risk-nexus/workplans/RISK-WP-0002-publication-handover.md

---
id: RISK-WP-0002
type: workplan
title: "Hand the publishable findings to policy-nexus, and decide what else is a public document"
domain: infotech
repo: risk-nexus
status: proposed
owner: the-custodian
topic_slug: risk-nexus
created: "2026-08-20"
updated: "2026-08-20"
depends_on_workplans:
  - RISK-WP-0001
---

# RISK-WP-0002 — publication handover

**Draft.** Sized deliberately small: two documents are ready and the rest is a
decision, not a project.

## Goal

`RISK-F-0001` and `RISK-F-0008` carry `disclosure: public` and
`publication: pending-handover`. Get them onto `policy.coulomb.social` under
`policy-nexus`'s existing contract, and settle whether this repo's method
documents are public too.

Done means: both findings have a permanent address, `publication: published`,
and a recorded answer on the method documents.

## Why now

Six findings are embargoed with lift conditions, and `RISK-F-0009` has already
demonstrated that a condition can be met and the embargo still hold. When those
conditions start clearing, publication will happen in a trickle rather than a
batch — so the route wants to exist before it is needed, not during.

`policy-nexus` has been told this is coming (2026-08-20) and asked for nothing.

## Tasks

### T01 — Publish the two ready findings

```task
id: RISK-WP-0002-T01
status: todo
priority: high
```

Follow `policy-nexus`'s publication contract as it stands. Do not invent an
address scheme: `POLICY-NEXUS-WP-0001` settled addressing and permanence, and
this repo is a consumer of that decision.

Open question for T01 rather than an assumption: **is a finding published whole,
or as a summary?** `RISK-F-0001` contains a full ruling, a re-grade, a review
log and this register's own process defect. Some of that is register-internal
work product. Decide once, here, and apply it to every later publication.

### T02 — Rule on the method documents

```task
id: RISK-WP-0002-T02
status: todo
priority: medium
```

`docs/method/severity.md`, `disclosure.md`, `escalation.md`, `review.md`.

The case for publishing: they say how the estate grades and holds risk, which
is exactly what an outside reader needs to judge whether a published finding
means anything.

The case against: the escalation rule names the operator's own thresholds, and
the severity scale is a judgement instrument this repo revises freely. A
published instrument invites argument about the instrument.

Suggested split, to be ruled on rather than assumed: severity and disclosure
public, escalation and review internal. Escalation in particular describes when
the operator is interrupted, which is not the estate's business to advertise.

### T03 — The standing route

```task
id: RISK-WP-0002-T03
status: todo
priority: medium
```

Write down what happens when an embargo lifts: who hands over, in what shape,
and how `publication: published` gets recorded back on the finding.

Small. It is a paragraph in `docs/method/disclosure.md` plus whatever
`policy-nexus` needs on their side, not a mechanism.

## Non-goals

- No publication surface here. `policy-nexus` hosts; this repo hands over.
- No timed release, no coordinated disclosure, no notification tiers. Those stay
  deferred (`docs/method/disclosure.md`) until there are real users.
- No re-grading of anything to make it publishable.

## Risks

**A finding is published with an internal ruling attached.** Mitigation: T01
decides whole-versus-summary before anything ships.

**The handover becomes a project.** Mitigation: three tasks, one of which is a
paragraph. If it grows, that is a signal the publication contract does not fit
findings, and that is a conversation with `policy-nexus` rather than more tasks
here.