Close approved build-mode guardrail publication with live proof

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181

SCOPE.md

@@ -37,11 +37,13 @@ implement identity or credential custody, or enforce downstream authorization.
 Workplans, evidence, runbooks and general documentation are not publication
 content. Source owners retain control of publication disposition.
 
-The build-mode guardrail implementation is available as source; public release
+The build-mode guardrail and canon-derived machine-readable JSON were published
-acceptance remains tracked in `PNEX-WP-0006`. That record requires founder batch
+under founder-approved proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1 on
-publication disposition. The two discovered source rows were reviewed on 2026-10-19
+2026-10-19. PNEX-WP-0006 is complete: Helm revision 10, 1/1 ready, exact release
-and retained as metadata-pending without changing publication admission. Source
+hashes and all 150 page/artifact responses verified. See
-availability and passing local checks do not establish live publication.
+`docs/evidence/2026-10-19-build-mode-publication/receipt.json`. This proves the
+pinned public release, not downstream enforcement or a fresh native CI run.
+The two discovery rows remain metadata-pending without publication admission.
 
 
 ## Staged work-record generator adoption

WORK-RECORDS.md

@@ -12,7 +12,7 @@
 | workplan | PNEX-WP-0003 | finished | — | workplans/PNEX-WP-0003-adr-review-cleanup-publish.md |
 | workplan | PNEX-WP-0004 | finished | — | workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md |
 | workplan | PNEX-WP-0005 | finished | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
-| workplan | PNEX-WP-0006 | blocked | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
+| workplan | PNEX-WP-0006 | finished | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
 | workplan | POLICY-NEXUS-WP-0001 | finished | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
 | task | PNEX-WP-0002-T01 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md |
 | task | PNEX-WP-0002-T02 | done | — | workplans/PNEX-WP-0002-arc42-architecture-collection.md |
@@ -36,8 +36,8 @@
 | task | PNEX-WP-0005-T01 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
 | task | PNEX-WP-0005-T02 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
 | task | PNEX-WP-0005-T03 | done | — | workplans/PNEX-WP-0005-security-layer-v08-publication.md |
-| task | PNEX-WP-0006-T01 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
+| task | PNEX-WP-0006-T01 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
-| task | PNEX-WP-0006-T02 | wait | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
+| task | PNEX-WP-0006-T02 | done | — | workplans/PNEX-WP-0006-build-mode-change-authorization.md |
 | task | POLICY-NEXUS-WP-0001-T01 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
 | task | POLICY-NEXUS-WP-0001-T02 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |
 | task | POLICY-NEXUS-WP-0001-T03 | done | — | workplans/POLICY-NEXUS-WP-0001-permanent-publication-surface.md |

