coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adaptive check cadence: the interval is earned, not assigned

Browse source 
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.

The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.

Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 07:43:51 +02:00
parent 8b204d0411
commit 42bbf5d2dc
17 changed files with 429 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

31
REGISTER.md
View file

@ -2,21 +2,21 @@
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-20. Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-20.
6 open of 9 findings; 3 notes below the floor. 8 live of 9 findings; 3 notes below the floor.
## Findings ## Findings
| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by | | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, partially-answered) | risk-nexus | open | 2026-11-17 | | [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | embargoed | none | railiance-platform | open | instant (0) | **due** |
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 2026-09-18 | | [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, partially-answered) | risk-nexus | open | instant (0) | **due** |
| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | 2026-09-18 | | [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | instant (0) | **due** |
| [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | 2026-11-17 | | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | instant (0) | **due** |
| [RISK-F-0004](findings/RISK-F-0004-agent-boundary-policy-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | unset | unset | unset | railiance-platform | open | — | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | instant (0) | **due** |
| [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | 2026-09-18 | | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | instant (0) | **due** |
| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | mitigated | 2026-09-18 | | [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | medium | embargoed | none | ops-warden | mitigated | instant (0) | **due** |
| [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | 2026-11-17 | | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | instant (0) | **due** |
| [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | 2026-08-26 | | [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | instant (0) | **due** |
## Constraints ## Constraints
@ -32,11 +32,12 @@ Held from publication with a stated condition. A hold with no moving condition i
| Finding | Since | Lifts when | Re-decided | | Finding | Since | Lifts when | Re-decided |
| --- | --- | --- | --- | | --- | --- | --- | --- |
| RISK-F-0009 | 2026-08-20 | the deny set covers every high-risk lane with a KV path, verified against live OpenBao | — |
| RISK-F-0007 | 2026-08-19 | a verification exists for at least one consumer boundary | 2026-09-18 | | RISK-F-0007 | 2026-08-19 | a verification exists for at least one consumer boundary | 2026-09-18 |
| RISK-F-0006 | 2026-08-19 | a backup exists and a restore has been demonstrated once | 2026-09-18 | | RISK-F-0006 | 2026-08-19 | a backup exists and a restore has been demonstrated once | 2026-09-18 |
| RISK-F-0005 | 2026-08-19 | AUDIT-WP-0008-T04 lands a tenant filter in the read path | 2026-11-17 | | RISK-F-0005 | 2026-08-19 | AUDIT-WP-0008-T04 lands a tenant filter in the read path | 2026-11-17 |
| RISK-F-0004 | 2026-08-19 | the read path filters by tenant in code | 2026-09-18 | | RISK-F-0004 | 2026-08-19 | the read path filters by tenant in code | 2026-09-18 |
| RISK-F-0003 | 2026-08-19 | the five exec_capable lanes graded under WARDEN-WP-0032-T05 | 2026-09-18 | | RISK-F-0003 | 2026-08-19 | RISK-F-0009 resolved — the OpenBao deny set covers every high-risk lane with a KV path | 2026-09-18 |
| RISK-F-0002 | 2026-08-19 | FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production | 2026-11-17 | | RISK-F-0002 | 2026-08-19 | FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production | 2026-11-17 |
## Notes (below the floor) ## Notes (below the floor)
@ -52,5 +53,7 @@ Seen, deliberately not findings. Not graded, not reviewed, not published.
## How to read this ## How to read this
Severity is `docs/method/severity.md`; disclosure `docs/method/disclosure.md`; Severity is `docs/method/severity.md`; disclosure `docs/method/disclosure.md`;
escalation `docs/method/escalation.md`; review dates `docs/method/review.md`. escalation `docs/method/escalation.md`; the check cadence `docs/method/review.md`.
Cadence is the ladder rung and the count of consecutive clean checks — a finding at `1q (9)`
has held still for a long time; one at `instant (0)` moved recently. Anything wrong resets it.
A constraint may be graded higher than the finding that carries it — read both. A constraint may be graded higher than the finding that carries it — read both.

35
docs/method/escalation.md
View file

@ -103,33 +103,22 @@ the operator is a *stuck* disagreement, because only the operator can assign
work across repos that will not take it. One exchange, then escalate — not work across repos that will not take it. One exchange, then escalate — not
three, and not zero. three, and not zero.
### 5. Stalled remediation — adopted, bounded by interval ### 5. Stalled remediation — adopted, bounded by the bottom rung
Escalate when a finding's fix has not moved for **twice its review interval** Escalate when a finding has sat at the **`instant` rung of the cadence ladder
(`docs/method/review.md`): 14 days for `critical`, 60 for `high`, 180 for for more than fourteen days** (`docs/method/review.md`).
`medium`. `low` findings do not escalate on staleness; they age out through
review.
"Not moved" means the fix owner's tracking record has not changed state and no The bottom rung means one of two things: every check keeps finding something
new evidence has arrived. A deliberate, stated deferral by the owner is wrong, or no check is happening. Fourteen days of either is a stall, and the
movement. Silence is not. escalation does not have to know which — the operator will.
### 6. Ordering hazard across repos — added This replaces the original severity-keyed interval. It is strictly better: a
`medium` finding that keeps resetting is stalling visibly, and the old rule
would have waited 180 days to say so.
Escalate once when remediating finding A in the wrong order relative to `low` findings are not exempt. Under the ladder, severity does not set cadence
finding B would create a **false attestation** — a control that starts at all, so there is no rung a `low` finding sits on that a `critical` one does
claiming a check happened when it did not. not.
This trigger is not in `INTENT.md`'s list. It is added because `RISK-F-0002`
produced the case: enabling the `ops-warden` signing gate against a forgeable
`flex-auth` would convert an absent control into a signed audit record
asserting an authorization that was never made. Ordering hazards are cheap to
avoid before the fact and expensive to detect afterwards, because the evidence
is what lies.
The escalation is a single acknowledgement of the ordering, not a standing
supervision request. Once the operator has the constraint, the register carries
it.
## What does not escalate ## What does not escalate

