policy-nexus/workplans/PNEX-WP-0004-fleet-standards-publication-and-ci-source-auth.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on_workplans	state_hub_workstream_id
PNEX-WP-0004	workplan	Publish the first deferred fleet-standards batch and authenticate CI source acquisition	infotech	policy-nexus	active	the-custodian	policy-nexus	2026-08-31	2026-08-31	PNEX-WP-0003	a4f65253-4aab-5a43-8a19-3d07c11da244

PNEX-WP-0004 — fleet standards publication and CI source authentication

Goal

Publish the first coherent return from CUST-IN-0016: five reviewed, Custodian-owned fleet standards. At the same time, make the scheduled Forgejo candidate build capable of reading private source repositories through a dedicated least-privilege credential rather than anonymous HTTP or an admin token.

Done means the five standards have permanent current and immutable URLs, the source inventory and ADR-review ledger reflect the Custodian rulings, the retained-history/currency/release gates pass, and the CI workflow fails closed with an actionable error when its dedicated source-read credential is absent.

Publication batch

id	Source	Address series
canon-autonomy-lanes	canon/standards/autonomy-lanes_v0.1.md	/standards/autonomy-lanes/v0.1/
canon-contrib-convention	canon/standards/contribution-convention_v0.1.md	/standards/contribution-convention/v0.1/
canon-project-repository-flavor	canon/standards/project-repository-flavor_v0.1.md	/standards/project-repository-flavor/v0.1/
canon-work-record-types	canon/standards/work-record-types_v0.1.md	/standards/work-record-types/v0.1/
canon-workplan-terminology-fleet	canon/standards/workplan-terminology-fleet_v0.1.md	/standards/workplan-terminology/v0.1/

All five are owned by the-custodian, reviewed on 2026-08-31, use revision accepted-1, and retain a six-month review interval. Source-owner commit: the-custodian@4b951be.

Explicit exclusions and deferrals

• bootstrap-protocol_v0.1.md and custodian_constitution_v0.1.md declare sensitivity: internal; they must not be published on the public surface.
• repo-classification-standard_v1.0.md remains deferred until its active front-matter and body-level Draft v1.0 statement are reconciled.
• sbom-convention_v0.1.md remains deferred until its authority and operating model are reviewed against current SBOM Nexus architecture.
• The other owner repositories and all five conflict rows stay with CUST-IN-0016; they are not pulled into this bounded batch.

CI credential boundary

fetch_sources.py may accept a Forgejo token only through an environment variable or an explicit caller-provided value. It sends the token solely to the configured Forgejo origin over HTTPS, never prints it, never writes it to source-lock, and refuses a credential for a remote on another origin. The workflow uses a dedicated FORGEJO_SOURCE_TOKEN secret. Registry credentials remain confined to registry login and are not reused for repository reads.

Provisioning the secret is an external Custodian/platform handoff: the token must have organization-private repository read access and no package write, admin, cluster, or deployment authority. Code and tests may land before that secret is installed; the scheduled workflow must fail closed until it is.

Tasks

T01 — Owner review and disclosure gate

id: PNEX-WP-0004-T01
status: done
priority: high
state_hub_task_id: "2301c729-841b-5c5c-a9dd-aa5d4390c36b"

Review the Custodian slice, add truthful publication metadata to the five public fleet standards, and record the internal/deferred sources explicitly in CUST-IN-0016.

Completed 2026-08-31 in the-custodian@4b951be. No normative body text was changed.

T02 — Register and audit the five standards

id: PNEX-WP-0004-T02
status: done
priority: high
state_hub_task_id: "a4378f0b-cf58-5dac-9f8e-2a69b07ff6e3"

Add five explicit publication.json entries, refresh the source inventory and review ledger, and ensure the two internal constitution sources are never classified as publishable output.

Completed 2026-08-31. The explicit registry contains 65 documents; the source audit reports 65 published and 79 metadata-pending sources. The two internal constitution records are ruled local and have no publication address.

T03 — Authenticate private source acquisition

id: PNEX-WP-0004-T03
status: done
priority: high
state_hub_task_id: "e0c0fa67-5a90-5990-a4e9-35e517816a7d"

Add same-origin Forgejo-token support to fetch_sources.py, cover header, redaction, and cross-origin refusal behavior with unit tests, and pass only the dedicated source token from the Forgejo workflow. Authenticate the workflow's own archive download as well as every declared owner-repository fetch.

Completed 2026-08-31. Five authentication-boundary tests cover same-origin header injection, cross-origin refusal, paired token/origin configuration, anonymous mode, and full-revision archive addressing. The complete 22-test suite passes. Installing the read-only Forgejo Actions secret remains the credential-owner handoff and is not a code-completion gate.

T04 — Build and publish the immutable candidate

id: PNEX-WP-0004-T04
status: progress
priority: high
state_hub_task_id: "a6f789ea-5d90-55cf-b67b-5cf401b81e66"

Run make check, retained-history build, currency, and release verification. Publish the OCI candidate and record its image, publication-manifest, source-inventory, and source-set digests.

2026-08-31: the local retained-history build, release verifier, and currency gate pass for all 65 documents. Pre-publication identities are publication manifest c54efb4226f964b8af4e37cebcccda6d3becaa5db1cd9465c166392d2a87c842, source inventory b061ebc593f8e6353929eb795663d66278eca094429f139b6060e7b236e3d8d8, and source set 7e0f0ee3fdf3bcdc8d34e7fc9ba12304ba84864b06c63e9226324e6aa0ea4e7f.

T05 — Promote, smoke, and close

id: PNEX-WP-0004-T05
status: todo
priority: medium
state_hub_task_id: "07c9c18d-95cf-5b09-940a-40b5ff5828a7"

Update the paired rapp-policy-nexus and railiance-apps bindings, pass server-side admission, deploy atomically, and verify all five current and immutable accepted-1 URLs before closing this workplan.

Residuals

• Secret provisioning and rotation remain with the credential owner surfaced by warden route; no token value enters this repository or State Hub.
• CUST-IN-0016 remains open for 26 other-owner metadata returns, two substantive Custodian reviews, and five owner conflict rows. The two internal constitutions are explicit local/excluded outcomes, not publication backlog.