Build immutable policy publication artifact

docs/adr/ADR-0001-addressing-and-permanence.md

@@ -0,0 +1,60 @@
+# ADR-0001 — policy addressing and permanence
+
+- Status: accepted
+- Date: 2026-08-18
+- Owner: the-custodian
+
+## Decision
+
+A document has one stable current address and immutable revision addresses:
+
+```text
+/<kind>/<document>/<version>/
+/<kind>/<document>/<version>/revisions/<revision>/
+```
+
+The publication manifest records both. Existing public paths become permanent
+redirect aliases; the first is `/tenancy-posture.html`. No URL is derived from
+a checkout path, branch name, build number or hosting implementation.
+
+The current address advances only when the owning source publishes a new
+revision. A revision address is write-once: the builder records the exact git
+commit (or commit plus working-tree marker) and the full source-content digest.
+It refuses to replace that revision with different content. Committing the
+same bytes may update the current page's provenance but does not rewrite the
+already-published revision page. The generated publication manifest makes the
+source repository, path, revision and digest machine-readable.
+
+Superseded and withdrawn documents are never deleted. The current page gains a
+status banner and link to its successor; every historical revision continues
+to resolve. “Withdrawn” means retained and visibly non-current. Deletion is not
+a lifecycle state.
+
+Source Git history remains the authority for versions that predate this site.
+Once a revision is published, the built revision page is also retained by the
+hosting artifact/release. Rollback republishes a previous complete build; it
+does not rebuild old pages from a changed working tree.
+
+## Permanence promise
+
+A published URL is expected to resolve indefinitely. Breaking that promise
+requires an explicit the-custodian decision plus a redirect/export plan. A DNS,
+hosting or repository migration does not qualify: those must preserve paths.
+
+This repo owns addressing, rendering and currency. It does not decide whether
+a draft is accepted; ratification belongs to the canon owner/the-custodian.
+
+## Publication scope
+
+Canon `standards`, `architecture`, and `constitution` are in scope. `values`,
+`tpsc`, and `projects` are out until their owner marks individual documents as
+governing. Per-repo ADRs are in scope through explicit manifest entries.
+Workplans, evidence, runbooks and general docs are not.
+
+## Consequences
+
+- Builds fail if a source disappears, an id differs, a path collides, or an
+  immutable revision would change; stale output is not silently called fresh.
+- Pages show status, revision, owner, last review and exact source revision.
+- Availability remains restart recovery on the single-node rail. This contract
+  promises stable addressing, not a high-availability SLA.