Persist the gap analysis to history/, open RISK-WP-0005

history/2026-08-21-intent-gap-analysis.md follows the estate's history
convention. RISK-WP-0005 carries the seven gaps, ordered so the one place
the register misreports goes first: fix_tracking is a string nobody
reads, so a stalled fix and a silent owner are currently the same thing.

The two INTENT claims with no implementation at all — incident intake and
external report — are T02. STATE.md now says both of those out loud
rather than leaving them to the assessment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/RISK-WP-0005-close-the-intent-gaps.md

@@ -0,0 +1,240 @@
+---
+id: RISK-WP-0005
+type: workplan
+title: "Close the gaps between what INTENT claims and what the register can actually do"
+domain: infotech
+repo: risk-nexus
+status: active
+owner: the-custodian
+topic_slug: risk-nexus
+created: "2026-08-21"
+updated: "2026-08-21"
+depends_on_workplans:
+  - RISK-WP-0001
+  - RISK-WP-0004
+---
+
+# RISK-WP-0005 — close the INTENT gaps
+
+## Goal
+
+`history/2026-08-21-intent-gap-analysis.md` compared what `INTENT.md` claims
+against what four days of building actually produced. Five of six ownership
+claims hold. Seven gaps do not.
+
+Done means: the register no longer reports anything it cannot see, no longer
+claims a surface it does not have, and the two intake paths `INTENT.md` names
+but has never had — incident and external report — exist.
+
+## The honest framing
+
+Every task here exists because the register failed one of its own tests, not
+because someone imagined an improvement. Two are uncomfortable enough to state
+plainly at the top:
+
+- **`fix_tracking` is a string nobody reads.** The register claims to track
+  remediation and does not. An owner who goes quiet and a fix that goes quiet
+  are currently indistinguishable.
+- **A regulation that applies was found *after* it was needed**, by about
+  nineteen months. The policy catalogue fixes the next one; nothing fixes that
+  one.
+
+## Tasks
+
+### T01 — Make remediation tracking track
+
+```task
+id: RISK-WP-0005-T01
+status: todo
+priority: high
+```
+
+Gap 2, and first because it is the only place the register currently reports
+something it cannot see.
+
+`fix_tracking` holds ids like `FLEX-WP-0015-T02`. The hub knows whether those
+moved. Read them: resolve each `fix_tracking` against the hub, record the
+status and the date it last changed, and surface it in `make check`.
+
+Then separate the two silences that currently look alike:
+
+- **The register has not checked** — the cadence rung already says this.
+- **The fix has not moved** — its own timer, independent of whether anyone
+  checked, escalating on trigger 5 without needing a human to notice.
+
+**Acceptance:** `make check` reports, per open finding, when its fix record
+last changed. A finding whose fix has not moved in its stall window is listed
+whether or not the register has been checking.
+
+Where `fix_tracking` is `unset` (`RISK-F-0004`, `RISK-F-0006`, `RISK-F-0009`),
+that absence is itself the report.
+
+### T02 — An intake path for incidents and external reports
+
+```task
+id: RISK-WP-0005-T02
+status: todo
+priority: high
+```
+
+Gap 1. `INTENT.md` claims intake "from any source: research, review, incident,
+external report". Two of those four have no path at all.
+
+Three pieces, and only the first is this repo's alone:
+
+1. **Incident intake.** A finding that describes something happening *now*
+   rather than a latent defect. Needs: an entry shape, a tempo (the ladder
+   already starts at `instant`, which is most of it), and a link from an
+   incident to `RISK-POL-0005` — breach notification runs on a 72-hour clock
+   that nothing currently starts.
+2. **External report.** There is no address an outsider could use and no
+   `security.txt` anywhere in the estate. Where that address lives is not this
+   repo's call — route the question to `the-custodian` and `policy-nexus`,
+   since it is a published surface.
+3. **Severity for a live incident.** The scale assumes a defect nobody is
+   exercising. Say what changes when someone is.
+
+**Non-goal:** a bug bounty, a disclosure programme, or any commitment to
+outside parties. The ask is a route, not a promise.
+
+### T03 — Define the production transition
+
+```task
+id: RISK-WP-0005-T03
+status: todo
+priority: high
+```
+
+Gap 4, and cheap. Five findings owe a re-score at "the production transition"
+and `RISK-F-0007`'s acceptance **expires** there.
+
+Nobody has defined the event, nobody has been named to declare it, and nothing
+outside this repo knows the obligation exists. An acceptance that expires on an
+undefined event expires on nobody's calendar.
+
+Settle: what counts as the transition (first real user? first real tenant data?
