coulomb/policy-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A policy management service
80 commits 1 branch 0 tags 3.5 MiB
Find a file
Exact
tegwick edba47492e Declare the live release units for this owner. 
The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.

Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
2026-10-23 15:49:57 +02:00
.forgejo/workflows Isolate publication fixtures and bind CI receipts to immutable image 2026-10-11 02:28:04 +02:00
build feat: publish Risk Nexus findings and methods 2026-09-01 01:56:46 +02:00
deploy Build immutable policy publication artifact 2026-08-18 12:16:04 +02:00
docs Close approved build-mode guardrail publication with live proof 2026-10-19 15:37:32 +02:00
intakes PNEX-IN-0001 closed: source inventory key flex-auth -> access-engine 2026-09-30 20:43:32 +02:00
registry Declare the live release units for this owner. 2026-10-23 15:49:57 +02:00
tests Fix release-builder Git dependency and isolate guardrail fixture sources 2026-10-19 15:03:35 +02:00
tools build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
workplans Close approved build-mode guardrail publication with live proof 2026-10-19 15:37:32 +02:00
.generated-work-records.json build: adopt staged work-record generation 2026-10-19 11:33:57 +02:00
.generated-work-records.mk build: adopt staged work-record generation 2026-10-19 11:33:57 +02:00
.gitignore build: keep generated orientation brief local and untracked 2026-10-19 13:44:21 +02:00
.repo-classification.yaml Record Policy Nexus production verification 2026-08-18 12:55:14 +02:00
Containerfile Fix release-builder Git dependency and isolate guardrail fixture sources 2026-10-19 15:03:35 +02:00
INTENT.md Build immutable policy publication artifact 2026-08-18 12:16:04 +02:00
Makefile build: review staged source inventory without changing owner dispositions 2026-10-19 13:42:46 +02:00
publication.json Publish canon-derived build-mode guardrail source and evaluator 2026-10-11 21:30:47 +02:00
README.md feat: publish Risk Nexus findings and methods 2026-09-01 01:56:46 +02:00
SCOPE.md Close approved build-mode guardrail publication with live proof 2026-10-19 15:37:32 +02:00
source-inventory.config.json PNEX-IN-0001 closed: source inventory key flex-auth -> access-engine 2026-09-30 20:43:32 +02:00
source-inventory.json review: disposition discovered policy sources without publication admission 2026-10-19 14:29:29 +02:00
WORK-RECORDS.md Close approved build-mode guardrail publication with live proof 2026-10-19 15:37:32 +02:00

README.md

policy-nexus

Permanent publication for the estate's policy surface. Serves policy.coulomb.social.

This repo publishes estate canon, architecture decisions, and explicitly disclosed risk records from the repositories that own them, at stable URLs, with visible status and currency. Pages are generated, never authored here: the source of truth stays upstream and this repo never writes back.

Regulatory intake and disclosure decisions belong to risk-nexus; publishable records may arrive from it like any other source. This repo does not interpret them.

Not a CMS, not a documentation site, not a policy author, and not a source of legal advice.

  • Intent: INTENT.md
  • Owner publication contract: docs/publication-contract.md
  • ADR review ledger (unpublished work artefact): docs/adr-review/
  • Workplans: workplans/

Build and verify the publication locally with:

make check
make build
make currency

publication.json is the explicit source and address registry. A build fails closed when a source is unavailable or an immutable revision would change. source-inventory.config.json defines the bounded canon/ADR discovery scope, while source-inventory.json records an explicit reviewed disposition for every matching source. make source-audit fails when a source appears or disappears without that review. Working-tree-only files in sibling repos do not affect the audit; local checks inspect committed Git trees.

The Forgejo workflow pulls exact main revisions for all inventoried source repos every day at 04:17 UTC and on manual dispatch. It fails visibly on an unavailable source, unreviewed inventory drift, invalid release, or overdue published document. Successful runs publish immutable source-<source-set-digest> candidates and a moving discovery tag, but never deploy them. Production promotion remains an explicit review of the registry-resolved OCI digest and publication-manifest digest together in rapp-policy-nexus and railiance-apps.

Production publication is split from runtime ownership. This repository builds and publishes the immutable OCI site image; rapp-policy-nexus owns the Helm package, exposure checks, and rollback; railiance-apps selects the approved production digests. A release build additionally refuses dirty or synthetic source provenance:

make release-build
make image-build IMAGE_REF=forgejo.coulomb.social/coulomb/policy-nexus:git-$(git rev-parse HEAD)

Tags are discovery handles only. Production always records the registry-resolved OCI digest and the SHA-256 of build/publication-manifest.json.