118
docs/method/review.md
View file

@ -14,20 +14,75 @@ review_interval: 180d
`INTENT.md`: a finding that has sat untouched past its review date is itself a `INTENT.md`: a finding that has sat untouched past its review date is itself a
finding. Silence is not resolution. This document makes that operable. finding. Silence is not resolution. This document makes that operable.
## Intervals ## The cadence ladder
Set from the headline severity at grading time, and reset at each review. Operator ruling, 2026-08-20. **Intervals are not set by severity. They are
earned by outcomes.**
| Severity | Interval | Stale (2×, escalation trigger 5) | A finding is checked, and the check comes back clean or it does not. Clean
| --- | --- | --- | climbs one rung. Anything wrong drops straight back to the bottom.
| `critical` | 7 days | 14 days |
| `high` | 30 days | 60 days |
| `medium` | 90 days | 180 days |
| `low` | 180 days | — (ages out through review) |
A finding graded `critical` is being looked at weekly or it is not being | Rung | Wait before the next check |
managed. If weekly is unbearable, the honest response is to re-grade it, not | --- | --- |
to let the date slide. | `instant` | now, and again immediately until a check comes back clean |
| `1h` | one hour |
| `8h` | eight hours |
| `24h` | one day |
| `48h` | two days |
| `96h` | four days |
| `7d` | one week |
| `14d` | two weeks |
| `1mo` | one month |
| `1q` | one quarter — **the ceiling; nothing is ever checked less often than this** |
Two rules and one escape:
- **Climb on clean.** One rung per clean check, never two.
- **Reset on anything wrong.** Not a slide down one rung — straight to
`instant`. A matter that has just moved has no track record, whatever it had
before.
- **The operator may defer.** An `instant` finding can be deferred to a stated
future date by explicit operator decision, recorded as `deferred_to`. That is
the only way out of the bottom rung other than a clean check, and it is a
decision with a name on it rather than a check quietly not happening.
### The rung is the signal
This is the point of the design, not a side effect. **The cadence a finding
sits on is a statement about how stable the estate has been on that matter.**
`RISK-F-0002` at `1q (9)` says the signing gate has been examined ten times
over three months and nothing has moved. `RISK-F-0002` at `instant (0)` says
something changed within the day. The number carries information that no
severity does — severity says how bad it would be, the rung says how settled
it is — and the two are independent. A `low` finding that keeps resetting is
telling you something a `critical` one at the ceiling is not.
It is also self-correcting in the direction that matters. Anything volatile
gets attention often, automatically, without anyone deciding it deserves it;
anything genuinely quiet stops consuming attention, without anyone deciding to
stop looking. Neither of those judgements has to be made by a person who might
be wrong or busy.
### What "clean" means
A check is **clean** when nothing about the assessment moved: the grade still
holds, every stated blocker is still true, the fix state is unchanged, the
disclosure state is still right, and no new fact has arrived.
A check is **not clean** when any of those moved — including when they moved in
a good direction. `RISK-F-0001` being fixed is not a clean check; it is a large
change, and the next check comes immediately. Good news resets the ladder
exactly like bad news, because the ladder measures stillness, not health.
### Starting position
Every finding starts at `instant`. A register with no check history has no
grounds to wait, and the first clean check is what buys the first hour.
The whole register sat at `instant (0)` on 2026-08-20, which is correct and
temporary: everything in it had been graded, re-graded or ruled on within the
preceding day.
## What a review is ## What a review is
@ -58,18 +113,19 @@ and `review_by` is pushed by one interval. A review that changes nothing still
writes the line — "checked, nothing moved" is the evidence that the silence was writes the line — "checked, nothing moved" is the evidence that the silence was
observed rather than accidental. observed rather than accidental.
## When a review is missed ## When a check is missed
Overdue is not a status change on the finding. It is a fact about *this repo*, Overdue is not a status change on the finding. It is a fact about *this repo*,
and it surfaces in three places: and it surfaces in three places:
- `make check` reports it (`tools/register_check.py`), always, unconditionally. - `make check` lists it under "Checks due", with how late it is and which rung
- `REGISTER.md` shows the finding as overdue with the day count. it is on.
- At **twice** the interval, escalation trigger 5 fires for `critical`, - `REGISTER.md` shows the next check as **due**.
`high` and `medium`. That is the point at which the register's own silence - A finding sitting at the bottom rung for more than fourteen days with no
reaches the operator. movement fires escalation trigger 5. Bottom rung means it keeps failing or
keeps being skipped; fourteen days of that is a stall whichever it is.
The register does not auto-escalate severity for lateness, and it does not The register does not auto-escalate severity for lateness and does not
auto-close anything. Both would be the register lying about its own state to auto-close anything. Both would be the register lying about its own state to
make a number look better. make a number look better.
@ -90,13 +146,17 @@ obligation is visible rather than discovered on the day.
## Front-matter this adds ## Front-matter this adds
```yaml ```yaml
last_reviewed: "2026-08-19" last_checked: "2026-08-20T05:40:00Z"
review_by: "2026-08-26" next_check: "2026-08-20T06:40:00Z"
cadence: 1h
clean_streak: 1
production_rescore: true production_rescore: true
deferred_to: "" # only by explicit operator decision
``` ```
`review_by` is what the nag reads. It is a date, never a duration, so that `next_check` is what the nag reads, and it is an absolute moment rather than a
nothing has to recompute an interval to know whether a finding is late. duration, so nothing has to recompute an interval to know whether a check is
late. The rungs run in hours as well as days, so it carries a time.
## Closing a finding ## Closing a finding
@ -106,10 +166,20 @@ A finding leaves `open` for exactly one of:
something concrete rather than been told. Publication follows if the something concrete rather than been told. Publication follows if the
disclosure state was `embargoed`. disclosure state was `embargoed`.
- `accepted` — the estate is deliberately carrying it. Requires who accepted - `accepted` — the estate is deliberately carrying it. Requires who accepted
it, why, and a re-review date. `accepted` is not `closed`; it keeps a review it, why, and what ends the acceptance. `accepted` is not closed: it stays on
interval forever. the ladder forever, and it climbs like anything else.
- `mitigated` — the live gap is closed but the finding is not. `RISK-F-0003` is
the case: the boundary now fires, and the omission that let it not fire is
still there. Stays watched.
- `withdrawn` — the finding was wrong, or the defect never existed. Say which. - `withdrawn` — the finding was wrong, or the defect never existed. Say which.
**Any status the tooling does not recognise keeps the finding watched, and the
unrecognised word is reported.** `RISK-F-0003` arrived as `mitigated` on
2026-08-20, before that word existed here, and dropped silently out of
`make check` — a finding vanishing from the nag because someone used an
unfamiliar word is precisely the failure this register exists to prevent. The
tooling now fails loud instead of quiet.
There is no `stale`, no `wontfix` and no silent expiry. A finding that nobody There is no `stale`, no `wontfix` and no silent expiry. A finding that nobody
will fix and nobody will accept stays `open` and keeps arriving in the nag, will fix and nobody will accept stays `open` and keeps arriving in the nag,
because that is the true state. because that is the true state.

