94 lines
4 KiB
Markdown
94 lines
4 KiB
Markdown
|
---
|
|||
|
|
id: RISK-METHOD-INTAKE
|
|||
|
|
type: method
|
|||
|
|
title: "Intake: the four sources, including the two that had no path"
|
|||
|
|
status: adopted
|
|||
|
|
owner: risk-nexus
|
|||
|
|
adopted: "2026-08-21"
|
|||
|
|
workplan: RISK-WP-0005-T02
|
|||
|
|
review_interval: 6m
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# Intake
|
|||
|
|
|
|||
|
|
`INTENT.md` claims intake "from any source: research, review, incident,
|
|||
|
|
external report". Until 2026-08-21 two of those four had no path at all, and
|
|||
|
|
every finding in the register had arrived from a repo reading its own code.
|
|||
|
|
|
|||
|
|
A register that only receives self-assessments is a self-assessment aggregator.
|
|||
|
|
That is a respectable thing to be and it is not what the intent says.
|
|||
|
|
|
|||
|
|
## The four sources
|
|||
|
|
|
|||
|
|
| Source | Path | State |
|
|||
|
|
| --- | --- | --- |
|
|||
|
|
| Research | a repo or agent files against `findings/README.md` | working, nine findings |
|
|||
|
|
| Review | same, usually against a ladder or standard | working, most of the nine |
|
|||
|
|
| **Incident** | below | new |
|
|||
|
|
| **External report** | below — and the address is not this repo's to create | routed |
|
|||
|
|
|
|||
|
|
## Incident
|
|||
|
|
|
|||
|
|
An incident is a finding about something happening **now** rather than a latent
|
|||
|
|
defect. The difference is not severity; it is that someone is exercising it, or
|
|||
|
|
the loss is occurring, while the record is being written.
|
|||
|
|
|
|||
|
|
### What is different
|
|||
|
|
|
|||
|
|
- **File first, grade later.** The normal order is reversed: get the record
|
|||
|
|
into `findings/` with what is known, and grade it in the same hour rather
|
|||
|
|
than in the same sitting. An ungraded incident is still a record; an unwritten
|
|||
|
|
one is nothing.
|
|||
|
|
- **`incident: true` and a `first_observed` timestamp**, both in front-matter.
|
|||
|
|
The timestamp matters more than the grade, because obligations run from it.
|
|||
|
|
- **Cadence starts at `instant` and stays there** until the incident is over.
|
|||
|
|
That is the ladder's existing behaviour and needs no special case: something
|
|||
|
|
that keeps moving keeps resetting.
|
|||
|
|
- **The 72-hour clock.** If personal data is or may be involved,
|
|||
|
|
`RISK-POL-0005` (GDPR Arts 33–34) requires notification within 72 hours of
|
|||
|
|
becoming aware. **`first_observed` is what starts that clock**, and this is
|
|||
|
|
the one place the register puts a hard deadline on itself. Escalation is
|
|||
|
|
immediate under trigger 1 or 2 — not batched, notwithstanding the batching
|
|||
|
|
rule, because batching exists to protect the operator's attention and a
|
|||
|
|
72-hour clock outranks that.
|
|||
|
|
- **Severity is scored on what is happening, not what could.** The `L4`
|
|||
|
|
likelihood band — "already happening" — exists for exactly this and is
|
|||
|
|
otherwise almost unused.
|
|||
|
|
|
|||
|
|
### What is not different
|
|||
|
|
|
|||
|
|
Ownership, routing, and the boundary. The repo that owns the system owns the
|
|||
|
|
response; this register records, grades, escalates and keeps the clock. A risk
|
|||
|
|
register that runs incident response is a second engineering team with a
|
|||
|
|
stopwatch.
|
|||
|
|
|
|||
|
|
## External report
|
|||
|
|
|
|||
|
|
Someone outside the estate finding something and having somewhere to send it.
|
|||
|
|
|
|||
|
|
**No such place exists.** There is no `security.txt` anywhere in the estate, no
|
|||
|
|
published address, and no route from an outsider to this register. If someone
|
|||
|
|
found a flaw in a coulomb.social surface tomorrow, their options would be to
|
|||
|
|
guess an email address or say nothing.
|
|||
|
|
|
|||
|
|
**Where that address lives is not this repo's decision.** It is a published
|
|||
|
|
surface, which makes it `policy-nexus`'s to serve and the custodian's to
|
|||
|
|
approve. Routed on 2026-08-21 with a proposal:
|
|||
|
|
|
|||
|
|
- a `security.txt` (RFC 9116) at `policy.coulomb.social/.well-known/`, naming
|
|||
|
|
a contact and a preferred language, with an expiry date as the RFC requires;
|
|||
|
|
- reports arriving there routed to `risk-nexus` and filed like any other
|
|||
|
|
finding, with `reported_by: external`;
|
|||
|
|
- **no promise of a bounty, a timeline, or safe harbour.** The ask is a route
|
|||
|
|
in, not a commitment out. A published disclosure policy is a later decision
|
|||
|
|
and a heavier one.
|
|||
|
|
|
|||
|
|
Until that exists, this register's claim to accept external reports is
|
|||
|
|
aspirational and `STATE.md` says so.
|
|||
|
|
|
|||
|
|
## What all four share
|
|||
|
|
|
|||
|
|
The reporter says what is true and how they know. This register says how bad it
|
|||
|
|
is and who hears about it. Nothing in this document changes that boundary —
|
|||
|
|
including for incidents, where the temptation to take over is strongest.
|