risk-nexus/docs/method/intake.md

---
id: RISK-METHOD-INTAKE
type: method
title: "Intake: the four sources, including the two that had no path"
status: adopted
owner: risk-nexus
adopted: "2026-08-21"
workplan: RISK-WP-0005-T02
review_interval: 6m
---

# Intake

`INTENT.md` claims intake "from any source: research, review, incident,
external report". Until 2026-08-21 two of those four had no path at all, and
every finding in the register had arrived from a repo reading its own code.

A register that only receives self-assessments is a self-assessment aggregator.
That is a respectable thing to be and it is not what the intent says.

## The four sources

| Source | Path | State |
| --- | --- | --- |
| Research | a repo or agent files against `findings/README.md` | working, nine findings |
| Review | same, usually against a ladder or standard | working, most of the nine |
| **Incident** | below | new |
| **External report** | below — and the address is not this repo's to create | routed |

## Incident

An incident is a finding about something happening **now** rather than a latent
defect. The difference is not severity; it is that someone is exercising it, or
the loss is occurring, while the record is being written.

### What is different

- **File first, grade later.** The normal order is reversed: get the record
  into `findings/` with what is known, and grade it in the same hour rather
  than in the same sitting. An ungraded incident is still a record; an unwritten
  one is nothing.
- **`incident: true` and a `first_observed` timestamp**, both in front-matter.
  The timestamp matters more than the grade, because obligations run from it.
- **Cadence starts at `instant` and stays there** until the incident is over.
  That is the ladder's existing behaviour and needs no special case: something
  that keeps moving keeps resetting.
- **The 72-hour clock.** If personal data is or may be involved,
  `RISK-POL-0005` (GDPR Arts 33–34) requires notification within 72 hours of
  becoming aware. **`first_observed` is what starts that clock**, and this is
  the one place the register puts a hard deadline on itself. Escalation is
  immediate under trigger 1 or 2 — not batched, notwithstanding the batching
  rule, because batching exists to protect the founder's attention and a
  72-hour clock outranks that.
- **Severity is scored on what is happening, not what could.** The `L4`
  likelihood band — "already happening" — exists for exactly this and is
  otherwise almost unused.

### What is not different

Ownership, routing, and the boundary. The repo that owns the system owns the
response; this register records, grades, escalates and keeps the clock. A risk
register that runs incident response is a second engineering team with a
stopwatch.

## External report

Someone outside the estate finding something and having somewhere to send it.

**At proposal time (2026-08-21), no such place was recorded.** There was no `security.txt` in the reviewed records, no
published address, and no route from an outsider to this register. If someone
found a flaw in a coulomb.social surface tomorrow, their options would be to
guess an email address or say nothing.

**Where that address lives is not this repo's decision.** It is a published
surface, which makes it `policy-nexus`'s to serve and the custodian's to
approve. Routed on 2026-08-21 with a proposal:

- a `security.txt` (RFC 9116) at `policy.coulomb.social/.well-known/`, naming
  a contact and a preferred language, with an expiry date as the RFC requires;
- reports arriving there routed to `risk-nexus` and filed like any other
  finding, with `reported_by: external`;
- **no promise of a bounty, a timeline, or safe harbour.** The ask is a route
  in, not a commitment out. A published disclosure policy is a later decision
  and a heavier one.

Until that exists, this register's claim to accept external reports is
aspirational and `STATE.md` says so.

### Owner disposition reconciled — 2026-10-04

The custodian's committed `CUST-WP-0063-T04` records approval of the bounded
RFC 9116 route on 2026-08-22, decision
`051de446-7ae9-4eca-a766-14345655ab35`. The decision-API lookup returned
404; this is an owner-file reconciliation. `the-custodian/intakes.md`
records `CUST-IN-0011` as `routed`, owned by `policy-nexus`, with selected
Contact URI `https://security.coulomb.social/` on 2026-08-23. Selection is
complete; provisioning and monitored delivery are not established here.

Required owner return: the production host grant, certificate/ingress,
monitored private receipt mechanism and an end-to-end report-to-risk-nexus
receipt, followed by the published `security.txt` location and expiry.
The intake's 2026-08-23 DNS/TLS observation is historical, not a fresh probe.
Risk-nexus does not provision the endpoint or publish an untested contact.

## What all four share

The reporter says what is true and how they know. This register says how bad it
is and who hears about it. Nothing in this document changes that boundary —
including for incidents, where the temptation to take over is strongest.