Intake RISK-F-0011 and climb the due checks
Gate House routed a King's Guard observation that qonto-assistant's audit.deny stream has no completeness evidence. Filed and graded medium, public, open. Clean-checked F-0010, F-0008, and REG-0001 after confirming nothing moved. Raised the inbox timeout so question-zero does not false-fail on the tunneled hub. Assistant: grok Assistant-Session: 01a060e9-e363-7521-bf11-df5fa31b7156
This commit is contained in:
parent
dceb5ba008
commit
29f50d5143
9 changed files with 274 additions and 41 deletions
|
|
@ -44,10 +44,10 @@ escalation_act: rule
|
|||
decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
|
||||
outstanding: "whether the stated target periods are achievable under platform-pg co-residency, and whether a keyed commitment restores erasability"
|
||||
determination: RISK-REG-0001
|
||||
last_checked: "2026-09-01T00:38:53Z"
|
||||
next_check: "2026-09-01T00:38:53Z"
|
||||
cadence: instant
|
||||
clean_streak: 0
|
||||
last_checked: "2026-09-02T08:11:17Z"
|
||||
next_check: "2026-09-02T09:11:17Z"
|
||||
cadence: 1h
|
||||
clean_streak: 1
|
||||
waiting_on:
|
||||
- who: audit-core
|
||||
what: "does a keyed commitment restore erasability without breaking chain verification; what is the platform-pg co-residency horizon"
|
||||
|
|
@ -57,7 +57,7 @@ waiting_on:
|
|||
default_at: "2026-11-17"
|
||||
graded_by: risk-nexus
|
||||
ruling: RISK-RULING-2026-08-19-C
|
||||
checked_by: "codex/risk-nexus"
|
||||
checked_by: "grok/risk-nexus"
|
||||
---
|
||||
|
||||
# RISK-F-0008 — the exemption nobody has established
|
||||
|
|
@ -364,3 +364,4 @@ co-residency horizon that decides whether the stated retention periods are
|
|||
achievable. An accepted risk still gets checked.
|
||||
- **2026-08-20** — not clean: Trigger list ruled: no external determination in build mode; accepted with the legal policy set as the compensating control. Cadence instant → instant; checked again immediately.
|
||||
- **2026-09-01** — not clean: the regulatory record now states target periods per category; the remaining gap is whether platform-pg co-residency can achieve them, while the keyed-commitment question is unchanged. Grade and acceptance hold. Cadence instant → instant; checked again immediately.
|
||||
- **2026-09-02** — clean check: acceptance, RISK-REG-0001, and the audit-core keyed-commitment wait unchanged. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.
|
||||
|
|
|
|||
|
|
@ -25,10 +25,10 @@ embargo_condition: "the provider credential is revoked or invalidated and the li
|
|||
embargo_since: "2026-09-01"
|
||||
embargo_review: "2026-09-15"
|
||||
escalation: none
|
||||
last_checked: "2026-09-01T00:32:44Z"
|
||||
next_check: "2026-09-01T00:32:44Z"
|
||||
cadence: instant
|
||||
clean_streak: 0
|
||||
last_checked: "2026-09-02T08:11:17Z"
|
||||
next_check: "2026-09-02T09:11:17Z"
|
||||
cadence: 1h
|
||||
clean_streak: 1
|
||||
waiting_on:
|
||||
- who: railiance-platform
|
||||
what: "revoke or invalidate the provider credential, remove the source default, name fix tracking, and demonstrate governed ciphertext upload plus restore"
|
||||
|
|
@ -38,7 +38,7 @@ waiting_on:
|
|||
default_at: "2026-09-15"
|
||||
graded_by: risk-nexus
|
||||
ruling: RISK-RULING-2026-09-01-A
|
||||
checked_by: "codex/risk-nexus"
|
||||
checked_by: "grok/risk-nexus"
|
||||
---
|
||||
|
||||
# RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
|
||||
|
|
@ -121,3 +121,4 @@ Reasoning: `docs/rulings/2026-09-01-inbox-sweep.md`.
|
|||
## Reviews
|
||||
|
||||
- **2026-09-01** — graded from the filed report and a redacted current-source check. The literal default remains; no fix record was found. Cadence starts at instant.