docs/evidence/2026-10-19-build-mode-publication/receipt.json

@@ -0,0 +1,83 @@
+{
+  "proposal_id": "POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1",
+  "approved_revision": 1,
+  "approved_packet_hashlist_sha256": "309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f",
+  "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+  "result": "verified",
+  "helm_revision": 10,
+  "rollback_required": false,
+  "rollback_revision": 9,
+  "candidate_source_revision": "9fabcce1cb4c83165bcaba8be58d76788b4d87a1",
+  "candidate_origin": "local owner-format build; native CI run89 retained failed, no new CI success claimed",
+  "change_gate": {
+    "decision": "the-custodian/docs/kubernetes-change-gate-decision.md",
+    "target_tier": "production",
+    "readiness_state": "production-approved",
+    "path": "direct-administer-transition",
+    "auth_mode": "ADMINISTER @ realm:kubernetes/railiance01",
+    "activation": "APPROVED",
+    "evidence_boundary": "target-audited",
+    "transition_ends": "2026-12-21"
+  },
+  "native": {
+    "capture_utc": "2026-10-19T13:35:06.098696+00:00",
+    "cluster_mutated": false,
+    "expected_node_ip": "92.205.62.239",
+    "expected_node_ip_present": true,
+    "helm_revision": 10,
+    "helm_status": "deployed",
+    "image_matches_candidate": true,
+    "machine_id_sha256": "fe7367a60951922122af7ba18ed2cde65c7e0a232bbedfb045cb575de2094c2f",
+    "ready_replicas": 1,
+    "release_pin_matches": {
+      "publication-manifest-digest": true,
+      "source-inventory-digest": true,
+      "source-set-digest": true
+    },
+    "replicas": 1,
+    "secret_values_observed": false,
+    "ssh_alias": "railiance01"
+  },
+  "public": {
+    "verified": true,
+    "capture_utc": "2026-10-19T13:36:20.944233+00:00",
+    "hashes": {
+      "publication_manifest_digest": "8c74b4e414f7760429600b7ba0b3627fcfe438417bfe6695f55acfa6905d352e",
+      "source_inventory_digest": "e84453b6b411a7d66d2b5efbf083cd0033441d6b12983326442933da87bf61fd",
+      "source_lock_digest": "c150c6c0745441b4b69884ecc6cf55e97db26080fcf4c2224775b1f755580529"
+    },
+    "source_set_digest": "b00535063c56ede08f0a292b301a47add18bf70f81904bf3f434c8faa5ebe682",
+    "document_count": 74,
+    "previous73_source_digests_unchanged": true,
+    "added_document": "canon-build-mode-change-authorization",
+    "all_canonical_and_revision_pages_byte_equal_candidate": true,
+    "page_and_artifact_count": 150,
+    "guardrail_expiry_banner": "Expires on: production-close-down",
+    "guardrail_json_byte_equal_verified_candidate": true,
+    "guardrail_json_sha256": "a86462a57bb1df5804d3088881af22569082d43ff68bcab2b67cbe56b6fc46cd",
+    "tls_verified": true,
+    "refinements": [
+      "Initial verifier incorrectly expected hosting transition date2026-12-21 in canon expiry.",
+      "Second verifier expected source expires_on label rather than rendered Expires on.",
+      "Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged."
+    ]
+  },
+  "deployment": {
+    "started_utc": "2026-10-19T13:34:20.566225+00:00",
+    "command": [
+      "make",
+      "policy-nexus-deploy",
+      "POLICY_NEXUS_TARGET=railiance01"
+    ],
+    "atomic": true,
+    "attempt": 1,
+    "approval_ref": "conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0",
+    "completed_utc": "2026-10-19T13:34:26.648713+00:00",
+    "returncode": 0,
+    "raw_output_suppressed": true
+  },
+  "owner_source_commits": {
+    "rapp-policy-nexus": "6ead90ffa4ae5742c37c292485762e83113382c3",
+    "railiance-apps": "3be92daf74a7572319bfe94dd882a70430528343"
+  }
+}

workplans/PNEX-WP-0006-build-mode-change-authorization.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Publish the build-mode change authorization guardrail"
 domain: infotech
 repo: policy-nexus
-status: blocked
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-10-11"
@@ -23,10 +23,9 @@ repo's intent: publication only, the content stays in canon.
 
 ```task
 id: PNEX-WP-0006-T01
-status: wait
+status: done
 priority: high
-needs_human: true
+needs_human: false
-intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
 state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"
 ```
 
@@ -37,10 +36,9 @@ machine-checkable YAML block intact. Show `expires_on: production-close-down` pr
 
 ```task
 id: PNEX-WP-0006-T02
-status: wait
+status: done
 priority: high
-needs_human: true
+needs_human: false
-intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
 state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7"
 ```
 
@@ -123,3 +121,31 @@ Local validation: `make check` passed all 65 tests and source-audit (186 sources
 rendering, immutable release verification and currency for all 74 entries.
 Source-set digest: `a70bafe26e45d262d062764b955ff9f98ae1e6780c3eee0ef52af6c8ddf00be2`.
 These are local candidate checks, not a served-site or scheduled-CI receipt.
+
+
+## Approved publication and native verification — 2026-10-19
+
+Founder approved exact proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1,
+revision 1, at `conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0`.
+The immutable Custodian packet SHA256SUMS digest is
+`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`.
+Owner hosting paths deployed the exact retained OCI image
+`sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1`
+in one atomic upgrade. Helm revision 10 is deployed with 1/1 ready; no rollback
+was required. Revision 9 remains the verified rollback target.
+
+Both tasks are complete: the public canonical/revision pages carry the visible
+`Expires on: production-close-down` banner, and the stable machine-readable JSON
+is byte-identical to the canon-derived, locally verified artifact. All 150
+canonical/revision/index/artifact responses match the retained candidate; all
+release hashes match; exactly one document was added, with the previous 73 source
+digests unchanged. Evidence: `docs/evidence/2026-10-19-build-mode-publication/receipt.json`.
+
+Failed native CI run 89 remains historical failed evidence. Source commit
+`9fabcce1cb4c83165bcaba8be58d76788b4d87a1` fixed the observed test/build defects;
+65 local tests and the owner-format release build passed. This deployment uses
+the verified local artifact and does not claim a subsequent native CI success or
+a new vulnerability scan. Two public-verifier date/label assertions were corrected
+to the authored rendered banner; failed checks remain in the Custodian execution
+receipt, with no image or deployment change. No publication-scope residual remains;
+metadata-pending source rows retain their existing independent publication gates.