19
findings/README.md
View file

@ -1,7 +1,14 @@
# Filing a finding # Filing a finding
One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter, One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter,
then prose. Next id is one past the highest here. then prose.
**Ids are allocated by `risk-nexus`.** Take the next id past the highest you
can see and file — that is the right thing to do — but if two reporters take
the same one, the earlier commit keeps it and the newcomer is renumbered here,
with the original id recorded as `filed_as`. This happened on 2026-08-20
(`RISK-F-0009`, filed as `RISK-F-0004`), which is why it is written down. Do
not renumber your own finding after filing; the register does it and tells you.
## What the reporter fills in ## What the reporter fills in
@ -24,8 +31,14 @@ related: [RISK-F-0001] # optional
`severity`, `severity_at_production`, `impact`, `likelihood`, `severity`, `severity_at_production`, `impact`, `likelihood`,
`fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`, `fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`,
`escalation*`, `constraint*`, `last_reviewed`, `review_by`, `graded_by`, `escalation*`, `constraint*`, `last_checked`, `next_check`, `cadence`,
`ruling`. `clean_streak`, `graded_by`, `ruling`.
`cadence` is the check-frequency rung, and it is earned rather than assigned:
a clean check climbs one rung (`instant` → `1h` → `8h` → `24h` → `48h` → `96h`
→ `7d` → `14d` → `1mo` → `1q`), and anything moving drops it straight back to
`instant`. So the rung on your finding is a public statement about how settled
the matter has been — which is why it is not yours to set.
Setting them yourself is not an error to be corrected — it is a boundary this Setting them yourself is not an error to be corrected — it is a boundary this
repo would rather keep. The reporter says what is true; this repo says how bad repo would rather keep. The reporter says what is true; this repo says how bad

6
findings/RISK-F-0001-flex-auth-unauthenticated-check.md
View file

@ -28,8 +28,10 @@ escalation: withdrawn
escalation_trigger: 1 escalation_trigger: 1
escalation_status: withdrawn-before-sending escalation_status: withdrawn-before-sending
date_fixed: "2026-08-19" date_fixed: "2026-08-19"
last_reviewed: "2026-08-19" last_checked: "2026-08-19T21:30:00Z"
review_by: "2026-08-26" next_check: "2026-08-19T21:30:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19 ruling: RISK-RULING-2026-08-19
--- ---

