diff --git a/REGISTER.md b/REGISTER.md index 313c537..0df8299 100644 --- a/REGISTER.md +++ b/REGISTER.md @@ -2,18 +2,18 @@ Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-19. -7 open of 8 findings; 2 notes below the floor. +5 open of 8 findings; 2 notes below the floor. ## Findings | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by | | --- | --- | --- | --- | --- | --- | --- | --- | --- | | [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, pending-operator) | risk-nexus | open | 2026-11-17 | -| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **required** (t4, pending-operator) | unset | open | 2026-09-18 | -| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **required** (t3, pending-operator) | railiance-platform | open | 2026-09-18 | +| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 2026-09-18 | +| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | 2026-09-18 | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | 2026-11-17 | | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | 2026-09-18 | -| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | open | 2026-09-18 | +| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | mitigated | 2026-09-18 | | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | 2026-11-17 | | [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | 2026-08-26 | diff --git a/findings/RISK-F-0006-apps-pg-no-backup-configured.md b/findings/RISK-F-0006-apps-pg-no-backup-configured.md index bb0aeab..88763d3 100644 --- a/findings/RISK-F-0006-apps-pg-no-backup-configured.md +++ b/findings/RISK-F-0006-apps-pg-no-backup-configured.md @@ -11,7 +11,7 @@ date_filed: "2026-08-19" system: railiance-platform environment: production fix_owner: railiance-platform -fix_tracking: unset +fix_tracking: unset (railiance-platform to open) related: [RISK-F-0001] # Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-second-grading.md severity: high @@ -24,9 +24,13 @@ disclosure: embargoed embargo_condition: "a backup exists and a restore has been demonstrated once" embargo_since: "2026-08-19" embargo_review: "2026-09-18" -escalation: required +escalation: answered escalation_trigger: 3 -escalation_status: pending-operator +escalation_status: approved +escalation_answered: "2026-08-19" +escalation_answered_by: the-custodian +escalation_act: approve +decision: "spend for apps-pg backup storage approved; no ceiling stated" last_reviewed: "2026-08-19" review_by: "2026-09-18" graded_by: risk-nexus @@ -86,3 +90,26 @@ error as the gate in `RISK-F-0002`. - **2026-08-19** — filed and graded from `RISK-F-0001`'s unfiled list. Open at review: has the spend been ruled on; is a backup configured; has a restore been demonstrated; does `railiance-platform` track it anywhere. + +## Operator decision — 2026-08-19: approved + +The spend is approved. `railiance-platform` may provision backup storage for +`apps-pg` without returning for authorisation. + +No ceiling was stated, so none is recorded. The register asks +`railiance-platform` to report the actual target and its monthly cost once +chosen; a figure materially above the trigger-3 band (recurring €50/month) +comes back for confirmation rather than being assumed covered. That is the +register being careful with an open approval, not a condition on it. + +**What is now blocking is work, not permission.** The finding stays `open` at +`high`, and the embargo condition is unchanged: a backup exists **and** a +restore has been demonstrated once. A backup nobody has restored from is a +claim, not a control. + +`fix_tracking` is still `unset` and is now `railiance-platform`'s to open. + +## Reviews + +- **2026-08-19** — escalation answered, spend approved. Open at review: is a + backup configured; has a restore been demonstrated; what does it cost. diff --git a/findings/RISK-F-0007-unverified-tenant-boundary.md b/findings/RISK-F-0007-unverified-tenant-boundary.md index 623d8ea..065e7d7 100644 --- a/findings/RISK-F-0007-unverified-tenant-boundary.md +++ b/findings/RISK-F-0007-unverified-tenant-boundary.md @@ -2,7 +2,7 @@ id: RISK-F-0007 type: finding title: "No consumer's tenant boundary is verified anywhere" -status: open +status: accepted reported_by: net-kingdom reported_via: risk-nexus routed_by: risk-nexus @@ -10,7 +10,7 @@ date_reported: "2026-08-19" date_filed: "2026-08-19" system: estate environment: build -fix_owner: unset +fix_owner: per-consumer, on request fix_tracking: unset related: [RISK-F-0004, RISK-F-0005] # Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-second-grading.md @@ -24,9 +24,16 @@ disclosure: embargoed embargo_condition: "a verification exists for at least one consumer boundary" embargo_since: "2026-08-19" embargo_review: "2026-09-18" -escalation: required +escalation: answered escalation_trigger: 4 -escalation_status: pending-operator +escalation_status: assigned +escalation_answered: "2026-08-19" +escalation_answered_by: the-custodian +escalation_act: assign +accepted_by: the-custodian +accepted_on: "2026-08-19" +accepted_until: "production transition (hard expiry, not a date)" +decision: "pragmatic default before production — carried unverified; verification of a named consumer boundary on request" last_reviewed: "2026-08-19" review_by: "2026-09-18" graded_by: risk-nexus @@ -97,3 +104,52 @@ better than a routed one nobody agreed to. - **2026-08-19** — filed and graded. Open at review: has an owner been named; have any further instances been found; is the Tenancy Posture question still open. + +## Operator decision — 2026-08-19: pragmatic default, tighter control on request + +The custodian ruled: **before production, carry it.** Verifying every +consumer's tenant boundary is not attempted as a programme now; a named +boundary is verified when someone asks for it. + +The finding moves to `accepted` — which in this register is not `closed`. It +keeps its severity, its review interval and its production re-score, and it +stays in `REGISTER.md` where an accepted risk is supposed to be visible while +it is being carried. + +**The acceptance expires at the production transition, and that is an event, +not a date.** `production_rescore` is `true`: at production the same defect is +`I4` × `L3` — `critical` — and the acceptance does not survive it. Nobody has +to remember; `make check` lists it under what is owed at that transition. + +### The on-request path + +So that "on request" is a mechanism and not a sentiment: + +- **Who may ask** — any repo that consumes or is consumed by another, the + operator, or an outside counterparty through the operator. +- **What they get** — verification scoped to one named consumer boundary, not + a general audit. The request names the consumer and what would have to be + true. +- **Who does it** — the owning repo of that consumer. This register scopes and + records; it does not verify, and it does not fix. +- **What it produces** — a dated verification record here. If the boundary + holds, that is evidence and this finding's likelihood falls for that + consumer. If it does not, that is a finding of its own with its own owner, + filed normally. + +Requests arrive as a message to `risk-nexus` and appear in the register within +one review cycle. + +### What the register keeps saying while this is carried + +The two-for-two record stands: every repo that has looked at its own boundary +this month found a defect (`RISK-F-0004`, `RISK-F-0005`). The acceptance does +not make that less true, and this finding is the place it stays visible. If a +third instance arrives, the pragmatic default is worth re-taking before +production rather than at it. + +## Reviews + +- **2026-08-19** — escalation answered, accepted until production with + verification on request. Open at review: any request received; any further + instances found; whether production is close enough to re-take the default.