tegwick
683f22d986
Two estate repos now own things ops-warden had been handling in-repo by default. New rule .claude/rules/finding-routing.md, wired into CLAUDE.md. The correction it encodes: on 2026-08-17 flex-auth reported a live authorization bypass directly to ops-warden — in the service our own pre-sign gate consults. We answered the design question and wrote the recommendation into wiki/NetKingdomSecurityMap.md, and did not route the finding. rapp-postgres filed it, which is why RISK-F-0001 reads reported_via: rapp-postgres despite ops-warden being a first-hand recipient and the affected PEP. That is the exact failure risk-nexus/INTENT names: findings landing in whichever document was open. A wiki section answers a question; it carries no severity, owner, date, or review that fires when nobody looks. Answering and routing are not alternatives. Also recorded: the delegation register is explicitly NOT a findings feed (risk-nexus wants a register small enough to read); severity/disclosure/ escalation stay unset when we route, because the reporter says what is true and that repo says how bad it is; and a blocker is a claim about the world at a date — RISK-F-0001 invalidated one of ours in a day. Offers warden plan (WP-0029) to risk-nexus for its unwritten escalation duty: a shipped classifier for what must reach the operator personally, decided by properties rather than instinct, carrying reasons and a typed act. Flags but does not close the policy-nexus gap: ops-warden has no ADRs, yet carries rules that govern other repos (no-double-source, conduit-not-broker, interim-by-default, agent read-boundary). They sit in wiki prose and are therefore unpublishable and uncitable. Structural call, left to the operator. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
386 B
386 B
ops-warden — Claude Code Instructions
@SCOPE.md @.claude/rules/repo-identity.md @.claude/rules/session-protocol.md @.claude/rules/first-session.md @.claude/rules/workplan-convention.md @.claude/rules/stack-and-commands.md @.claude/rules/architecture.md @.claude/rules/repo-boundary.md @.claude/rules/credential-routing.md @.claude/rules/finding-routing.md @.claude/rules/agents.md