policy-nexus

Permanent publication for the estate's policy surface. Serves policy.coulomb.social.

This repo publishes estate canon, architecture decisions, and explicitly disclosed risk records from the repositories that own them, at stable URLs, with visible status and currency. Pages are generated, never authored here: the source of truth stays upstream and this repo never writes back.

Regulatory intake and disclosure decisions belong to risk-nexus; publishable records may arrive from it like any other source. This repo does not interpret them.

Not a CMS, not a documentation site, not a policy author, and not a source of legal advice.

• Intent: INTENT.md
• Owner publication contract: docs/publication-contract.md
• ADR review ledger (unpublished work artefact): docs/adr-review/
• Workplans: workplans/

Build and verify the publication locally with:

make check
make build
make currency

publication.json is the explicit source and address registry. A build fails closed when a source is unavailable or an immutable revision would change. source-inventory.config.json defines the bounded canon/ADR discovery scope, while source-inventory.json records an explicit reviewed disposition for every matching source. make source-audit fails when a source appears or disappears without that review. Working-tree-only files in sibling repos do not affect the audit; local checks inspect committed Git trees.

The Forgejo workflow pulls exact main revisions for all inventoried source repos every day at 04:17 UTC and on manual dispatch. It fails visibly on an unavailable source, unreviewed inventory drift, invalid release, or overdue published document. Successful runs publish immutable source-<source-set-digest> candidates and a moving discovery tag, but never deploy them. Production promotion remains an explicit review of the registry-resolved OCI digest and publication-manifest digest together in rapp-policy-nexus and railiance-apps.

Production publication is split from runtime ownership. This repository builds and publishes the immutable OCI site image; rapp-policy-nexus owns the Helm package, exposure checks, and rollback; railiance-apps selects the approved production digests. A release build additionally refuses dirty or synthetic source provenance:

make release-build
make image-build IMAGE_REF=forgejo.coulomb.social/coulomb/policy-nexus:git-$(git rev-parse HEAD)

Tags are discovery handles only. Production always records the registry-resolved OCI digest and the SHA-256 of build/publication-manifest.json.