policy-nexus/workplans/PNEX-WP-0006-build-mode-change-authorization.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
PNEX-WP-0006	workplan	Publish the build-mode change authorization guardrail	infotech	policy-nexus	blocked	codex	custodian	2026-10-11	2026-10-19	implementation		774c5037-a3d0-5e65-893c-d18970acd66a

Handoff from the-custodian CUST-WP-0079-T04. On 2026-10-11 the founder adopted a standing build-mode change authorization. The source of truth is the-custodian canon/standards/build-mode-change-authorization_v0.1.md. policy-nexus publishes it, per this repo's intent: publication only, the content stays in canon.

Publish the standard on policy.coulomb.social

id: PNEX-WP-0006-T01
status: wait
priority: high
needs_human: true
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"

Add the standard to the source inventory and publication index. Render it with its machine-checkable YAML block intact. Show expires_on: production-close-down prominently.

Publish the machine-readable rule

id: PNEX-WP-0006-T02
status: wait
priority: high
needs_human: true
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7"

Serve the YAML block as a stable JSON/YAML artifact (for example /guardrails/build-mode-change-authorization.json). CI checks in other repos and access-engine can then fetch and evaluate it deterministically. Add a test that the published artifact equals the canon block.

Implementation and publication boundary (2026-10-11)

T01/T02 source implementation is prepared: canonical document inventory/index entry, visible expiry, canon YAML-derived JSON artifact, digest-bound release verification, and fail-closed local evaluator. Local checks pass; the native public page/artifact have not been published and neither task is closed. Validation receipt: docs/evidence/2026-10-11-build-mode-guardrail/validation.json.

Daily red-lane package: publish only the new build-mode standard and its derived JSON artifact after founder batch disposition and clean source provenance. Expected addresses: /standards/build-mode-change-authorization/v0.1/ and /guardrails/build-mode-change-authorization.json. Abort owner: policy-nexus. Rollback: restore the previously deployed image/source revision; retain all previous immutable publication paths. Verification: canonical page expiry/YAML, JSON equality with the approved canon block, artifact digest and installed source revision. No native action, access-scope change or new spend is authorized by local preparation.

Full source audit also detects the unrelated unreviewed net-kingdom/canon/standards/security-layer-model_v0.9.md. Its owning source publication disposition must be resolved before the release gate passes; this workplan does not silently admit it or edit another owner's standard.

Source automation and remaining gate review — 2026-10-19

The scheduled Forgejo workflow already fetches pinned source revisions and builds source-inventory/source-lock/publication evidence into immutable candidate images. That is generated-output automation, not evidence of a fresh successful run or public promotion. Authored discovery selectors, publication mappings and inventory disposition/reason rows remain owner review inputs.

make source-inventory-review now reuses the owner refresh implementation in a temporary staged snapshot, writing only an ignored discovery-delta report. It does not rewrite or stage authored inputs. Partial staging, duplicate/symlink rejection and preservation of dispositions are tested. No candidate hook or second versioned registry was introduced.

Current source-audit still fails closed for two unreviewed additions: net-kingdom/canon/standards/security-layer-model_v0.9.md (proposed) and railiance-platform/docs/adr/ADR-0006-playwright-consumer-group.md (accepted in its owner source, not yet dispositioned for this publication corpus). The optional review reports both additions and no removals. Neither row was auto-admitted; no authored publication/config/inventory input changed. Both T01 and T02 remain wait for those explicit owner dispositions and the existing founder publication batch. No public release, credential access or runtime mutation was performed.