risk-nexus/history/2026-08-21-intent-gap-analysis.md

---
type: history
title: "risk-nexus INTENT gap analysis"
date: "2026-08-21"
author: claude
repo: risk-nexus
related_workplan: RISK-WP-0005
---

# What this repo promised, and what it has

`INTENT.md` was written before the register existed. Four days in, this is what
it claimed, what is true, and what is not.

## What it owns — six claims

| Claim | State | Honest reading |
| --- | --- | --- |
| Finding intake, from any source: research, review, **incident, external report** | Partial | Nine findings, all from research or self-review. **No incident path and no external-report channel exist at all.** |
| Severity and triage | Yes | Scale adopted, amended twice under use, applied to nine findings with no `unset` left. |
| Remediation tracking — owner, state, whether it stalled | **Nominal** | `fix_tracking` holds strings nobody reads. See gap 2. |
| Disclosure timing | Yes | Three states, exercised, and it has bitten across two findings. |
| Regulatory intake | Yes, and beyond | One determination, thirteen-entry policy set, a written route. |
| The escalation rule | Yes | Adopted 2026-08-20 with the operator's thresholds. |

## What it does not own — held

Fixing, publication, blocking delivery, legal advice, amending canon. Nothing
in four days crossed those. The nearest approach was running `kubectl` against
another repo's cluster, and that is bounded in `docs/method/verification.md`:
read-only, recorded, routed as a question, never a conclusion on the owner's
behalf.

## What good looks like — four tests from INTENT

**"A gap that was known is recorded with a severity and an owner."** Met.
Nine, including the estate-wide one that had lived as open question 3 of an
unratified draft.

**"A regulation that applies was found before it was needed."** **Not met, and
this is the sharpest failure in the assessment.** The policy set found two
obligations that are *already live*: commercial and tax retention, and the
e-invoicing receiving duty in force since January 2025. Neither was found
before it was needed. They were found roughly nineteen months late, by writing
a catalogue that should have existed first. The catalogue now makes the test
passable going forward; it does not make this instance a pass.

**"A fix that stalled was visible while it stalled."** **Untested, and weaker
than it looks.** No fix has stalled yet. The mechanism — fourteen days at the
bottom rung — measures whether the *register* is checking, not whether the
*fix* is moving. See gap 2.

**"The things that genuinely needed the operator's judgement reached them."**
Met, four times, three answered. One was withdrawn before sending because the
fix landed first, which the register recorded as luck rather than a success.

## The gaps, in the order they would hurt

### 1. Nothing can report to this register from outside

Every finding arrived from a repo reading its own code, or from this register
reading a cluster. `INTENT.md` claims intake from **incident and external
report**; neither has a path.

There is no address an outsider could use, no `security.txt` anywhere in the
estate, and no defined route from "something is happening right now" to a
record. The severity scale assumes a latent defect; an active incident has a
different tempo, and `RISK-POL-0005` (breach notification, 72 hours) is dormant
with nothing wired to it.

The register is currently a **self-assessment aggregator**. That is a
respectable thing to be and it is not what the intent says it is.

### 2. Remediation tracking does not track

`fix_tracking: FLEX-WP-0015-T02` is a string this repo writes down and never
reads. The hub knows whether that task moved; the register asks a human
instead, and "has the fix moved?" is question three of every check.

That decays the moment nobody is looking, which is precisely the condition the
whole cadence design assumes. **The fix state should be read from the hub, and
a fix that has not moved should reset nothing and escalate on its own timer** —
independent of whether the register happened to check.

Today, an owner who goes quiet and a fix that goes quiet look identical.

### 3. There is no coverage model

The register knows what was reported. It has no view of what was never looked
at.

A system with zero findings is indistinguishable from a system nobody has
assessed, and `RISK-N-0003` records the uncomfortable evidence: every repo that
has examined its own boundary this month found a defect — two for two.
`INTENT.md`'s "nobody is surprised" cannot hold while the denominator is
unknown.

### 4. The production transition has no owner and no definition

Five findings owe a re-score at "the production transition", and
`RISK-F-0007`'s acceptance **expires** there. Nothing outside this repo knows
that, no one has defined what the event is, and no one has been named to
declare it.

An acceptance that expires on an undefined event expires on nobody's calendar.

### 5. The repo claims a surface it does not have

`README.md` and `INTENT.md` both say `risk-nexus` serves `risk.coulomb.social`.
It serves nothing. Two documents wait on `policy-nexus` for an address, and the
site does not exist.

Small, but it is exactly the class of claim this register grades other repos
down for: a stated control that is not there.

### 6. Escalation has no delivery guarantee

Escalations go to an inbox and are said aloud in whatever session is running.
If the operator does not read the inbox, the escalation is indistinguishable
from one never sent — which is the failure this register committed on
2026-08-19 and fixed *for itself* with `hourly-register-inbox-watch`.

The same fix has not been applied to the escalation path. Nothing acknowledges,
and nothing re-raises.

### 7. Everything runs from one checkout

The activity definitions instruct a session that may not exist. If no agent
picks up the daily sweep, `make due` still reports and nobody reads it. The
ladder degrades to decoration silently — and a `1q` rung would then mean "no
one checked for a quarter", which reads identically to "stable for a quarter".

`clean_streak` makes a suspiciously smooth climb visible, but only to someone
looking.

## What is deliberately not a gap

- **No monitoring.** `RISK-N-0003` is a note, ruled so on purpose: no repo owns
  estate-wide detection and a register that grows probes becomes a second
  engineering team.
- **No OpenBao access.** Bounded in `verification.md`. Acquiring production
  secret-store credentials for a risk register would trade a verification
  problem for a worse one.
- **No blocking.** Build mode: a finding is information. Unchanged.

## Ranking

If one thing is done next it is **gap 2**, because it is the only one where the
register currently reports something it cannot actually see, and INTENT names
it explicitly. Gaps 1 and 4 are the next two, and both are cheap.

Gap 3 is the largest and the most expensive, and it is the one that decides
whether "nobody is surprised" is a claim this repo can ever make.