risk-nexus/activity-definitions/daily-register-check-sweep.md

---
id: daily-register-check-sweep
name: Daily Register Check Sweep
type: activity-definition
version: "1.0"
enabled: true
owner: risk-nexus
governance: custodian
status: active
created: "2026-08-20"
updated: "2026-08-20"
trigger:
  type: cron
  cron_expression: "15 7 * * *"
  timezone: Europe/Berlin
  misfire_policy: skip
dedupe_key_strategy: skip
context_sources:
  - type: state-hub
    query: hub_inbox
    required: false
    params:
      to_agent: risk-nexus
      unread_only: true
    bind_to: context.inbox
report_sinks:
  - type: state-hub-progress
    event_type: risk_register_check
    author: activity-core
---

# Daily Register Check Sweep

Runs daily at 07:15 Berlin time, before the working day, and unconditionally.

## Why a floor exists at all

The cadence ladder is self-pacing: a finding that keeps coming back clean is
checked less often, up to a quarterly ceiling. That works only if *something*
performs checks. `RISK-WP-0004-T01` recorded the honest state — the procedure
and the tooling existed, and nothing ran them, so every finding sat at
`instant` and the ladder was decoration.

This is the floor. It does not decide what is due; `make due` does that from
the findings' own front-matter. It guarantees that the question is asked once a
day whether or not anyone remembers to ask it.

## The work this instruction stands for

Per `docs/method/check-procedure.md`, for each finding `make due` lists:

1. read anything the inbox has said about it (question zero);
2. is the grade still right;
3. is every stated blocker still true — a blocker is a claim about the world at
   a date;
4. has the fix moved, read from the owner's record rather than from memory;
5. is the disclosure state still right.

Then `make checked ARGS="<id> clean"` or `"<id> moved '<what changed>'"`, and
`make register`. A check that is not written down did not happen.

## The one thing that must not happen

**Stamping `clean` without doing those five.** It costs nothing and produces a
`1q` rung that is a lie about stability — the `RISK-F-0002` failure mode (a
control that produces a false record is worse than no control) turned on this
register's own instruments. `clean_streak` is in the register partly so that a
suspiciously smooth climb is visible.

This activity therefore emits an instruction to a session that can exercise
judgement. It does not, and must not, grow the ability to record outcomes
itself.

```rule
id: work-the-due-list
condition: 'true'
action:
  task_template: 'risk-nexus: work the register due list'
  description: >-
    Run `make due` in risk-nexus, then work each due finding through the five
    questions in docs/method/check-procedure.md and record the outcome with
    `make checked`. Also review due regulatory records and full policies,
    re-decide due embargoes, and reconcile pending publication handovers,
    including closed findings, per docs/method/check-procedure.md.
    Findings at the `instant` rung are due immediately; the
    ladder climbs only on a clean check. Escalate only what
    docs/method/escalation.md says to escalate, batched into one operator
    conversation. If nothing is due, that is a complete run and worth nothing
    further.
  target_repo: risk-nexus
  priority: medium
  labels: ["risk-register", "cadence", "check"]
```