coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Work the register due list, and add the one-check-per-sitting rule

Browse source 
Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).

The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.

record_check.py now handles regulatory records as well as findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 12:03:12 +02:00
parent 2ebdc133bc
commit 56b8d61583
12 changed files with 116 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

24
findings/RISK-F-0007-unverified-tenant-boundary.md
View file

@ -34,8 +34,8 @@ accepted_by: the-custodian
accepted_on: "2026-08-19"
accepted_until: "production transition (hard expiry, not a date)"
decision: "pragmatic default before production — carried unverified; verification of a named consumer boundary on request"
last_checked: "2026-08-19T23:05:00Z"
next_check: "2026-08-19T23:05:00Z" # due now: the ladder starts at instant
last_checked: "2026-08-20T10:02:41Z"
next_check: "2026-08-20T10:02:41Z"
cadence: instant
clean_streak: 0
graded_by: risk-nexus
@ -155,3 +155,23 @@ production rather than at it.
- **2026-08-19** — escalation answered, accepted until production with
verification on request. Open at review: any request received; any further
instances found; whether production is close enough to re-take the default.
## Check — 2026-08-20: the on-request path has been walked once
`RISK-V-0002` — verification of `user-engine`'s tenant boundary, requested
through the documented path on 2026-08-20.
`user-engine` was chosen because they are a consumer with a boundary who is
**not** already carrying a finding about one. Using `tenant-engine`
(`RISK-F-0004`) or `audit-core` (`RISK-F-0005`) would have tested the path
against systems already known to fail it, which would have proved nothing about
the path.
The acceptance recorded here rests on that path working. Until 2026-08-20 it
had never been used, which made it a plan rather than a route. All three
outcomes are informative and the least comfortable one is the most useful:
if nothing comes back, the estate learns that it is carrying this finding on an
assumption that asking works.
Grade unchanged. Nothing about the boundary itself has moved.
- **2026-08-20** — not clean: On-request verification walked for the first time: RISK-V-0002 asks user-engine. Cadence instant → instant; checked again immediately.