feat: publish Risk Nexus findings and methods

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tests/test_publication.py

@@ -255,6 +255,25 @@ class PublicationTest(unittest.TestCase):
             with self.assertRaisesRegex(ValueError, "owner is required"):
                 build_site.build(manifest, root / "site")
 
+    def test_build_rejects_non_public_risk_record(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            manifest = _fixture(root)
+            value = json.loads(manifest.read_text(encoding="utf-8"))
+            value["repositories"] = {"risk-nexus": {"path": "canon-repo"}}
+            value["documents"][0]["source_repo"] = "risk-nexus"
+            manifest.write_text(json.dumps(value), encoding="utf-8")
+            source = root / "canon-repo/canon/standards/example.md"
+            source.write_text(
+                source.read_text(encoding="utf-8").replace(
+                    "status: proposed\n", "status: proposed\ndisclosure: embargoed\n"
+                ),
+                encoding="utf-8",
+            )
+
+            with self.assertRaisesRegex(ValueError, "require disclosure: public"):
+                build_site.build(manifest, root / "site")
+
 
 if __name__ == "__main__":
     unittest.main()