6
findings/RISK-F-0002-ops-warden-sign-ungated.md
View file

@ -29,8 +29,10 @@ embargo_review: "2026-11-17"
escalation: withdrawn escalation: withdrawn
escalation_trigger: 6 escalation_trigger: 6
escalation_status: withdrawn-hazard-window-closed escalation_status: withdrawn-hazard-window-closed
last_reviewed: "2026-08-19" last_checked: "2026-08-19T21:30:00Z"
review_by: "2026-11-17" next_check: "2026-08-19T21:30:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19 ruling: RISK-RULING-2026-08-19
--- ---

47
findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
View file

@ -10,21 +10,24 @@ date_reported: "2026-08-19"
system: ops-warden system: ops-warden
environment: production environment: production
fix_owner: ops-warden fix_owner: ops-warden
fix_tracking: WARDEN-WP-0032-T05 fix_tracking: WARDEN-WP-0032-T05 (done) / T06 (structural)
# Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md # Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md
severity: high severity: medium
severity_at_production: high severity_at_production: medium
severity_superseded: "high (2026-08-19) — the CLI-layer gap is mitigated"
impact: I4 impact: I4
likelihood: L2 likelihood: L2
fidelity_modifier: false fidelity_modifier: false
production_rescore: false production_rescore: false
disclosure: embargoed disclosure: embargoed
embargo_condition: "the five exec_capable lanes graded under WARDEN-WP-0032-T05" embargo_condition: "RISK-F-0009 resolved — the OpenBao deny set covers every high-risk lane with a KV path"
embargo_since: "2026-08-19" embargo_since: "2026-08-19"
embargo_review: "2026-09-18" embargo_review: "2026-09-18"
escalation: none escalation: none
last_reviewed: "2026-08-19" last_checked: "2026-08-20T05:40:00Z"
review_by: "2026-09-18" next_check: "2026-08-20T05:40:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19 ruling: RISK-RULING-2026-08-19
--- ---
@ -190,3 +193,35 @@ Reasoning: `docs/rulings/2026-08-19-first-grading.md`.
Open at review: OpenBao policy coverage of the five paths; whether Open at review: OpenBao policy coverage of the five paths; whether
`WARDEN-WP-0032-T05` has landed; whether any compliance evidence cites `WARDEN-WP-0032-T05` has landed; whether any compliance evidence cites
`ADR-0004` as implemented. `ADR-0004` as implemented.
## Check — 2026-08-20: mitigated on one layer, `high` → `medium`
`ops-warden` reports all 17 high-risk lanes now exiting 7 on
`warden access --fetch` with `WARDEN_AGENT_ID` set, verified under
`WARDEN-WP-0032-T05`/`T06`. The 14 ungraded lanes are graded; the boundary
fires. The live gap this finding described is closed on the CLI layer.
**Not clean, so the cadence stays at `instant`.** Something moved, and under
the ladder that resets the clock rather than earning a longer one. The next
check is the one that can start climbing.
**`high` → `medium`.** What remains is the omission shape rather than the
instance: whether a future lane can still be added without a grade. That is
`WARDEN-WP-0032-T06`, and the durable form of the operator's maturity-context
rule is `zone-engine`'s (`RISK-N-0004`). Not `low`, because "graded by hand
once" is not the same as "cannot be ungraded again".
**The embargo condition changed rather than being met.** The original condition
— the five `exec_capable` lanes graded — is satisfied. But `RISK-F-0009` shows
the *second* layer, the OpenBao deny set that protects the direct `bao kv get`
path, covers 6 of 17 high-risk lanes. Publishing this finding now would name
lanes that are still reachable by the path this control exists to close. The
condition is therefore re-pointed at `RISK-F-0009`.
That is the disclosure rule working across two findings rather than one: what
matters is whether the text shortens a path, not whether this particular
finding's own fix has landed.
**Verification limit, recorded rather than assumed:** the mitigation is
`ops-warden`'s report and this register has not probed it. Their operator token
is expired, which is also why `RISK-F-0009` rests on a file comparison.

6
findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md
View file

@ -25,8 +25,10 @@ embargo_condition: "the read path filters by tenant in code"
embargo_since: "2026-08-19" embargo_since: "2026-08-19"
embargo_review: "2026-09-18" embargo_review: "2026-09-18"
escalation: none escalation: none
last_reviewed: "2026-08-19" last_checked: "2026-08-19T21:20:00Z"
review_by: "2026-09-18" next_check: "2026-08-19T21:20:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-B ruling: RISK-RULING-2026-08-19-B
--- ---

6
findings/RISK-F-0005-audit-core-unfiltered-read-path.md
View file

@ -25,8 +25,10 @@ embargo_condition: "AUDIT-WP-0008-T04 lands a tenant filter in the read path"
embargo_since: "2026-08-19" embargo_since: "2026-08-19"
embargo_review: "2026-11-17" embargo_review: "2026-11-17"
escalation: none escalation: none
last_reviewed: "2026-08-19" last_checked: "2026-08-19T21:20:00Z"
review_by: "2026-11-17" next_check: "2026-08-19T21:20:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-B ruling: RISK-RULING-2026-08-19-B
--- ---

