policy-nexus/workplans/PNEX-WP-0006-build-mode-change-authorization.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
PNEX-WP-0006	workplan	Publish the build-mode change authorization guardrail	infotech	policy-nexus	finished	codex	custodian	2026-10-11	2026-10-19	implementation		774c5037-a3d0-5e65-893c-d18970acd66a

Handoff from the-custodian CUST-WP-0079-T04. On 2026-10-11 the founder adopted a standing build-mode change authorization. The source of truth is the-custodian canon/standards/build-mode-change-authorization_v0.1.md. policy-nexus publishes it, per this repo's intent: publication only, the content stays in canon.

Publish the standard on policy.coulomb.social

id: PNEX-WP-0006-T01
status: done
priority: high
needs_human: false
state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"

Add the standard to the source inventory and publication index. Render it with its machine-checkable YAML block intact. Show expires_on: production-close-down prominently.

Publish the machine-readable rule

id: PNEX-WP-0006-T02
status: done
priority: high
needs_human: false
state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7"

Serve the YAML block as a stable JSON/YAML artifact (for example /guardrails/build-mode-change-authorization.json). CI checks in other repos and access-engine can then fetch and evaluate it deterministically. Add a test that the published artifact equals the canon block.

Implementation and publication boundary (2026-10-11)

T01/T02 source implementation is prepared: canonical document inventory/index entry, visible expiry, canon YAML-derived JSON artifact, digest-bound release verification, and fail-closed local evaluator. Local checks pass; the native public page/artifact have not been published and neither task is closed. Validation receipt: docs/evidence/2026-10-11-build-mode-guardrail/validation.json.

Daily red-lane package: publish only the new build-mode standard and its derived JSON artifact after founder batch disposition and clean source provenance. Expected addresses: /standards/build-mode-change-authorization/v0.1/ and /guardrails/build-mode-change-authorization.json. Abort owner: policy-nexus. Rollback: restore the previously deployed image/source revision; retain all previous immutable publication paths. Verification: canonical page expiry/YAML, JSON equality with the approved canon block, artifact digest and installed source revision. No native action, access-scope change or new spend is authorized by local preparation.

Full source audit also detects the unrelated unreviewed net-kingdom/canon/standards/security-layer-model_v0.9.md. Its owning source publication disposition must be resolved before the release gate passes; this workplan does not silently admit it or edit another owner's standard.

Source automation and remaining gate review — 2026-10-19

The scheduled Forgejo workflow already fetches pinned source revisions and builds source-inventory/source-lock/publication evidence into immutable candidate images. That is generated-output automation, not evidence of a fresh successful run or public promotion. Authored discovery selectors, publication mappings and inventory disposition/reason rows remain owner review inputs.

make source-inventory-review now reuses the owner refresh implementation in a temporary staged snapshot, writing only an ignored discovery-delta report. It does not rewrite or stage authored inputs. Partial staging, duplicate/symlink rejection and preservation of dispositions are tested. No candidate hook or second versioned registry was introduced.

Current source-audit still fails closed for two unreviewed additions: net-kingdom/canon/standards/security-layer-model_v0.9.md (proposed) and railiance-platform/docs/adr/ADR-0006-playwright-consumer-group.md (accepted in its owner source, not yet dispositioned for this publication corpus). The optional review reports both additions and no removals. Neither row was auto-admitted; no authored publication/config/inventory input changed. Both T01 and T02 remain wait for those explicit owner dispositions and the existing founder publication batch. No public release, credential access or runtime mutation was performed.

Delegated inventory review — 2026-10-19

The publication-inventory reviewer has explicitly recorded both discovered rows as metadata-pending, following the existing inventory schema and publication contract. Security-layer-model v0.9 remains proposed-1 with gate-house content ownership and NetKingdom publication ownership; no ratification or publication admission is inferred. RPLAT-ADR-0006 is accepted with complete review metadata, but lacks an explicit publication entry/address. Its pending reason is addressing and publication-owner request, not missing metadata or a fabricated internal-only classification. Neither source is excluded from future consideration.

These are local inventory review decisions under the delegated owner-review task, not source-owner consent to publication. publication.json and source canon remain unchanged. The earlier two-unreviewed-additions blocker is resolved; it is retained above as historical evidence. T01/T02 still wait for the founder daily-batch decision: approve or defer publication of the existing build-mode standard entry and its canon-derived JSON artifact, with the expected addresses, verification and rollback already specified above. This decision does not request admission of either newly inventoried document. Release preparation must still pass current source provenance, currency and immutable-artifact checks; local validation is not live release proof.

Local validation: make check passed all 65 tests and source-audit (186 sources, 74 publication entries, 94 metadata-pending); make release-build passed local rendering, immutable release verification and currency for all 74 entries. Source-set digest: a70bafe26e45d262d062764b955ff9f98ae1e6780c3eee0ef52af6c8ddf00be2. These are local candidate checks, not a served-site or scheduled-CI receipt.

Approved publication and native verification — 2026-10-19

Founder approved exact proposal POLICY-PUB-20261019-BUILD-MODE-GUARDRAIL-R1, revision 1, at conversation:call_5157a09329d34746a3fdf857d5a47b8d:item0. The immutable Custodian packet SHA256SUMS digest is 309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f. Owner hosting paths deployed the exact retained OCI image sha256:214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1 in one atomic upgrade. Helm revision 10 is deployed with 1/1 ready; no rollback was required. Revision 9 remains the verified rollback target.

Both tasks are complete: the public canonical/revision pages carry the visible Expires on: production-close-down banner, and the stable machine-readable JSON is byte-identical to the canon-derived, locally verified artifact. All 150 canonical/revision/index/artifact responses match the retained candidate; all release hashes match; exactly one document was added, with the previous 73 source digests unchanged. Evidence: docs/evidence/2026-10-19-build-mode-publication/receipt.json.

Failed native CI run 89 remains historical failed evidence. Source commit 9fabcce1cb4c83165bcaba8be58d76788b4d87a1 fixed the observed test/build defects; 65 local tests and the owner-format release build passed. This deployment uses the verified local artifact and does not claim a subsequent native CI success or a new vulnerability scan. Two public-verifier date/label assertions were corrected to the authored rendered banner; failed checks remain in the Custodian execution receipt, with no image or deployment change. No publication-scope residual remains; metadata-pending source rows retain their existing independent publication gates.