coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

File and grade RISK-F-0012: e-invoice receipt and retention

Browse source 
Moves the unowned RISK-POL-0012 receiving duty onto the findings track:
medium (I2 x L3), public, no escalation. The founder assigned qonto-assistant
as fix owner; workplan requested with suggested measures, default 2026-10-06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 10:06:58 +02:00
parent 5a7e4ac2d4
commit 228116926b
4 changed files with 144 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
REGISTER.md
View file

@ -2,14 +2,15 @@
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-09-22.
2 live of 11 findings; 3 notes below the floor.
3 live of 12 findings; 3 notes below the floor.
## Findings
| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [RISK-F-0012](findings/RISK-F-0012-e-invoice-receipt-and-retention.md) | The estate cannot show it receives and retains EN 16931 e-invoices | qonto-assistant | medium | public | none | qonto-assistant | open | instant (0) | **due** |
| [RISK-F-0011](findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md) | qonto-assistant audit.deny stream completeness is not established | qonto-assistant | medium | public | **pending** (t5, sent) | qonto-assistant | open | instant (0) | **due** |
| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | low | public | none | railiance-platform | fixed | 1h (1) | 2026-09-22 07:01Z |
| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | low | public | none | railiance-platform | fixed | 1h (1) | **due** |
| [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | public | none | railiance-platform | fixed | instant (0) | **due** |
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | 2026-09-22 14:13Z |
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | public | **answered** (t4, assigned) | per-consumer, on request | fixed | instant (0) | **due** |
@ -35,6 +36,7 @@ Silence never buys a softer grade — see `docs/method/dependencies.md`.
| Finding | Who | What would change | Default if silent | On |
| --- | --- | --- | --- | --- |
| RISK-F-0012 | qonto-assistant | fix_tracking is set and the finding is tracked on the owner's own workplan state | the medium grade stands; the absence of a workplan is recorded as a stalled remediation and escalation trigger 5 is assessed | 2026-10-06 |
| RISK-F-0008 | audit-core | a working keyed commitment narrows RISK-REG-0001 to retained-by-obligation categories only | encrypt-then-hash recorded as the only known route, and the retention period recorded as unstateable | 2026-11-17 |
## Notes (below the floor)