RISK-WP-0004: five of six tasks done; the executor is the operator's call

T02 inbox check, wired into make check and verified against the actual
2026-08-19 failure — replayed at that moment it surfaces all three
messages that were already waiting. T03 sweeps the rest of the
quietly-tolerated class: bad dates, cadence off the ladder, undefined
disclosure states, dangling constraint_on and related refs, embargoes
without conditions, escalations without triggers. T04 requests
verification of user-engine's tenant boundary — the first walk down the
on-request path, chosen as a consumer not already known to fail it. T05
established by trying what this register can verify: cluster yes, OpenBao
403. T06 puts regulatory records on the findings ladder.

T01 stays in progress: the procedure, make due and make checked exist,
but arming something that runs them on schedule is a standing compute
commitment and the operator's to make.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -1,11 +1,12 @@
 PY := python3
 TOOLS := tools
 
-.PHONY: help register check checked
+.PHONY: help register check checked due
 
 help:
 	@echo "make register  - rebuild REGISTER.md from findings/"
-	@echo "make check     - verify the index is current, then report what is going quiet"
+	@echo "make check     - verify the index, report what is going quiet, and read the inbox"
+	@echo "make due       - just the work list: what needs a check right now"
 	@echo "make checked   - record a check outcome: make checked ARGS=\"RISK-F-0002 clean\""
 
 register:
@@ -15,7 +16,13 @@ check:
 	@$(PY) $(TOOLS)/register_index.py --check
 	@echo
 	@$(PY) $(TOOLS)/register_check.py
+	@echo
+	@$(PY) $(TOOLS)/inbox_check.py
 
 checked:
 	@$(PY) $(TOOLS)/record_check.py $(ARGS)
 	@$(PY) $(TOOLS)/register_index.py
+
+due:
+	@$(PY) $(TOOLS)/register_check.py | sed -n '/Checks due/,/^$$/p'
+	@$(PY) $(TOOLS)/inbox_check.py