Authority is three-way and stated rather than held by one repo: policy-nexus
owns the surface, the-custodian owns what counts as canon and when it is
ratified, railiance-platform owns the substrate. The middle one is the guard
against the real hazard here - a repo that reads every other repo is one step
from becoming the place where "what is current" is decided, and this says
plainly that it renders that judgement rather than making it.
The tell that the split is right is that T01 and T04 need different
competences. T01 asks what supersession means and what a permanent URL
promises; T04 is DNS and ingress. One owner would be weak at one of them.
T06 withdrawn. Regulatory intake is risk work, not publishing work, and it
wanted a different owner and a different skill from everything else in this
workplan. risk-nexus publishes through here, arriving as another manifest
source rather than as a second content type this repo curates.
The consequence is the point: this repo now does one thing, which is what made
its ownership answerable.
Domain corrected from government, a leftover from when this looked like a civic
policy site.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The forcing case is now tenancy-posture_v0.1, not Custodian ADR-008, and the
renderer is tools/render.py rather than a path in another repo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The renderer and its stylesheet moved in from the-custodian with a make build
target, so T02 generalises something that works rather than starting from
scratch. Publication tooling belongs to the repo that owns publication.
Disclosure is resolved for now: full public is fine in build mode, where there
are no users to expose and no attacker with anything to gain. Recorded as
deferred rather than closed, because it stops being true at production - the
same blast-radius disclosure that a consumer must read becomes a map once real
tenant data exists.
Controlled disclosure is deliberately not this repo's job. Publication is about
permanence and currency; embargo is about severity, remediation and timing, and
building it here would put risk judgement in the repo least qualified to make
it. It likely wants a service of its own - a risk-nexus - with this repo as its
publication surface rather than its brain.
The only cost today is one line in T01: the addressing scheme must not assume
every document is public from birth, so that adding an embargo state later is a
new status rather than a URL migration.
First publication retargeted - the framework relocated to NetKingdom canon and
is now tenancy-posture_v0.1, five axes rather than five planes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator answered the two blocking questions, so T06 is now specifiable and
T03 has a bounded corpus: two canon trees and roughly 68 ADRs across 18
repositories. Workplans, evidence and runbooks are out - a site that publishes
everything publishes nothing in particular.
T06 gains an inclusion test (does the rule constrain something the estate
actually does), a record format, and a candidate register drawn from what the
estate demonstrably touches rather than from a list of well-known regulations -
data protection and erasure, residency, procurement via vergabe-teilnahme,
identity assurance via the aal2 class, and the agentic tenant grouping. The
register is to confirm, not to assume.
The hard rule is now in the format itself: a record states what a source said
and when. Interpretation belongs to the repo making the decision. The estate
has no legal function and this repo must not grow one by accident.
Rewrote the README, which described a broader civic corpus than the repo is
scoped to and would have attracted the wrong contributions.
One question got sharper rather than resolved: publishing every ADR across 18
repos puts the estate's architecture, known gaps and residual risks in one
indexed public place. That is right for a document consumers must read, and it
is a decision to take deliberately rather than inherit from a default.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
policy.coulomb.social replaces disposable artifact-page publication. The repo
has two halves - publishing estate policy outward, and gathering external
policy inward - and one standing constraint: it reads from the repos that own
policy and never writes back, so it cannot become a second source of truth.
WP-0001 is scoped by a forcing case. ADR-008 needs review from six repos and
is currently served from a private URL that may not resolve later. It is both
the first publication and the acceptance test: if the site cannot carry five
ladders, a threat matrix, an E x P grid and twelve owner-attributed questions,
the site is not finished.
T01 fixes addressing and the permanence promise before anything is built,
because changing it later breaks the one thing this repo exists to guarantee.
T02 takes over the renderer that already exists in the-custodian rather than
reimplementing it - stdlib-only is an acceptance criterion, not a preference.
T06 is deliberately last and carries a hard rule: a gathered record says what
a source said and when, never what the estate must therefore do.
Four questions left open for the operator, including who owns this and whether
"government policies" in the README means regulation bearing on the estate or
a broader public corpus. T06 cannot be specified until that is answered.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
