coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Intake RISK-F-0011 and climb the due checks

Browse source 
Gate House routed a King's Guard observation that qonto-assistant's
audit.deny stream has no completeness evidence. Filed and graded medium,
public, open. Clean-checked F-0010, F-0008, and REG-0001 after confirming
nothing moved. Raised the inbox timeout so question-zero does not false-fail
on the tunneled hub.

Assistant: grok
Assistant-Session: 01a060e9-e363-7521-bf11-df5fa31b7156
This commit is contained in:
tegwick 2026-09-02 10:14:43 +02:00
parent dceb5ba008
commit 29f50d5143
9 changed files with 274 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

11
findings/RISK-F-0008-audit-retention-legal-basis-assumed.md
View file

@ -44,10 +44,10 @@ escalation_act: rule
decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
outstanding: "whether the stated target periods are achievable under platform-pg co-residency, and whether a keyed commitment restores erasability"
determination: RISK-REG-0001
last_checked: "2026-09-01T00:38:53Z"
next_check: "2026-09-01T00:38:53Z"
cadence: instant
clean_streak: 0
last_checked: "2026-09-02T08:11:17Z"
next_check: "2026-09-02T09:11:17Z"
cadence: 1h
clean_streak: 1
waiting_on:
- who: audit-core
what: "does a keyed commitment restore erasability without breaking chain verification; what is the platform-pg co-residency horizon"
@ -57,7 +57,7 @@ waiting_on:
default_at: "2026-11-17"
graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-C
checked_by: "codex/risk-nexus"
checked_by: "grok/risk-nexus"
---
# RISK-F-0008 — the exemption nobody has established
@ -364,3 +364,4 @@ co-residency horizon that decides whether the stated retention periods are
achievable. An accepted risk still gets checked.
- **2026-08-20** — not clean: Trigger list ruled: no external determination in build mode; accepted with the legal policy set as the compensating control. Cadence instant → instant; checked again immediately.
- **2026-09-01** — not clean: the regulatory record now states target periods per category; the remaining gap is whether platform-pg co-residency can achieve them, while the keyed-commitment question is unchanged. Grade and acceptance hold. Cadence instant → instant; checked again immediately.
- **2026-09-02** — clean check: acceptance, RISK-REG-0001, and the audit-core keyed-commitment wait unchanged. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.