risk-nexus/docs/method/review.md

---
id: RISK-METHOD-REVIEW
type: method
title: "Review and expiry: what happens when nobody looks"
status: adopted
owner: risk-nexus
adopted: "2026-08-19"
workplan: RISK-WP-0001-T04
review_interval: 6m
disclosure: public
revision: "adopted-1"
last_reviewed: "2026-08-20"
---

# Review and expiry

`INTENT.md`: a finding that has sat untouched past its review date is itself a
finding. Silence is not resolution. This document makes that operable.

## The cadence ladder

Operator ruling, 2026-08-20. **Intervals are not set by severity. They are
earned by outcomes.**

A finding is checked, and the check comes back clean or it does not. Clean
climbs one rung. Anything wrong drops straight back to the bottom.

| Rung | Wait before the next check |
| --- | --- |
| `instant` | now, and again immediately until a check comes back clean |
| `1h` | one hour |
| `8h` | eight hours |
| `24h` | one day |
| `48h` | two days |
| `96h` | four days |
| `7d` | one week |
| `14d` | two weeks |
| `1mo` | one month |
| `1q` | one quarter — **the ceiling; nothing is ever checked less often than this** |

Two rules and one escape:

- **Climb on clean.** One rung per clean check, never two.
- **Reset on anything wrong.** Not a slide down one rung — straight to
  `instant`. A matter that has just moved has no track record, whatever it had
  before.
- **The operator may defer.** An `instant` finding can be deferred to a stated
  future date by explicit operator decision, recorded as `deferred_to`. That is
  the only way out of the bottom rung other than a clean check, and it is a
  decision with a name on it rather than a check quietly not happening.

### Who checked, and when anyone last did

`RISK-WP-0005-T06`. Two defences against the rung telling a lie:

- **`checked_by` on every check.** `record_check.py` writes it. A rung earned
  by nobody in particular is visible as such.
- **A heartbeat.** If nothing anywhere in the register has been checked for two
  days, `make check` says so **before anything else**. A `1q` rung means
  "stable for a quarter" and "nobody looked for a quarter", and those read
  identically from the outside — the heartbeat is what separates them.

### The rung is the signal

This is the point of the design, not a side effect. **The cadence a finding
sits on is a statement about how stable the estate has been on that matter.**

`RISK-F-0002` at `1q (9)` says the signing gate has been examined ten times
over three months and nothing has moved. `RISK-F-0002` at `instant (0)` says
something changed within the day. The number carries information that no
severity does — severity says how bad it would be, the rung says how settled
it is — and the two are independent. A `low` finding that keeps resetting is
telling you something a `critical` one at the ceiling is not.

It is also self-correcting in the direction that matters. Anything volatile
gets attention often, automatically, without anyone deciding it deserves it;
anything genuinely quiet stops consuming attention, without anyone deciding to
stop looking. Neither of those judgements has to be made by a person who might
be wrong or busy.

### What "clean" means

A check is **clean** when nothing about the assessment moved: the grade still
holds, every stated blocker is still true, the fix state is unchanged, the
disclosure state is still right, and no new fact has arrived.

A check is **not clean** when any of those moved — including when they moved in
a good direction. `RISK-F-0001` being fixed is not a clean check; it is a large
change, and the next check comes immediately. Good news resets the ladder
exactly like bad news, because the ladder measures stillness, not health.

### Starting position

Every finding starts at `instant`. A register with no check history has no
grounds to wait, and the first clean check is what buys the first hour.

The whole register sat at `instant (0)` on 2026-08-20, which is correct and
temporary: everything in it had been graded, re-graded or ruled on within the
preceding day.

## What a review is

Five questions, answered in writing on the finding. It takes minutes; it is not
an investigation.

0. **Has the inbox said anything?** Read the messages addressed to this repo
   before anything else. This is question zero because on 2026-08-19 the
   register graded `RISK-F-0001` `critical` while two messages sat unread in
   its own inbox — one narrowing the exposure, one reporting the fix. Both
   changed the grade. A register that does not read its own inbox is guessing
   with a straight face.
1. **Is the grade still right?** Re-read impact and likelihood against what has
   changed. New facts move the grade in both directions.
2. **Is the blocker still true?** This is the one `RISK-F-0002` bought with
   evidence: *a blocker is a claim about the world at a date*. Its own stated
   blocker — "`flex-auth` is not deployed yet" — was invalidated within a day
   by `RISK-F-0001`, and nothing would have re-checked it. Every review
   re-checks every stated blocker.
3. **Has the fix moved?** Read the owner's tracking record, not our memory of
   it. Confirm the record still exists and still refers to this defect.
4. **Is the disclosure state still right?** An embargo whose condition has
   been met is published; an embargo whose condition has not moved in two
   reviews is a stall.

The finding gets a dated line under `## Reviews`, `last_reviewed` is updated,
and `review_by` is pushed by one interval. A review that changes nothing still
writes the line — "checked, nothing moved" is the evidence that the silence was
observed rather than accidental.

## When a check is missed

Overdue is not a status change on the finding. It is a fact about *this repo*,
and it surfaces in three places:

- `make check` lists it under "Checks due", with how late it is and which rung
  it is on.
- `REGISTER.md` shows the next check as **due**.
- A finding sitting at the bottom rung for more than fourteen days with no
  movement fires escalation trigger 5. Bottom rung means it keeps failing or
  keeps being skipped; fourteen days of that is a stall whichever it is.

The register does not auto-escalate severity for lateness and does not
auto-close anything. Both would be the register lying about its own state to
make a number look better.

## The production re-score

Every finding carries `severity_at_production` alongside `severity`
(`docs/method/severity.md`). Where the two differ, the finding is flagged
`production_rescore: true`.

On the day any part of the estate declares production readiness, every flagged
finding is re-scored before that declaration completes. This is not a review
date — it is an event, and it fires regardless of where the review dates
happen to sit.

Until then, `make check` lists the flagged findings so the size of that
obligation is visible rather than discovered on the day.

## Front-matter this adds

```yaml
last_checked: "2026-08-20T05:40:00Z"
next_check: "2026-08-20T06:40:00Z"
cadence: 1h
clean_streak: 1
production_rescore: true
deferred_to: ""        # only by explicit operator decision
```

`next_check` is what the nag reads, and it is an absolute moment rather than a
duration, so nothing has to recompute an interval to know whether a check is
late. The rungs run in hours as well as days, so it carries a time.

## Closing a finding

A finding leaves `open` for exactly one of:

- `fixed` — the owner's record shows the defect gone, and this repo has read
  something concrete rather than been told. Publication follows if the
  disclosure state was `embargoed`.
- `accepted` — the estate is deliberately carrying it. Requires who accepted
  it, why, and what ends the acceptance. `accepted` is not closed: it stays on
  the ladder forever, and it climbs like anything else.
- `mitigated` — the live gap is closed but the finding is not. `RISK-F-0003` is
  the case: the boundary now fires, and the omission that let it not fire is
  still there. Stays watched.
- `withdrawn` — the finding was wrong, or the defect never existed. Say which.

**Any status the tooling does not recognise keeps the finding watched, and the
unrecognised word is reported.** `RISK-F-0003` arrived as `mitigated` on
2026-08-20, before that word existed here, and dropped silently out of
`make check` — a finding vanishing from the nag because someone used an
unfamiliar word is precisely the failure this register exists to prevent. The
tooling now fails loud instead of quiet.

There is no `stale`, no `wontfix` and no silent expiry. A finding that nobody
will fix and nobody will accept stays `open` and keeps arriving in the nag,
because that is the true state.