131 lines
5 KiB
Markdown
131 lines
5 KiB
Markdown
|
---
|
|||
|
|
id: RISK-WP-0006
|
|||
|
|
type: workplan
|
|||
|
|
title: "Keep review obligations visible when the index or records are stale"
|
|||
|
|
domain: infotech
|
|||
|
|
repo: risk-nexus
|
|||
|
|
status: finished
|
|||
|
|
owner: the-custodian
|
|||
|
|
topic_slug: risk-nexus
|
|||
|
|
created: "2026-09-05"
|
|||
|
|
updated: "2026-09-05"
|
|||
|
|
depends_on_workplans:
|
|||
|
|
- RISK-WP-0005
|
|||
|
|
state_hub_workstream_id: "900ba790-c5b8-523c-947f-5cd743fa1d58"
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# RISK-WP-0006 — keep review obligations visible
|
|||
|
|
|
|||
|
|
## Problem and priority
|
|||
|
|
|
|||
|
|
The [scope assessment](../history/2026-09-05-014333-scope-intent-assessment.md)
|
|||
|
|
found that `make check` stops before showing overdue work, all four full legal
|
|||
|
|
policies are outside review discovery, and disclosure obligations disappear
|
|||
|
|
from the work list. These are the first priorities: they hide known obligations
|
|||
|
|
and can be corrected within this repository without a new service or mandate.
|
|||
|
|
Malformed dates must not defeat the repaired reporting path.
|
|||
|
|
|
|||
|
|
## Tasks and acceptance
|
|||
|
|
|
|||
|
|
### T01 — Run every check stage even if another fails
|
|||
|
|
|
|||
|
|
```task
|
|||
|
|
id: RISK-WP-0006-T01
|
|||
|
|
status: done
|
|||
|
|
priority: high
|
|||
|
|
state_hub_task_id: "44f58905-fc81-571f-b112-e37001b02ed9"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Run index, register and inbox checks independently, preserving a nonzero result
|
|||
|
|
if any stage fails. A stale index and a broken register stage must still allow
|
|||
|
|
the inbox stage to run. No regeneration or grading as a side effect.
|
|||
|
|
|
|||
|
|
### T02 — Include full policies in the review workflow
|
|||
|
|
|
|||
|
|
```task
|
|||
|
|
id: RISK-WP-0006-T02
|
|||
|
|
status: done
|
|||
|
|
priority: high
|
|||
|
|
state_hub_task_id: "4a9cd603-7722-5e3b-833e-b65109f33d8a"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Discover nested regulatory records, excluding README catalogues. Full policies
|
|||
|
|
must appear when due and accept recorded outcomes. `make due` must expose these
|
|||
|
|
obligations to existing scheduled sessions, not filter them out. Invalid dates
|
|||
|
|
must be reported without aborting the report; invalid deferrals must not write.
|
|||
|
|
|
|||
|
|
### T03 — Keep disclosure obligations visible after closure
|
|||
|
|
|
|||
|
|
```task
|
|||
|
|
id: RISK-WP-0006-T03
|
|||
|
|
status: done
|
|||
|
|
priority: high
|
|||
|
|
state_hub_task_id: "3d250ebe-1d06-55f2-a4cc-8a716b12414f"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Report due or missing embargo review dates and pending publication handovers
|
|||
|
|
across all findings, including fixed findings. Surface them through `make due`.
|
|||
|
|
Do not publish, lift embargoes or change finding statuses automatically.
|
|||
|
|
|
|||
|
|
### T04 — Correct the archived fix completion signal
|
|||
|
|
|
|||
|
|
```task
|
|||
|
|
id: RISK-WP-0006-T04
|
|||
|
|
status: done
|
|||
|
|
priority: medium
|
|||
|
|
state_hub_task_id: "79b0c627-9fff-59e2-a400-8d3e9585504b"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
An archived completed workplan must not be reported as an unchanged unfinished
|
|||
|
|
fix just because its display status carries an archive suffix. Preserve the
|
|||
|
|
archive label and the documented whole-file timestamp limitation.
|
|||
|
|
|
|||
|
|
### T05 — Verify, document and reconcile registration
|
|||
|
|
|
|||
|
|
```task
|
|||
|
|
id: RISK-WP-0006-T05
|
|||
|
|
status: done
|
|||
|
|
priority: high
|
|||
|
|
state_hub_task_id: "96d06e61-84e7-5c3a-9d79-b700408afaf7"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Add focused regression tests for the failures above using isolated files and
|
|||
|
|
mocked external reads. Run them and the live read-only reporting path. Update
|
|||
|
|
SCOPE, usage and the operational instructions, and reconcile the workplan and
|
|||
|
|
task records with State Hub. Record actual registration results and residuals.
|
|||
|
|
|
|||
|
|
## Scope boundary and next priorities
|
|||
|
|
|
|||
|
|
This plan repairs visibility, not the overdue substantive reviews themselves.
|
|||
|
|
External intake delivery, urgent incident handling, scheduler-to-session delivery
|
|||
|
|
proof and the production declaration require separate operational decisions or
|
|||
|
|
cross-repository work. They remain open in the assessment. Missing fix records
|
|||
|
|
and the F-0011 notice require evidence reconciliation, not automatic closure.
|
|||
|
|
No legal conclusions, grades, acknowledgements or messages are generated here.
|
|||
|
|
|
|||
|
|
## Verification and completion evidence
|
|||
|
|
|
|||
|
|
Implementation complete for T01–T04. Eight isolated regression tests pass via
|
|||
|
|
`make test`, covering stage failures, nested policy discovery and recorded
|
|||
|
|
reviews, invalid dates and deferrals, disclosure after closure, and archived
|
|||
|
|
completed fixes. `git diff --check` passes.
|
|||
|
|
|
|||
|
|
Live validation first ran with a stale index: every report still executed and
|
|||
|
|
Make returned nonzero. After `make register`, `make check` and `make due` both
|
|||
|
|
returned zero while exposing all four overdue policies, eight pending handovers,
|
|||
|
|
three overdue findings and the newer F-0011 inbox notice. No finding or policy
|
|||
|
|
was stamped reviewed, re-graded or closed.
|
|||
|
|
|
|||
|
|
Registration: the normal CLI and an outside-sandbox retry timed out on State Hub
|
|||
|
|
reads. A longer-timeout full reconciliation was stopped after prolonged API
|
|||
|
|
reads without a completion result. Targeted registration succeeded
|
|||
|
|
through the same workplan/task API and deterministic IDs used by the reconciler.
|
|||
|
|
The workplan UUID is `900ba790-c5b8-523c-947f-5cd743fa1d58`; all five task
|
|||
|
|
UUIDs are recorded beside their source blocks. Completion and the file binding
|
|||
|
|
are synchronized through the API; the local index uses the reconciler renderer.
|
|||
|
|
|
|||
|
|
Residuals: external contact delivery, incident clocks, independent execution
|
|||
|
|
assurance, substantive overdue reviews, method review scheduling and production
|
|||
|
|
transition decisions remain open. The updated activity definition is local
|
|||
|
|
source; deployment/synchronization to activity-core was not performed.
|