policy-nexus/workplans/PNEX-WP-0005-security-layer-v08-publication.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
PNEX-WP-0005	workplan	Publish the accepted security-layer v0.8 guardrails	infotech	policy-nexus	finished	codex	custodian	2026-10-11	2026-10-11	implementation		20adecb1-98b5-5a8e-9550-9aa0bc5087b8

Native human memo infd-20261010-security-layer-v08 revision2 accepted exact proposed source103a635f; confirmed approval8432d0dc. NetKingdom accepted artifact 3d829856 is committed in0e17d956ab45f8c4a0163b70749490c414e54e67. This is new requested publication demand, not a residual or duplicate checker migration. GH-WP-0004-T11 is source-complete; hosting is this owner's task.

Register accepted source and preserve history

id: PNEX-WP-0005-T01
status: done
priority: high
state_hub_task_id: "0c18f3d3-2cb3-5677-a901-326b8c86865f"

Register accepted-1 v0.8 and superseded currentv0.7 notice; retain immutable historicalv0.7 source/page bytes. Full local73document build succeeded. Inventory refresh adds13 previously unreviewed discovered records as metadata-pending, changes no existing disposition and publishes none of those13. Exact memo/source and native acceptance receipts stay with NetKingdom and Custodian evidence.

Produce a verified source-bound publisher candidate

id: PNEX-WP-0005-T02
status: done
priority: high
state_hub_task_id: "8adf9d79-2a4f-5441-9eaa-9e74fbe87c5d"

Retain immutable fetched source revision lock, content/manifest hashes and full release verification. Local build alone is not a served publication. Dated Custodian ADR002/004 technical annotations preserve the original decisions and author/date; original served accepted-1 pages are retained. All72 served immutable pages and their exact owner source commits are verified. Independent review caught and fixed overwrite/provenance/routing defects;52actualowner tests pass with the CI source-root environment. The first CI run failed a fixture environment leak; repaired exactsource CI is being observed, not presumed ready. Publish/verify the candidate through documented owner CI; retain any failed checks and exact release output before proposing native activation.

Serve and verify the accepted guardrails

id: PNEX-WP-0005-T03
status: done
priority: high
state_hub_task_id: "d4d28d79-4991-5079-93bf-16c66d678cb3"

Prepare exact hosting revision/image and rollback, native resource/headroom preflight and source-bound deployment diff. Obtain required scoped supervisor disposition if hosting activation is outside the existing source-publication approval. Execute through owner path; independently verify v0.8 accepted page, old route supersession notice and immutableoldrevision survival. No permission or PDP/runtime capability is introduced by publishing static guardrails.

2026-10-11 record identity correction: initial new-plan ID PNEX-WP-0004 collided with the finished fleet-standards/source-auth plan. This new demand is PNEX-WP-0005; older plan/tasks/UUIDs remain unchanged. The failed create receipt is preserved; no historical task or workstream is retired to hide it.

2026-10-11 verified published candidate: CIrun78 exactb64a0c5 SUCCESS; image 4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06. Rawsource-lock/inventory/manifest/source-set/image labels verified;73 source hashes/currentHTTPpages and72 immutablehistoryHTTPpages match. Fullscan70 packages zero all-severity findings;52tests pass withCIenvironment. Earlier fixture failure, two-CRITICAL/39-HIGH candidate, localbuild mistakes and review refinements remain in docs/evidence/2026-10-11-runtime-release-verification. T03 remains open pending exacthostingpacket ownerreview/humandisposition/native activation, with oldHelmrev8 stilllive. No hosting grant inferred fromsource acceptance orCI.

2026-10-11 native publication complete: exact R1 human approval52a3c479 confirmed01:14:23Z. Existing owner Helm lane upgraded to revision9/deployed 01:23:42Z; exact approved4e0db6 image, paired provenance and all nine existing UID/defaulted configurations verified, Ready1/generation9. Public158file hashes match actual candidate bytes, including73current documents and72old immutable paths; TLSReady/HTTPShealth/legacy308/404 pass. Source selection reconciled to actual approved four pins. See rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting. Initial failed pre-actuation/namespace refinement and prior source/CI failures remain retained; no rollback used. Argo adoption stays with RPF-WP-0043 and RAPP-POLICY-NEXUS-WP-0002. Metadata-pending discovered records remain the existing publication intake inventory and were not silently published. No new PDP permission, conformity claim or owner ratification is introduced.