coulomb/policy-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A policy management service
76 commits 1 branch 0 tags 3.5 MiB
Find a file
tegwick 28c6da022f build: keep generated orientation brief local and untracked 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
2026-10-19 13:44:21 +02:00
.forgejo/workflows Isolate publication fixtures and bind CI receipts to immutable image 2026-10-11 02:28:04 +02:00
build feat: publish Risk Nexus findings and methods 2026-09-01 01:56:46 +02:00
deploy Build immutable policy publication artifact 2026-08-18 12:16:04 +02:00
docs build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
intakes PNEX-IN-0001 closed: source inventory key flex-auth -> access-engine 2026-09-30 20:43:32 +02:00
registry docs: declare policy publication reuse scope 2026-10-19 11:24:51 +02:00
tests build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
tools build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
workplans build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
.generated-work-records.json build: adopt staged work-record generation 2026-10-19 11:33:57 +02:00
.generated-work-records.mk build: adopt staged work-record generation 2026-10-19 11:33:57 +02:00
.gitignore build: keep generated orientation brief local and untracked 2026-10-19 13:44:21 +02:00
.repo-classification.yaml Record Policy Nexus production verification 2026-08-18 12:55:14 +02:00
Containerfile Refresh static publisher runtime and exact fixed Alpine packages 2026-10-11 02:47:02 +02:00
INTENT.md Build immutable policy publication artifact 2026-08-18 12:16:04 +02:00
Makefile build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
publication.json Publish canon-derived build-mode guardrail source and evaluator 2026-10-11 21:30:47 +02:00
README.md feat: publish Risk Nexus findings and methods 2026-09-01 01:56:46 +02:00
SCOPE.md build: keep generated orientation brief local and untracked 2026-10-19 13:44:21 +02:00
source-inventory.config.json PNEX-IN-0001 closed: source inventory key flex-auth -> access-engine 2026-09-30 20:43:32 +02:00
source-inventory.json Publish canon-derived build-mode guardrail source and evaluator 2026-10-11 21:30:47 +02:00
WORK-RECORDS.md build: adopt staged work-record generation 2026-10-19 11:33:57 +02:00

README.md

policy-nexus

Permanent publication for the estate's policy surface. Serves policy.coulomb.social.

This repo publishes estate canon, architecture decisions, and explicitly disclosed risk records from the repositories that own them, at stable URLs, with visible status and currency. Pages are generated, never authored here: the source of truth stays upstream and this repo never writes back.

Regulatory intake and disclosure decisions belong to risk-nexus; publishable records may arrive from it like any other source. This repo does not interpret them.

Not a CMS, not a documentation site, not a policy author, and not a source of legal advice.

  • Intent: INTENT.md
  • Owner publication contract: docs/publication-contract.md
  • ADR review ledger (unpublished work artefact): docs/adr-review/
  • Workplans: workplans/

Build and verify the publication locally with:

make check
make build
make currency

publication.json is the explicit source and address registry. A build fails closed when a source is unavailable or an immutable revision would change. source-inventory.config.json defines the bounded canon/ADR discovery scope, while source-inventory.json records an explicit reviewed disposition for every matching source. make source-audit fails when a source appears or disappears without that review. Working-tree-only files in sibling repos do not affect the audit; local checks inspect committed Git trees.

The Forgejo workflow pulls exact main revisions for all inventoried source repos every day at 04:17 UTC and on manual dispatch. It fails visibly on an unavailable source, unreviewed inventory drift, invalid release, or overdue published document. Successful runs publish immutable source-<source-set-digest> candidates and a moving discovery tag, but never deploy them. Production promotion remains an explicit review of the registry-resolved OCI digest and publication-manifest digest together in rapp-policy-nexus and railiance-apps.

Production publication is split from runtime ownership. This repository builds and publishes the immutable OCI site image; rapp-policy-nexus owns the Helm package, exposure checks, and rollback; railiance-apps selects the approved production digests. A release build additionally refuses dirty or synthetic source provenance:

make release-build
make image-build IMAGE_REF=forgejo.coulomb.social/coulomb/policy-nexus:git-$(git rev-parse HEAD)

Tags are discovery handles only. Production always records the registry-resolved OCI digest and the SHA-256 of build/publication-manifest.json.