coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adaptive check cadence: the interval is earned, not assigned

Browse source 
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.

The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.

Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 07:43:51 +02:00
parent 8b204d0411
commit 42bbf5d2dc
17 changed files with 429 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/method/escalation.md
View file

@ -103,33 +103,22 @@ the operator is a *stuck* disagreement, because only the operator can assign
work across repos that will not take it. One exchange, then escalate — not
three, and not zero.
### 5. Stalled remediation — adopted, bounded by interval
### 5. Stalled remediation — adopted, bounded by the bottom rung
Escalate when a finding's fix has not moved for **twice its review interval**
(`docs/method/review.md`): 14 days for `critical`, 60 for `high`, 180 for
`medium`. `low` findings do not escalate on staleness; they age out through
review.
Escalate when a finding has sat at the **`instant` rung of the cadence ladder
for more than fourteen days** (`docs/method/review.md`).
"Not moved" means the fix owner's tracking record has not changed state and no
new evidence has arrived. A deliberate, stated deferral by the owner is
movement. Silence is not.
The bottom rung means one of two things: every check keeps finding something
wrong, or no check is happening. Fourteen days of either is a stall, and the
escalation does not have to know which — the operator will.
### 6. Ordering hazard across repos — added
This replaces the original severity-keyed interval. It is strictly better: a
`medium` finding that keeps resetting is stalling visibly, and the old rule
would have waited 180 days to say so.
Escalate once when remediating finding A in the wrong order relative to
finding B would create a **false attestation** — a control that starts
claiming a check happened when it did not.
This trigger is not in `INTENT.md`'s list. It is added because `RISK-F-0002`
produced the case: enabling the `ops-warden` signing gate against a forgeable
`flex-auth` would convert an absent control into a signed audit record
asserting an authorization that was never made. Ordering hazards are cheap to
avoid before the fact and expensive to detect afterwards, because the evidence
is what lies.
The escalation is a single acknowledgement of the ordering, not a standing
supervision request. Once the operator has the constraint, the register carries
it.
`low` findings are not exempt. Under the ladder, severity does not set cadence
at all, so there is no rung a `low` finding sits on that a `critical` one does
not.
## What does not escalate