|
||||
- **2026-09-02** — clean check: literal source default remains; no fix tracking; embargo and 2026-09-15 wait unchanged. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.
|
||||
|
|
|
|||
146
findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md
Normal file
146
findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md
Normal file
|
|
@ -0,0 +1,146 @@
|
|||
---
|
||||
id: RISK-F-0011
|
||||
type: finding
|
||||
title: "qonto-assistant audit.deny stream completeness is not established"
|
||||
status: open
|
||||
owner: risk-nexus
|
||||
reported_by: kings-guard
|
||||
reported_via: gate-house
|
||||
routed_by: gate-house
|
||||
date_reported: "2026-09-01"
|
||||
date_filed: "2026-09-02"
|
||||
system: qonto-assistant
|
||||
environment: production
|
||||
fix_owner: qonto-assistant
|
||||
fix_tracking: unset
|
||||
# Graded by risk-nexus 2026-09-02 — docs/rulings/2026-09-02-qonto-deny-stream.md
|
||||
severity: medium
|
||||
severity_at_production: medium
|
||||
impact: I2
|
||||
likelihood: L3
|
||||
fidelity_modifier: false
|
||||
production_rescore: false
|
||||
disclosure: public
|
||||
publication: pending-handover
|
||||
publication_id: risk-f-0011-qonto-audit-deny-stream-completeness
|
||||
publication_path: "findings/qonto-audit-deny-stream-completeness/v1/index.html"
|
||||
publication_subtitle: "A live deny was observed on qonto-assistant, but nothing yet lets anyone claim the load-bearing deny stream is complete."
|
||||
revision: "graded-1"
|
||||
last_reviewed: "2026-09-02"
|
||||
review_interval: 6m
|
||||
escalation: none
|
||||
last_checked: "2026-09-02T07:20:00Z"
|
||||
next_check: "2026-09-02T07:20:00Z"
|
||||
cadence: instant
|
||||
clean_streak: 0
|
||||
waiting_on:
|
||||
- who: qonto-assistant
|
||||
what: "publish a heartbeat or emission-cadence declaration and a reconciliation view for the audit.deny stream, or reject that obligation"
|
||||
since: "2026-09-02"
|
||||
would_change: "a published cadence plus a reconciliation view would let a later observation support completeness; a rejection keeps the grade and records that estate observation must not treat the stream as complete"
|
||||
default: "the medium grade stands; missing cadence is recorded as a stalled remediation, and observation remains staffed with completeness pending"
|
||||
default_at: "2026-09-16"
|
||||
graded_by: risk-nexus
|
||||
ruling: RISK-RULING-2026-09-02-A
|
||||
checked_by: "grok/risk-nexus"
|
||||
---
|
||||
|
||||
# RISK-F-0011 — qonto-assistant audit.deny stream completeness is not established
|
||||
|
||||
## What is true, as reported
|
||||
|
||||
King's Guard observed real `qonto-assistant` allow and deny events emitted by
|
||||
`audit.AuditLogger` through `CapabilityService`. One deny (`list_transactions`
|
||||
over MCP, `arg_constraint`) arrived with record richness 90 and preserved
|
||||
origin linkage. Gate House accepted that mapping and recorded the qonto lane
|
||||
as staffed for observation.
|
||||
|
||||
The same return says the `audit.deny` class is load-bearing, and that its
|
||||
**stream completeness is unknown**:
|
||||
|
||||
- no heartbeat or emission-cadence declaration is published;
|
||||
- no reconciliation view was supplied;
|
||||
- richness 90 describes the received record, not the stream;
|
||||
- no claim is made that every deny was emitted or observed.
|
||||
|
||||
This is not evidence that an event was suppressed. The reporter assigned no
|
||||
severity and asked this register to intake, grade, and route.
|
||||
|
||||
Safe evidence named by Gate House: kings-guard revision `9daea96`; source
|
||||
return `23480b81-bc34-4df4-92cc-840fbc8514fd`; Gate House disposition
|
||||
`no_change` at commit `feff576` and
|
||||
`gate-house/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md`.
