coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build immutable policy publication artifact

Browse source
This commit is contained in:
tegwick 2026-08-18 12:16:04 +02:00
parent cac0301866
commit e8035f3887
22 changed files with 2375 additions and 452 deletions
Download patch file Download diff file Expand all files Collapse all files

49
README.md
View file

@ -1,21 +1,44 @@
# policy-nexus
Permanent publication and regulatory intake for the estate's policy surface.
Serves `policy.coulomb.social`.
Permanent publication for the estate's policy surface. Serves
`policy.coulomb.social`.
Two halves:
This repo publishes estate **canon and architecture decision records** from
the repositories that own them, at stable URLs, with visible status and
currency. Pages are generated, never authored here: the source of truth stays
upstream and this repo never writes back.
- **Outward** — publishes estate **canon and architecture decision records**
from the repositories that own them, at stable URLs, with visible status and
currency. Generated, never authored: the source of truth stays upstream and
this repo never writes back.
- **Inward** — records **regulation bearing on the estate**: rules that
constrain data it holds, markets it sells into, or obligations it has taken
on. A record says what a source said and when. It never says what the estate
must therefore do.
Regulatory intake and disclosure decisions belong to `risk-nexus`; publishable
records may arrive from it like any other source. This repo does not interpret
them.
Not a CMS, not a documentation site, not a civic-information corpus, and not a
source of legal advice.
Not a CMS, not a documentation site, not a policy author, and not a source of
legal advice.
- Intent: `INTENT.md`
- Workplans: `workplans/`
Build and verify the publication locally with:
```sh
make check
make build
make currency
```
`publication.json` is the explicit source and address registry. A build fails
closed when a source is unavailable or an immutable revision would change.
Production publication is split from runtime ownership. This repository builds
and publishes the immutable OCI site image; `rapp-policy-nexus` owns the Helm
package, exposure checks, and rollback; `railiance-apps` selects the approved
production digests. A release build additionally refuses dirty or synthetic
source provenance:
```sh
make release-build
make image-build IMAGE_REF=forgejo.coulomb.social/coulomb/policy-nexus:git-$(git rev-parse HEAD)
```
Tags are discovery handles only. Production always records the registry-resolved
OCI digest and the SHA-256 of `build/publication-manifest.json`.