policy-nexus/SCOPE.md

domain	repo	updated
capabilities	policy-nexus	2026-10-19

Scope

Policy Nexus publishes estate policy from its owning repositories at stable, versioned addresses. It owns publication and currency; policy content and ratification remain with the source owners (see INTENT.md).

Provided capabilities

• Generate policy pages and indexes from publication.json, retaining source revision, review status, superseded versions and immutable publication paths.
• Inventory canon and ADR sources and detect unpublished or changed source documents with tools/source_inventory.py and tools/check_currency.py.
• Build and verify release artifacts with make build and make release-check; verify source provenance before publishing a release.
• Extract the build-mode authorization rule from the Custodian canon YAML block into /guardrails/build-mode-change-authorization.json, with visible lifetime on the generated policy page. tools/guardrails.py validates and evaluates the restricted rule format, failing closed for unknown categories and malformed inputs. This is local lane classification, not a runtime authorization token.

The discovery declaration is registry/capabilities/capability.security.policy-publication.md, indexed by registry/indexes/capabilities.yaml for reuse-surface consumption. Consumers should use the publication contract in docs/publication-contract.md rather than copy policy into this repository.

Boundaries and current acceptance

Policy Nexus does not author or ratify policy, interpret external regulations, implement identity or credential custody, or enforce downstream authorization. Workplans, evidence, runbooks and general documentation are not publication content. Source owners retain control of publication disposition.

The build-mode guardrail implementation is available as source; public release acceptance remains tracked in PNEX-WP-0006. That record requires founder batch publication disposition. The two discovered source rows were reviewed on 2026-10-19 and retained as metadata-pending without changing publication admission. Source availability and passing local checks do not establish live publication.

Staged work-record generator adoption

The tracked .generated-work-records.json opts this repository into the shared pre-commit generation lane. make generated-work-records uses the isolated .generated-work-records.mk recipe and the Custodian adapter to render from staged Markdown with the existing State Hub renderer. make generated-work-records-check verifies the staged result without writes. Unstaged source edits are preserved; unstaged generated-file edits and unresolved conflicts stop the commit. The existing generated-only guard and secret scan remain in place. This adoption covers WORK-RECORDS.md only; other owner indexes retain their own generators. It makes no schedule or public-release change.

Inventory source and generated publication evidence

source-inventory.config.json, publication.json, and the disposition/reason rows in source-inventory.json are authored review inputs. They must not be blindly refreshed by a hook. The existing scheduled Forgejo publication workflow fetches the configured source revisions and builds generated source inventory, source-lock and publication manifests inside the immutable candidate image. The scheduled workflow is source automation; no fresh successful run or public release is claimed by this declaration.

make source-inventory-review invokes tools/staged_source_inventory.py to review the exact staged inputs with the existing owner refresh implementation in a temporary snapshot. It emits only an ignored build/ discovery delta, preserves authored dispositions and Git staging, and fails on unresolved discovery changes. This optional review command does not apply candidate rows, publish, or bypass source-audit. The source inventory remains an explicit owner gate; WORK-RECORDS pre-commit generation does not reinterpret it as disposable output.

Local orientation brief

.custodian-brief.md is a generated local orientation snapshot. It remains on disk for offline use and is root-ignored rather than versioned. Regenerate it with the State Hub brief renderer; workplans and other authored repository records remain authoritative. Brief refreshes must not create Git commits.