policy-nexus/workplans/PNEX-WP-0006-build-mode-change-authorization.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
PNEX-WP-0006	workplan	Publish the build-mode change authorization guardrail	infotech	policy-nexus	blocked	codex	custodian	2026-10-11	2026-10-19	implementation		774c5037-a3d0-5e65-893c-d18970acd66a

Handoff from the-custodian CUST-WP-0079-T04. On 2026-10-11 the founder adopted a standing build-mode change authorization. The source of truth is the-custodian canon/standards/build-mode-change-authorization_v0.1.md. policy-nexus publishes it, per this repo's intent: publication only, the content stays in canon.

Publish the standard on policy.coulomb.social

id: PNEX-WP-0006-T01
status: wait
priority: high
needs_human: true
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
state_hub_task_id: "ee3c6f88-91b5-5dac-94e7-d1b05b0276bc"

Add the standard to the source inventory and publication index. Render it with its machine-checkable YAML block intact. Show expires_on: production-close-down prominently.

Publish the machine-readable rule

id: PNEX-WP-0006-T02
status: wait
priority: high
needs_human: true
intervention_note: "Public publication is red-lane; add PNEX-WP-0006 to the single daily founder batch. Local code and tests are prepared; no per-item approval request."
state_hub_task_id: "92247888-82ad-52ca-962f-1a578adeb9f7"

Serve the YAML block as a stable JSON/YAML artifact (for example /guardrails/build-mode-change-authorization.json). CI checks in other repos and access-engine can then fetch and evaluate it deterministically. Add a test that the published artifact equals the canon block.

Implementation and publication boundary (2026-10-11)

T01/T02 source implementation is prepared: canonical document inventory/index entry, visible expiry, canon YAML-derived JSON artifact, digest-bound release verification, and fail-closed local evaluator. Local checks pass; the native public page/artifact have not been published and neither task is closed. Validation receipt: docs/evidence/2026-10-11-build-mode-guardrail/validation.json.

Daily red-lane package: publish only the new build-mode standard and its derived JSON artifact after founder batch disposition and clean source provenance. Expected addresses: /standards/build-mode-change-authorization/v0.1/ and /guardrails/build-mode-change-authorization.json. Abort owner: policy-nexus. Rollback: restore the previously deployed image/source revision; retain all previous immutable publication paths. Verification: canonical page expiry/YAML, JSON equality with the approved canon block, artifact digest and installed source revision. No native action, access-scope change or new spend is authorized by local preparation.

Full source audit also detects the unrelated unreviewed net-kingdom/canon/standards/security-layer-model_v0.9.md. Its owning source publication disposition must be resolved before the release gate passes; this workplan does not silently admit it or edit another owner's standard.

Source automation and remaining gate review — 2026-10-19

The scheduled Forgejo workflow already fetches pinned source revisions and builds source-inventory/source-lock/publication evidence into immutable candidate images. That is generated-output automation, not evidence of a fresh successful run or public promotion. Authored discovery selectors, publication mappings and inventory disposition/reason rows remain owner review inputs.

make source-inventory-review now reuses the owner refresh implementation in a temporary staged snapshot, writing only an ignored discovery-delta report. It does not rewrite or stage authored inputs. Partial staging, duplicate/symlink rejection and preservation of dispositions are tested. No candidate hook or second versioned registry was introduced.

Current source-audit still fails closed for two unreviewed additions: net-kingdom/canon/standards/security-layer-model_v0.9.md (proposed) and railiance-platform/docs/adr/ADR-0006-playwright-consumer-group.md (accepted in its owner source, not yet dispositioned for this publication corpus). The optional review reports both additions and no removals. Neither row was auto-admitted; no authored publication/config/inventory input changed. Both T01 and T02 remain wait for those explicit owner dispositions and the existing founder publication batch. No public release, credential access or runtime mutation was performed.

Delegated inventory review — 2026-10-19

The publication-inventory reviewer has explicitly recorded both discovered rows as metadata-pending, following the existing inventory schema and publication contract. Security-layer-model v0.9 remains proposed-1 with gate-house content ownership and NetKingdom publication ownership; no ratification or publication admission is inferred. RPLAT-ADR-0006 is accepted with complete review metadata, but lacks an explicit publication entry/address. Its pending reason is addressing and publication-owner request, not missing metadata or a fabricated internal-only classification. Neither source is excluded from future consideration.

These are local inventory review decisions under the delegated owner-review task, not source-owner consent to publication. publication.json and source canon remain unchanged. The earlier two-unreviewed-additions blocker is resolved; it is retained above as historical evidence. T01/T02 still wait for the founder daily-batch decision: approve or defer publication of the existing build-mode standard entry and its canon-derived JSON artifact, with the expected addresses, verification and rollback already specified above. This decision does not request admission of either newly inventoried document. Release preparation must still pass current source provenance, currency and immutable-artifact checks; local validation is not live release proof.

Local validation: make check passed all 65 tests and source-audit (186 sources, 74 publication entries, 94 metadata-pending); make release-build passed local rendering, immutable release verification and currency for all 74 entries. Source-set digest: a70bafe26e45d262d062764b955ff9f98ae1e6780c3eee0ef52af6c8ddf00be2. These are local candidate checks, not a served-site or scheduled-CI receipt.