6
findings/RISK-F-0006-apps-pg-no-backup-configured.md
View file

@ -31,8 +31,10 @@ escalation_answered: "2026-08-19"
escalation_answered_by: the-custodian escalation_answered_by: the-custodian
escalation_act: approve escalation_act: approve
decision: "spend for apps-pg backup storage approved; no ceiling stated" decision: "spend for apps-pg backup storage approved; no ceiling stated"
last_reviewed: "2026-08-19" last_checked: "2026-08-19T23:05:00Z"
review_by: "2026-09-18" next_check: "2026-08-19T23:05:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-B ruling: RISK-RULING-2026-08-19-B
--- ---

6
findings/RISK-F-0007-unverified-tenant-boundary.md
View file

@ -34,8 +34,10 @@ accepted_by: the-custodian
accepted_on: "2026-08-19" accepted_on: "2026-08-19"
accepted_until: "production transition (hard expiry, not a date)" accepted_until: "production transition (hard expiry, not a date)"
decision: "pragmatic default before production — carried unverified; verification of a named consumer boundary on request" decision: "pragmatic default before production — carried unverified; verification of a named consumer boundary on request"
last_reviewed: "2026-08-19" last_checked: "2026-08-19T23:05:00Z"
review_by: "2026-09-18" next_check: "2026-08-19T23:05:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-B ruling: RISK-RULING-2026-08-19-B
--- ---

6
findings/RISK-F-0008-audit-retention-legal-basis-assumed.md
View file

@ -32,8 +32,10 @@ escalation_act: rule
decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor" decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
outstanding: "a defensible retention period per category (waits on audit-core's co-residency horizon), and the trigger list for buying an external answer" outstanding: "a defensible retention period per category (waits on audit-core's co-residency horizon), and the trigger list for buying an external answer"
determination: RISK-REG-0001 determination: RISK-REG-0001
last_reviewed: "2026-08-19" last_checked: "2026-08-20T05:25:00Z"
review_by: "2026-11-17" next_check: "2026-08-20T05:25:00Z" # due now: the ladder starts at instant
cadence: instant
clean_streak: 0
graded_by: risk-nexus graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-C ruling: RISK-RULING-2026-08-19-C
--- ---

86
findings/RISK-F-0004-agent-boundary-policy-covers-a-third-of-high-risk-lanes.md → findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md
View file

@ -1,5 +1,5 @@
--- ---
id: RISK-F-0004 id: RISK-F-0009
type: finding type: finding
title: "agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest" title: "agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest"
status: open status: open
@ -11,12 +11,29 @@ system: railiance-platform
environment: production environment: production
fix_owner: railiance-platform fix_owner: railiance-platform
fix_tracking: unset fix_tracking: unset
severity: unset filed_as: "RISK-F-0004 by ops-warden; renumbered by risk-nexus 2026-08-20 (id collision)"
disclosure: unset answers: RISK-F-0003
escalation: unset related: [RISK-F-0003]
# Graded by risk-nexus 2026-08-20 — docs/rulings/2026-08-20-openbao-layer.md
severity: high
severity_at_production: high
impact: I4
likelihood: L2
fidelity_modifier: false
production_rescore: false
disclosure: embargoed
embargo_condition: "the deny set covers every high-risk lane with a KV path, verified against live OpenBao"
embargo_since: "2026-08-20"
escalation: none
last_checked: "2026-08-20T05:40:00Z"
next_check: "2026-08-20T05:40:00Z"
cadence: instant
clean_streak: 0
graded_by: risk-nexus
ruling: RISK-RULING-2026-08-20
--- ---
# RISK-F-0004 — the OpenBao half of the agent read-boundary covers a third of the lanes # RISK-F-0009 — the OpenBao half of the agent read-boundary covers a third of the lanes
## What is true ## What is true
@ -101,3 +118,62 @@ this from an audit into an invariant.
- ops-warden `ADR-0004`, `ADR-0007` - ops-warden `ADR-0004`, `ADR-0007`
- `ops-warden/wiki/playbooks/agent-read-boundary.md` - `ops-warden/wiki/playbooks/agent-read-boundary.md`
- `railiance-platform/openbao/policies/agent-high-risk-boundary.hcl` - `railiance-platform/openbao/policies/agent-high-risk-boundary.hcl`
## Register ruling — 2026-08-20
**Renumbered from `RISK-F-0004`.** `ops-warden` filed it as `RISK-F-0004`,
which this register had already assigned to `tenant-engine`'s unfiltered event
read hours earlier. Earlier id keeps it; the newcomer moves. Nothing about the
finding changes, and the filing contract now says how ids are allocated so the
next reporter does not hit this.
`high` (`I4` × `L2`), embargoed, no escalation.
**`I4` on the worst uncovered lane.** Eight high-risk lanes have a concrete KV
path the policy does not deny. Most are `I3`-shaped inside their own system;
`scaleway-bootstrap` and `agent-harness-forgejo-deploy` are not — cloud account
bootstrap credentials and a forge deploy key propagate past the system that
holds them.
**`L2`.** It needs an agent token carrying a `workload-kv-read-*` policy, which
the estate does grant. The register holds `ops-warden`'s two stated limits
rather than resolving them in either direction: the comparison is static against
the policy *file* because their operator token is expired (`bao token lookup` →
403), so **the deployed policy may differ**; and whether any agent token
currently carries `agent-high-risk-boundary` together with a
`workload-kv-read-*` policy is not established.
**No fidelity modifier, same call as `RISK-F-0003`.** `ADR-0004` describes two
independent layers and one of them covers a third of the lanes, so the
documentation overstates the control — but the modifier is scoped to
attestations produced at runtime, not to documentation drift. Noted twice now
in the same system; if it recurs a third time the modifier's scope is what
should be re-examined, not the finding.
**No escalation.** `railiance-platform` owns the policy, `ops-warden` owns the
catalog, and they have not disagreed about anything — trigger 4 needs a failed
routing exchange, not merely two repos. `ops-warden`'s suggestion that the deny
set be generated from the catalog rather than maintained twice is routed as a
suggestion, which is what it was offered as.
**The pre-existing point is the important one.** Four of the eight uncovered
lanes were already graded `high` before the 2026-08-19 regrade. The divergence
is not a consequence of that work; the regrade only made the two lists
comparable enough to see it. A register that took credit for finding a fresh
defect here would be misreading its own evidence.
**Disclosure: embargoed**, and it changes `RISK-F-0003`'s embargo too. This
names eight live KV paths that nothing denies.
**One expired credential is blocking verification** of both this finding and
`RISK-F-0003`'s mitigation. That is not a finding — nothing is wrong with the
estate because a token expired — but it is why two gradings here rest on file
comparison rather than a probe, and the register says so rather than implying
otherwise.
## Reviews
- **2026-08-20** — renumbered, graded. Cadence starts at `instant`: nothing
about this has been checked twice yet. Open at the next check: does the
deployed policy match the file; do any agent tokens carry both policies; has
`railiance-platform` taken the catalog-generated deny set.

