--- domain: capabilities repo: policy-nexus updated: "2026-10-19" --- # Scope Policy Nexus publishes estate policy from its owning repositories at stable, versioned addresses. It owns publication and currency; policy content and ratification remain with the source owners (see `INTENT.md`). ## Provided capabilities - Generate policy pages and indexes from `publication.json`, retaining source revision, review status, superseded versions and immutable publication paths. - Inventory canon and ADR sources and detect unpublished or changed source documents with `tools/source_inventory.py` and `tools/check_currency.py`. - Build and verify release artifacts with `make build` and `make release-check`; verify source provenance before publishing a release. - Extract the build-mode authorization rule from the Custodian canon YAML block into `/guardrails/build-mode-change-authorization.json`, with visible lifetime on the generated policy page. `tools/guardrails.py` validates and evaluates the restricted rule format, failing closed for unknown categories and malformed inputs. This is local lane classification, not a runtime authorization token. The discovery declaration is `registry/capabilities/capability.security.policy-publication.md`, indexed by `registry/indexes/capabilities.yaml` for reuse-surface consumption. Consumers should use the publication contract in `docs/publication-contract.md` rather than copy policy into this repository. ## Boundaries and current acceptance Policy Nexus does not author or ratify policy, interpret external regulations, implement identity or credential custody, or enforce downstream authorization. Workplans, evidence, runbooks and general documentation are not publication content. Source owners retain control of publication disposition. The build-mode guardrail implementation is available as source; public release acceptance remains tracked in `PNEX-WP-0006`. That record requires founder batch publication disposition and resolution of the source inventory gate. Source availability and passing local checks do not establish live publication.