|
||||
The owner route `3b9c26a1-ba1a-4189-b439-edd61683aed5` was unread at intake.
|
||||
|
||||
## How it was found
|
||||
|
||||
Live observation, not a self-assessment. King's Guard completed
|
||||
`KG-WP-0003-T06/T07` against the real qonto-assistant lane. Gate House reviewed
|
||||
the return under `GH-WP-0001-T06` and routed the implementation residual here
|
||||
on 2026-09-01 (message `53645a75-0215-4261-a700-f7aedf09e7e8`).
|
||||
|
||||
## What a current-source check adds
|
||||
|
||||
The local lockout does **not** consume the audit stream. `DenyEscalationTracker`
|
||||
is in-process state on the decision path (`CapabilityService` calls
|
||||
`record_deny` / `check` directly; `AuditLogger.emit` is a parallel record).
|
||||
A dropped audit line would not, on today's source, disable qonto-assistant's
|
||||
own Fast Local Loop.
|
||||
|
||||
What the stream is load-bearing *for* is estate observation. King's Guard
|
||||
already consumes it. Without a cadence declaration or a reconciliation view,
|
||||
that observation can report a received deny and cannot vouch that every deny
|
||||
was emitted.
|
||||
|
||||
No heartbeat, emission-cadence, or reconciliation artefact was found in
|
||||
qonto-assistant at filing. `fix_tracking` is unset.
|
||||
|
||||
Taxonomy ownership of an emission-cadence declaration (net-kingdom /
|
||||
info-tech-canon) is a separate residual. This record does not wait on it:
|
||||
depth-one, and one routing exchange has not yet failed. Silence there does not
|
||||
change qonto-assistant's obligation to declare what it emits, or this grade.
|
||||
|
||||
## Suggested direction
|
||||
|
||||
Suggestion, owned by `qonto-assistant`:
|
||||
|
||||
1. Publish a heartbeat or emission-cadence declaration for `audit.deny`.
|
||||
2. Supply a reconciliation view an observer can use to test completeness.
|
||||
3. Open fix tracking, or reject the obligation in writing so observation stays
|
||||
explicitly incomplete.
|
||||
|
||||
Risk Nexus owns severity, disclosure, escalation, and review cadence.
|
||||
|
||||
## Register ruling — 2026-09-02
|
||||
|
||||
`medium` (`I2` × `L3`), public, no escalation.
|
||||
|
||||
**`I2`: one system's observation of one deny class.** A missed audit.deny
|
||||
does not, on the facts established, authorize a Qonto action or disable the
|
||||
in-process lockout. It leaves estate observation unable to treat the stream as
|
||||
complete. That is confined to the qonto-assistant lane.
|
||||
|
||||
**`L3`: the gap is the current state of a stream the working set already
|
||||
consumes.** King's Guard reached the stream with no additional step and still
|
||||
could not complete the claim. This is not `L4`: suppression is not established,
|
||||
and the band is scored on the missing completeness evidence, not on an
|
||||
unobserved drop. It is not `L2`: waiting for a special foothold would describe
|
||||
the wrong defect.
|
||||
|
||||
**No fidelity modifier.** The observer reported completeness as unknown. A
|
||||
later claim that the stream is complete without a cadence or reconciliation
|
||||
view would be the lying-control state; that is not today's headline.
|
||||
|
||||
**Disclosure `public`.** Reading this does not shorten a path to a defect. It
|
||||
is a missing completeness claim, published as one. Handover to `policy-nexus`
|
||||
is `pending-handover`.
|
||||
|
||||
**No escalation.** No real-person data exposure, no new outside obligation, no
|
||||
new spend, no failed ownership exchange, and no fourteen-day stall. The dated
|
||||
wait makes that last statement expire.
|
||||
|
||||
Reasoning: `docs/rulings/2026-09-02-qonto-deny-stream.md`.
|
||||
|
||||
## Reviews
|
||||
|
||||
- **2026-09-02** — graded from the Gate House intake, the named conformance review, and a current-source check of qonto-assistant. Local lockout is in-process; the emitted deny stream still has no cadence or reconciliation view. Cadence starts at instant.
|
||||
Loading…
Add table
Add a link
Reference in a new issue