BIN
tools/__pycache__/register_lib.cpython-312.pyc
View file

Binary file not shown.

97
tools/register_check.py
View file

@ -11,21 +11,11 @@ import datetime as dt
import register_lib as lib import register_lib as lib
TODAY = dt.date.today() NOW = lib.now()
def date(value):
if isinstance(value, dt.date):
return value
if isinstance(value, str) and value not in ("", "unset"):
return dt.date.fromisoformat(value)
return None
def main() -> int: def main() -> int:
# "accepted" is deliberately carried, not closed: it keeps its review fs = [f for f in lib.findings() if lib.watched(f.get("status"))]
# interval and its production re-score, so the nag must keep watching it.
fs = [f for f in lib.findings() if f.get("status") in ("open", "accepted")]
lines: list[str] = [] lines: list[str] = []
def section(title: str, rows: list[str], quiet: str) -> None: def section(title: str, rows: list[str], quiet: str) -> None:
@ -36,44 +26,67 @@ def main() -> int:
lines.append(f" {quiet}") lines.append(f" {quiet}")
lines.append("") lines.append("")
unknown = [
f"{f['id']} — status '{f.get('status')}' is not one of {', '.join(lib.KNOWN_STATUSES)}; watched anyway"
for f in fs
if f.get("status") not in lib.KNOWN_STATUSES
]
if unknown:
section("Unrecognised status", unknown, "none")
ungraded = [ ungraded = [
f"{f['id']} — {', '.join(k for k in lib.GRADED_FIELDS if str(f.get(k, 'unset')) == 'unset')}" f"{f['id']} — {', '.join(k for k in lib.GRADED_FIELDS if str(f.get(k, 'unset')) == 'unset')}"
for f in fs for f in fs
if any(str(f.get(k, "unset")) == "unset" for k in lib.GRADED_FIELDS) if any(str(f.get(k, "unset")) == "unset" for k in lib.GRADED_FIELDS)
] ]
section("Ungraded", ungraded, "none — every open finding carries a grade") section("Ungraded", ungraded, "none — every watched finding carries a grade")
overdue = [] due, deferred = [], []
for f in fs: for f in fs:
due = date(f.get("review_by")) if f.get("deferred_to"):
if due and TODAY > due: until = lib.moment(f["deferred_to"])
overdue.append(f"{f['id']} — review was due {due} ({(TODAY - due).days}d ago)") if until and NOW < until:
section("Overdue review", overdue, "none") deferred.append(f"{f['id']} — deferred by the operator until {f['deferred_to']}")
continue
stale = [] when = lib.moment(f.get("next_check"))
for f in fs: if when is None:
seen = date(f.get("last_reviewed")) due.append(f"{f['id']} — no next_check set")
interval = lib.REVIEW_INTERVAL_DAYS.get(f.get("severity")) elif NOW >= when:
if not seen or not interval or f.get("severity") == "low": late = NOW - when
continue hours = int(late.total_seconds() // 3600)
limit = seen + dt.timedelta(days=interval * lib.STALE_MULTIPLIER) rung = f.get("cadence", "instant")
if TODAY > limit: due.append(
stale.append( f"{f['id']} ({f.get('severity')}) — due {f['next_check']}"
f"{f['id']} ({f.get('severity')}) — untouched since {seen}; " f"{f', {hours}h late' if hours else ''}, cadence {rung}"
f"escalation trigger 5 fires (limit was {limit})"
) )
section("Stalled — escalation trigger 5", stale, "none") section("Checks due", due, "none")
if deferred:
section("Deferred by the operator", deferred, "none")
embargo = [] # The rung is the signal: how long this matter has held still.
for f in fs: stability = []
if f.get("disclosure") != "embargoed": for f in sorted(fs, key=lambda f: lib.rung_index(f.get("cadence", "instant"))):
continue rung = f.get("cadence", "instant")
due = date(f.get("embargo_review")) streak = f.get("clean_streak", 0)
if due and TODAY > due: note = " — at the ceiling" if rung == lib.TOP_RUNG else ""
embargo.append( stability.append(f"{f['id']}: {rung} ({streak} clean in a row){note}")
f"{f['id']} — embargo not re-decided since {due}; lifts when: {f.get('embargo_condition')}" section("Stability — where each finding sits on the ladder", stability, "nothing watched")
)
section("Embargo overdue for re-decision", embargo, "none") bottom = [
f"{f['id']} ({f.get('severity')}) — still at the bottom rung since {f.get('last_checked')}"
for f in fs
if lib.rung_index(f.get("cadence", "instant")) == 0
and (m := lib.moment(f.get("last_checked")))