+a declaration?), who declares it, and how this register hears about it. Then
+tell the repos that carry re-score obligations.
+
+Custodian decision on the definition; the plumbing is ours.
+
+### T04 — Stop claiming a surface we do not have
+
+```task
+id: RISK-WP-0005-T04
+status: todo
+priority: medium
+```
+
+Gap 5. `README.md` and `INTENT.md` both say this repo serves
+`risk.coulomb.social`. It serves nothing.
+
+Correct the README to say what is true — that publication runs through
+`policy-nexus` and two documents are pending an address. `INTENT.md` is the
+repo's constitutional document and its amendment is the custodian's; propose
+the wording rather than editing it.
+
+Small, and exactly the class of claim this register grades other repos down
+for: a stated control that is not there.
+
+### T05 — Give escalation a delivery guarantee
+
+```task
+id: RISK-WP-0005-T05
+status: todo
+priority: medium
+```
+
+Gap 6. An escalation goes to an inbox and is said aloud in whatever session is
+running. If nobody reads it, it is indistinguishable from one never sent —
+which is the failure this register committed on 2026-08-19 and fixed **for
+itself** with `hourly-register-inbox-watch`, without applying the same fix to
+the path that matters more.
+
+Needs: an acknowledgement state on the escalation (sent → seen → answered), and
+a re-raise once, per the adopted rule's "raised again once" clause. Not a
+weekly nag; the rule is explicit that repetition until someone answers is how
+the operator becomes the queue.
+
+### T06 — Make a lie about stability impossible to miss
+
+```task
+id: RISK-WP-0005-T06
+status: todo
+priority: medium
+```
+
+Gap 7. If nothing performs checks, every finding still climbs nowhere and sits
+at `instant` — but the reverse case is the dangerous one: a `1q` rung means
+"stable for a quarter" and "nobody looked for a quarter" and those read
+identically.
+
+Two cheap defences:
+
+- **Attribution.** Record who or what performed each check. A rung earned by
+  nobody should be visible as such.
+- **A register heartbeat.** If no check has been recorded anywhere in the
+  register for longer than the shortest rung by some margin, `make check` says
+  so first, before anything else.
+
+### T07 — A coverage model
+
+```task
+id: RISK-WP-0005-T07
+status: todo
+priority: low
+```
+
+Gap 3: the largest, the most expensive, and the one that decides whether
+"nobody is surprised" is a claim this repo can ever make.
+
+The register knows what was reported. It has no view of what was never looked
+at, so a system with zero findings is indistinguishable from a system nobody
+assessed — while `RISK-N-0003` records that every repo which *has* examined its
+own boundary this month found a defect.
+
+Start minimal: a list of systems from the hub, a last-assessed date per system,
+and the count of systems that have never been. Not an assessment programme, not
+a maturity model, and not this repo assessing anyone.
+
+**If this task grows past a page it becomes its own workplan.** Coverage is a
+different problem from triage and should not quietly absorb this one.
+
+## Non-goals
+
+- **No monitoring.** `RISK-N-0003` stands as a note. A register that grows
+  probes becomes a second engineering team, which `INTENT.md` names.
+- **No blocking.** Build mode: a finding is information.
+- **No commitment to outside parties.** T02 builds a route in, not a promise
+  out.
+- **No new instruments.** The four exist and have survived use. This workplan
+  makes them honest, not larger.
+
+## Sequencing
+
+T01 first — it is the only gap where the register misreports. T02 and T03 next
+and in parallel; both are cheap and T03 is mostly a decision. T04 any time.
+T05 and T06 after T01, since both touch the same reporting surface. T07 last,
+and possibly not here at all.
+
+## Risks
+
+**The register spends another workplan on itself.** Seven tasks, none of which
+fix a defect in the estate. Mitigation: T01, T02 and T03 all close claims
+`INTENT.md` already makes, which is repayment rather than expansion — and the
+same test as last time applies: if the next round produces no such items, this
+kind of workplan should stop.
+
+**T07 swallows the workplan.** Mitigation: it is last, explicitly minimal, and
+carries its own escape clause.
+
+**Incident intake invites a promise.** Mitigation: T02's non-goal is stated in
+the task, not only here.
+
+## Residuals
+
+- The nineteen-month-late obligations are not recoverable and are recorded in
+  the history note rather than converted into a task.
+- Whether findings should be reported to the estate by anything other than
+  their owners — monitoring, coverage sweeps — stays a note until evidence
+  makes it a finding.