# Publishing Policy
#
# Governs all outbound publishing actions. SPB-04, SPB-06, SPB-12, SPB-15.

version: 1

approvals_required:
  internal_docsite:
    approvers: [docs_owner]
  internal_wiki:
    approvers: [docs_owner]
  medium_or_blog:
    approvers: [docs_owner, communications_owner]
  youtube_or_video:
    approvers: [docs_owner, communications_owner]
  curriculum_external_platform:
    approvers: [docs_owner, communications_owner]

permitted_environments:
  internal: [local, home_lab, cloud]
  public_blog: [local, cloud]
  public_video: [local, cloud]
  curriculum_external: [local, cloud]
  # private_sensitive content cannot be routed to public venues regardless of environment
  classification_enforcement:
    private_sensitive_to_public: deny           # SPB-10
    internal_to_public: allow_with_review
    low_sensitive_to_public: allow

credential_scope_restrictions:
  # SPB-02 / SPB-04: each venue has its own labeled, agent-scoped credential.
  # Never share credentials across venues, never use user-level credentials.
  per_venue: true
  forbid_user_credentials: true
  forbid_long_lived_pat_unless_documented: true

publish_action_constraints:
  dry_run_required_first: true
  preflight_must_pass: true
  duplicate_publish_prevention: true             # do not republish identical content within 24h without explicit override

rollback_unpublish_policy:
  required_for: [public_blog, public_video, curriculum_external]
  procedure: see runbooks/add-new-venue-adapter.md (Rollback section)
  audit_required: true                            # SPB-12

audit_emission:
  events:
    - publish_dry_run
    - publish_attempted
    - publish_succeeded
    - publish_failed
    - unpublish_attempted
    - unpublish_succeeded
    - approval_recorded

policy_change_control: see SPB-15