and NOW - m > dt.timedelta(days=14)
]
section("Stalled — escalation trigger 5", bottom, "none")
embargo = [
f"{f['id']} — lifts when: {f.get('embargo_condition')}"
for f in fs
if f.get("disclosure") == "embargoed"
]
section("Embargoed", embargo, "none")
esc = [ esc = [
f"{f['id']} — trigger {f.get('escalation_trigger')}, {f.get('escalation_status')}" f"{f['id']} — trigger {f.get('escalation_trigger')}, {f.get('escalation_status')}"
@ -89,7 +102,7 @@ def main() -> int:
] ]
section("Owed at the production transition", rescore, "none — no finding is graded lower for build mode") section("Owed at the production transition", rescore, "none — no finding is graded lower for build mode")
print(f"Register check — {TODAY}\n{len(fs)} open or accepted finding(s)\n") print(f"Register check — {NOW:%Y-%m-%d %H:%MZ}\n{len(fs)} live finding(s)\n")
print("\n".join(lines).rstrip()) print("\n".join(lines).rstrip())
return 0 return 0

36
tools/register_index.py
View file

@ -22,14 +22,19 @@ def date(value) -> dt.date | None:
return None return None
def review_cell(f: dict) -> str: def check_cell(f: dict) -> str:
due = date(f.get("review_by")) when = lib.moment(f.get("next_check"))
if due is None: if when is None:
return "—" return "—"
late = (TODAY - due).days if lib.now() >= when:
if late > 0: return "**due**"
return f"**{due} (overdue {late}d)**" return when.strftime("%Y-%m-%d %H:%MZ")
return str(due)
def cadence_cell(f: dict) -> str:
rung = f.get("cadence", "instant")
streak = f.get("clean_streak", 0)
return f"{rung} ({streak})"
def sev_cell(f: dict) -> str: def sev_cell(f: dict) -> str:
@ -50,23 +55,23 @@ def esc_cell(f: dict) -> str:
def render() -> str: def render() -> str:
fs = lib.findings() fs = lib.findings()
ns = lib.notes() ns = lib.notes()
open_fs = [f for f in fs if f.get("status") == "open"] open_fs = [f for f in fs if lib.watched(f.get("status"))]
out = [ out = [
"# Register", "# Register",
"", "",
f"Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built {TODAY}.", f"Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built {TODAY}.",
"", "",
f"{len(open_fs)} open of {len(fs)} findings; {len(ns)} notes below the floor.", f"{len(open_fs)} live of {len(fs)} findings; {len(ns)} notes below the floor.",
"", "",
"## Findings", "## Findings",
"", "",
"| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by |", "| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |",
"| --- | --- | --- | --- | --- | --- | --- | --- | --- |", "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |",
] ]
for f in fs: for f in fs:
out.append( out.append(
"| [{id}]({path}) | {title} | {system} | {sev} | {disc} | {esc} | {owner} | {status} | {review} |".format( "| [{id}]({path}) | {title} | {system} | {sev} | {disc} | {esc} | {owner} | {status} | {cadence} | {check} |".format(
id=f["id"], id=f["id"],
path=f["_path"].relative_to(lib.REPO), path=f["_path"].relative_to(lib.REPO),
title=str(f.get("title", "")).strip('"'), title=str(f.get("title", "")).strip('"'),
@ -76,7 +81,8 @@ def render() -> str:
esc=esc_cell(f), esc=esc_cell(f),
owner=f.get("fix_owner", "—"), owner=f.get("fix_owner", "—"),
status=f.get("status", "—"), status=f.get("status", "—"),
review=review_cell(f), cadence=cadence_cell(f),
check=check_cell(f),
) )
) )
@ -112,7 +118,9 @@ def render() -> str:
out += ["", "## How to read this", "", out += ["", "## How to read this", "",
"Severity is `docs/method/severity.md`; disclosure `docs/method/disclosure.md`;", "Severity is `docs/method/severity.md`; disclosure `docs/method/disclosure.md`;",
"escalation `docs/method/escalation.md`; review dates `docs/method/review.md`.", "escalation `docs/method/escalation.md`; the check cadence `docs/method/review.md`.",
"Cadence is the ladder rung and the count of consecutive clean checks — a finding at `1q (9)`",
"has held still for a long time; one at `instant (0)` moved recently. Anything wrong resets it.",
"A constraint may be graded higher than the finding that carries it — read both.", "A constraint may be graded higher than the finding that carries it — read both.",
""] ""]
return "\n".join(out) return "\n".join(out)

