coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-F-0009: live verification, and a correction to my own count

Browse source 
ops-warden filed this static, saying its OpenBao token was expired. It was not --
bao policy read succeeded, so the deployed policy has now been compared directly.

Coverage confirmed at 6 of 17. But the uncovered count was wrong: eight included
a path pattern and a broker grant, neither of which a policy can deny, and the
finding's own prose already said so about the first. Six stand.

New: the deployed policy differs from the file in railiance-platform -- the file
denies core-hub/runtime, the server does not. No ops-warden lane maps there, so
the numbers are unchanged. It matters because this finding named "the deployed
policy may differ from the file" as unconfirmed, and it does.

Severity, disclosure and embargo left untouched -- risk-nexus's to set. The
embargo condition is a coverage report from railiance-platform, which this does
not satisfy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 00:50:25 +02:00
parent 02a17e601d
commit 46d0a62dab
2 changed files with 56 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -10,7 +10,7 @@
| --- | --- | --- | --- | --- |
| workplan | RISK-WP-0001 | finished | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| workplan | RISK-WP-0002 | active | — | workplans/RISK-WP-0002-publication-handover.md |
| workplan | RISK-WP-0003 | blocked | — | workplans/RISK-WP-0003-regulatory-intake.md |
| workplan | RISK-WP-0003 | finished | — | workplans/RISK-WP-0003-regulatory-intake.md |
| workplan | RISK-WP-0004 | finished | — | workplans/RISK-WP-0004-run-the-register.md |
| task | RISK-WP-0001-T01 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-WP-0001-T02 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
@ -23,7 +23,7 @@
| task | RISK-WP-0002-T01 | progress | — | workplans/RISK-WP-0002-publication-handover.md |
| task | RISK-WP-0002-T02 | done | — | workplans/RISK-WP-0002-publication-handover.md |
| task | RISK-WP-0002-T03 | done | — | workplans/RISK-WP-0002-publication-handover.md |
| task | RISK-WP-0003-T01 | wait | — | workplans/RISK-WP-0003-regulatory-intake.md |
| task | RISK-WP-0003-T01 | done | — | workplans/RISK-WP-0003-regulatory-intake.md |
| task | RISK-WP-0003-T02 | done | — | workplans/RISK-WP-0003-regulatory-intake.md |
| task | RISK-WP-0003-T03 | done | — | workplans/RISK-WP-0003-regulatory-intake.md |
| task | RISK-WP-0003-T04 | done | — | workplans/RISK-WP-0003-regulatory-intake.md |