The renderer and its stylesheet moved in from the-custodian with a make build
target, so T02 generalises something that works rather than starting from
scratch. Publication tooling belongs to the repo that owns publication.
Disclosure is resolved for now: full public is fine in build mode, where there
are no users to expose and no attacker with anything to gain. Recorded as
deferred rather than closed, because it stops being true at production - the
same blast-radius disclosure that a consumer must read becomes a map once real
tenant data exists.
Controlled disclosure is deliberately not this repo's job. Publication is about
permanence and currency; embargo is about severity, remediation and timing, and
building it here would put risk judgement in the repo least qualified to make
it. It likely wants a service of its own - a risk-nexus - with this repo as its
publication surface rather than its brain.
The only cost today is one line in T01: the addressing scheme must not assume
every document is public from birth, so that adding an embargo state later is a
new status rather than a URL migration.
First publication retargeted - the framework relocated to NetKingdom canon and
is now tenancy-posture_v0.1, five axes rather than five planes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator answered the two blocking questions, so T06 is now specifiable and
T03 has a bounded corpus: two canon trees and roughly 68 ADRs across 18
repositories. Workplans, evidence and runbooks are out - a site that publishes
everything publishes nothing in particular.
T06 gains an inclusion test (does the rule constrain something the estate
actually does), a record format, and a candidate register drawn from what the
estate demonstrably touches rather than from a list of well-known regulations -
data protection and erasure, residency, procurement via vergabe-teilnahme,
identity assurance via the aal2 class, and the agentic tenant grouping. The
register is to confirm, not to assume.
The hard rule is now in the format itself: a record states what a source said
and when. Interpretation belongs to the repo making the decision. The estate
has no legal function and this repo must not grow one by accident.
Rewrote the README, which described a broader civic corpus than the repo is
scoped to and would have attracted the wrong contributions.
One question got sharper rather than resolved: publishing every ADR across 18
repos puts the estate's architecture, known gaps and residual risks in one
indexed public place. That is right for a document consumers must read, and it
is a decision to take deliberately rather than inherit from a default.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
policy.coulomb.social replaces disposable artifact-page publication. The repo
has two halves - publishing estate policy outward, and gathering external
policy inward - and one standing constraint: it reads from the repos that own
policy and never writes back, so it cannot become a second source of truth.
WP-0001 is scoped by a forcing case. ADR-008 needs review from six repos and
is currently served from a private URL that may not resolve later. It is both
the first publication and the acceptance test: if the site cannot carry five
ladders, a threat matrix, an E x P grid and twelve owner-attributed questions,
the site is not finished.
T01 fixes addressing and the permanence promise before anything is built,
because changing it later breaks the one thing this repo exists to guarantee.
T02 takes over the renderer that already exists in the-custodian rather than
reimplementing it - stdlib-only is an acceptance criterion, not a preference.
T06 is deliberately last and carries a hard rule: a gathered record says what
a source said and when, never what the estate must therefore do.
Four questions left open for the operator, including who owns this and whether
"government policies" in the README means regulation bearing on the estate or
a broader public corpus. T06 cannot be specified until that is answered.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
