coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0004: five of six tasks done; the executor is the operator's call

Browse source 
T02 inbox check, wired into make check and verified against the actual
2026-08-19 failure — replayed at that moment it surfaces all three
messages that were already waiting. T03 sweeps the rest of the
quietly-tolerated class: bad dates, cadence off the ladder, undefined
disclosure states, dangling constraint_on and related refs, embargoes
without conditions, escalations without triggers. T04 requests
verification of user-engine's tenant boundary — the first walk down the
on-request path, chosen as a consumer not already known to fail it. T05
established by trying what this register can verify: cluster yes, OpenBao
403. T06 puts regulatory records on the findings ladder.

T01 stays in progress: the procedure, make due and make checked exist,
but arming something that runs them on schedule is a standing compute
commitment and the operator's to make.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 08:49:23 +02:00
parent 97fcc56a4d
commit 36b707f0c3
10 changed files with 296 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/regulatory/audit-retention-basis.md
View file

@ -8,7 +8,10 @@ determined: "2026-08-20"
finding: RISK-F-0008
sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147"
external_review: none
review_by: "2026-11-17"
last_checked: "2026-08-20T05:25:00Z"
next_check: "2026-08-20T05:25:00Z"
cadence: instant
clean_streak: 0
---
# RISK-REG-0001 — the retention basis, written down