66
tools/register_lib.py
View file

@ -4,6 +4,7 @@ The finding files are the source of truth. Nothing here writes to them.
""" """
from __future__ import annotations from __future__ import annotations
import datetime as dt
import pathlib import pathlib
import yaml import yaml
@ -12,9 +13,53 @@ FINDINGS = REPO / "findings"
NOTES = REPO / "notes" NOTES = REPO / "notes"
SEVERITIES = ["critical", "high", "medium", "low"] SEVERITIES = ["critical", "high", "medium", "low"]
REVIEW_INTERVAL_DAYS = {"critical": 7, "high": 30, "medium": 90, "low": 180} GRADED_FIELDS = ["severity", "disclosure", "escalation", "next_check", "cadence"]
STALE_MULTIPLIER = 2 # A finding leaves the watch list only by being genuinely finished. Anything
GRADED_FIELDS = ["severity", "disclosure", "escalation", "review_by", "last_reviewed"] # else — including a word the register has not seen before — stays watched, and
# the unknown word is reported. A finding must never fall out of the nag because
# somebody used a status the tooling did not recognise.
CLOSED_STATUSES = ("fixed", "withdrawn")
KNOWN_STATUSES = ("open", "accepted", "mitigated") + CLOSED_STATUSES
def watched(status: str | None) -> bool:
return status not in CLOSED_STATUSES
# The adaptive cadence ladder (operator ruling, 2026-08-20). A clean check
# climbs one rung; anything wrong drops straight back to `instant`. The rung a
# finding sits on is itself the signal: how stable this matter has been.
CADENCE = [
("instant", dt.timedelta(0)),
("1h", dt.timedelta(hours=1)),
("8h", dt.timedelta(hours=8)),
("24h", dt.timedelta(hours=24)),
("48h", dt.timedelta(hours=48)),
("96h", dt.timedelta(hours=96)),
("7d", dt.timedelta(days=7)),
("14d", dt.timedelta(days=14)),
("1mo", dt.timedelta(days=30)),
("1q", dt.timedelta(days=90)),
]
CADENCE_NAMES = [name for name, _ in CADENCE]
TOP_RUNG = CADENCE_NAMES[-1]
def rung_index(name: str) -> int:
return CADENCE_NAMES.index(name) if name in CADENCE_NAMES else 0
def interval(name: str) -> dt.timedelta:
return CADENCE[rung_index(name)][1]
def climb(name: str) -> str:
"""One clean check: up one rung, never past the quarter."""
return CADENCE_NAMES[min(rung_index(name) + 1, len(CADENCE) - 1)]
def reset() -> str:
"""Anything wrong: back to the bottom."""
return CADENCE_NAMES[0]
def load(path: pathlib.Path) -> dict: def load(path: pathlib.Path) -> dict:
@ -38,5 +83,20 @@ def notes() -> list[dict]:
return sorted((load(p) for p in NOTES.glob("RISK-N-*.md")), key=lambda n: n["id"], reverse=True) return sorted((load(p) for p in NOTES.glob("RISK-N-*.md")), key=lambda n: n["id"], reverse=True)
def moment(value) -> dt.datetime | None:
"""Parse a date or datetime front-matter value as UTC."""
if isinstance(value, dt.datetime):
return value if value.tzinfo else value.replace(tzinfo=dt.timezone.utc)
if isinstance(value, dt.date):
return dt.datetime.combine(value, dt.time(0, 0), tzinfo=dt.timezone.utc)
if isinstance(value, str) and value not in ("", "unset"):
return dt.datetime.fromisoformat(value.replace("Z", "+00:00")).astimezone(dt.timezone.utc)
return None
def now() -> dt.datetime:
return dt.datetime.now(dt.timezone.utc)
def sev_rank(sev: str) -> int: def sev_rank(sev: str) -> int:
return SEVERITIES.index(sev) if sev in SEVERITIES else len(SEVERITIES) return SEVERITIES.index(sev) if sev in SEVERITIES else len(SEVERITIES)