Build immutable policy publication artifact

workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Stand up policy.coulomb.social as the permanent publication surface"
 domain: infotech
 repo: policy-nexus
-status: proposed
+status: active
 owner: the-custodian
 topic_slug: policy-nexus
 created: "2026-08-17"
-updated: "2026-08-17"
+updated: "2026-08-18"
 ---
 
 # POLICY-NEXUS-WP-0001 — permanent publication surface
@@ -26,15 +26,15 @@ superseded versions, and can be reached by someone outside the estate.
 ## The forcing case
 
 `net-kingdom/canon/standards/tenancy-posture_v0.1.md` (*Tenancy Posture*,
-draft-5) needs review from six repos —
+draft-8) was reviewed by six repos —
 `tenant-engine`, `flex-auth`, `rapp-postgres`, `railiance-platform`,
 `adaptive-pricing`, `audit-core`. It is currently served from a private,
 disposable artifact URL. Routing a document that governs six repos to a link
 that may not resolve later is the problem this workplan exists to end.
 
 Tenancy Posture is therefore the first publication and the acceptance test. If the site
-cannot carry it correctly — five ladders, a threat matrix, an E×P grid, twelve
-owner-attributed open questions — the site is not finished.
+cannot carry it correctly — six ladders, a threat matrix, an E×P grid, and its
+owner-attributed questions and resolutions — the site is not finished.
 
 ## Existing structure this workplan must respect
 
@@ -45,10 +45,11 @@ document rather than requiring extra markup. It was written because the page
 and the source had diverged. T02 generalises it from one document to many; it
 does not start from scratch.
 
-**Source of truth stays upstream.** Canon lives in `the-custodian/canon`;
-per-repo ADRs live in their own repos. This repo reads and never writes back.
-A publication surface with write authority is a second source of truth, and the
-estate has a standing rule against that.
+**Source of truth stays upstream.** Canon lives in its owning repo — including
+`the-custodian/canon` and `net-kingdom/canon` — while per-repo ADRs live in
+their own repos. This repo reads and never writes back. A publication surface
+with write authority is a second source of truth, and the estate has a standing
+rule against that.
 
 **The adoption stance applies** (Tenancy Posture §14): adopt published standards and
 structural patterns; build tooling ground-up unless it is an established
@@ -73,6 +74,12 @@ credential come from the existing platform. If this repo needs storage it is a
 
 ### T01 — Addressing scheme and permanence contract
 
+```task
+id: POLICY-NEXUS-WP-0001-T01
+status: done
+priority: high
+```
+
 Decide, once, how a document maps to a URL, and write down what the estate is
 promising about that URL.
 
@@ -90,8 +97,18 @@ promising about that URL.
 **Why first:** everything downstream bakes in the answer, and changing it later
 breaks the one promise the repo exists to make.
 
+Completed 2026-08-18 in `docs/adr/ADR-0001-addressing-and-permanence.md`.
+The contract distinguishes stable current addresses from immutable revision
+addresses and retains superseded and withdrawn publications.
+
 ### T02 — Generalise the renderer
 
+```task
+id: POLICY-NEXUS-WP-0001-T02
+status: done
+priority: high
+```
+
 Lift `tools/render.py` from one document to many.
 
 - Multi-document: a manifest of sources rather than one path argument.
@@ -100,13 +117,24 @@ Lift `tools/render.py` from one document to many.
 - Index generation: a landing page listing documents with status and currency.
 - Keep the convention recognisers (level ladders, threat matrix, E×P grid,
   evidence chips, section rail) and keep it stdlib-only.
-- Keep the "generated from canon — do not edit" marker on every page.
+- Keep the "generated from canonical source — do not edit" marker on every page.
 
 **Acceptance:** Tenancy Posture renders byte-identically in substance to the current
 generated page, plus an index entry.
 
+Completed 2026-08-18. `publication.json` drives a stdlib-only multi-document
+builder. It emits a current page, immutable revision, legacy alias, index and
+machine-readable publication manifest. Tests cover path safety, revision
+immutability, lifecycle notices and currency.
+
 ### T03 — Source ingestion
 
+```task
+id: POLICY-NEXUS-WP-0001-T03
+status: progress
+priority: high
+```
+
 Define how a document gets from its owning repo to this one.
 
 - Manifest format: source repo, path, publication URL, owner.
@@ -129,8 +157,19 @@ owning repo triggers on merge). Pull is simpler and keeps the direction of
 dependency clean; push is fresher. Recommend pull with a manual trigger, and
 record the choice.
 
+2026-08-18: the explicit pull manifest and exact source-revision recording are
+implemented, and missing or inconsistent sources fail the build. Tenancy
+Posture is the first entry. Enumerating the remaining in-scope canon and ADR
+corpus and connecting scheduled/manual checkout refresh remain open.
+
 ### T04 — Deploy to policy.coulomb.social
 
+```task
+id: POLICY-NEXUS-WP-0001-T04
+status: progress
+priority: high
+```
+
 - DNS, TLS, ingress via the existing platform packages.
 - Static hosting — the output is static files by construction, so the serving
   layer should be the least interesting part of this workplan.
@@ -141,8 +180,22 @@ record the choice.
 - Smoke check after every deploy: the index resolves, Tenancy Posture resolves, and a
   known superseded URL still resolves.
 
+2026-08-18: `policy-nexus` now owns a digest-pinned, non-root OCI artifact
+contract and a Forgejo publication workflow. `rapp-policy-nexus` owns the
+separately reviewable Helm package, runtime hardening, public smoke checks and
+rollback; `railiance-apps` owns only the production digest binding. DNS already
+resolves and the reef has the required Traefik/cert-manager substrate. A clean
+source release, registry digest, server-side dry-run, deployment and live smoke
+evidence remain before this task can close.
+
 ### T05 — Currency and staleness
 
+```task
+id: POLICY-NEXUS-WP-0001-T05
+status: done
+priority: medium
+```
+
 The relevance half of the repo's purpose. A permanently available document that
 is quietly out of date is worse than no document.
 
@@ -154,8 +207,18 @@ is quietly out of date is worse than no document.
   unratified since 2026-08-10; that fact should be visible on the site, because
   invisibility is precisely why it stalled.
 
+Completed 2026-08-18 for the published corpus. Pages and the index expose
+review due dates and overdue state; `make currency` exits non-zero for stale or
+undeclared review metadata. Expansion follows T03 automatically.
+
 ### T06 — withdrawn
 
+```task
+id: POLICY-NEXUS-WP-0001-T06
+status: done
+priority: low
+```
+
 Regulatory intake moved to `risk-nexus` on 2026-08-17. Deciding what a rule
 demands of the estate is a judgement about risk, not an act of publishing, and
 it wanted a different owner and a different skill from everything above.
@@ -218,11 +281,12 @@ The README's one-line description — "a convergence and publication point for
 government policies" — reads broader than this. Worth updating so the repo does
 not attract the wrong contributions.
 
-## Open questions for the operator
+## Resolved publication scope
 
-1. **Canon subdirectory scope.** `standards` and `architecture` are clearly
-   policy. Are `constitution`, `values`, `tpsc` and `projects` in or out? T03
-   needs a yes or no per directory rather than a wildcard.
+ADR-0001 records the bounded answer: `standards`, `architecture` and
+`constitution` are in; `values`, `tpsc` and `projects` are out unless their
+owner explicitly identifies an individual governing document. T03 must still
+enumerate each publication rather than globbing those trees.
 
 ## Deferred: controlled disclosure