findings` | A finding explicitly marked public by `risk-nexus` | `findings/RISK-F-NNNN-<slug>.md` |
| `methods` | A public risk judgement instrument | `docs/method/<name>.md` |
Workplans, evidence, runbooks, review ledgers, and general docs are out.
Risk findings and methods are published only after `risk-nexus` has made the
disclosure decision and an explicit `publication.json` entry names the file.
Embargoed or restricted findings fail that admission test. Workplans, evidence,
runbooks, review ledgers, rulings, and general docs are out.
An ADR is published only after an explicit `publication.json` entry.
Architecture documents follow the same rule. Discovery
@ -29,7 +34,7 @@ Architecture documents follow the same rule. Discovery
---
id: <globally-unique-id>
title: "Human title"
status: proposed | accepted | superseded | withdrawn
status: proposed | accepted | adopted | fixed | superseded | withdrawn
owner: <owning-repo-or-canon-owner>
revision: "accepted-1"
last_reviewed: "YYYY-MM-DD"
@ -59,7 +64,7 @@ From ADR-0001:
/<kind>/<document>/<version>/revisions/<revision>/
```
- `<kind>` is one of the four kinds above.
- `<kind>` is one of the six kinds above.
- `<document>` is a kebab-case slug, unique on the site. If two systems
would share a short name, prefix with the system slug
(`railiance-repository-prefix`, not `repository-prefix`).
@ -75,6 +80,8 @@ Examples:
/architecture/policy-nexus/v0.1/
/adr/addressing-and-permanence/v1/
/adr/railiance-repository-prefix/v1/
/findings/flex-auth-unauthenticated-check/v1/
/methods/risk-severity/v1/
```
No URL is derived from a checkout path, branch, or build number.