From 59e3e0a23a01fb761f6dd6718d266f0bdaa424a9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 08:35:13 +0200 Subject: [PATCH] STATE.md: what the gap analysis changed Co-Authored-By: Claude Opus 5 --- STATE.md | 24 +++++++++++++++--------- WORK-RECORDS.md | 16 ++++++++-------- 2 files changed, 23 insertions(+), 17 deletions(-) diff --git a/STATE.md b/STATE.md index ca756a9..84f4114 100644 --- a/STATE.md +++ b/STATE.md @@ -18,7 +18,7 @@ question carries a default and a date, and the check cadence is scheduled on | `RISK-WP-0002` | active | Publication handover — T01 with `policy-nexus` | | `RISK-WP-0003` | **finished** | Regulatory intake; the legal policy set | | `RISK-WP-0004` | **finished** | Running the register: cadence, verification, inbox-before-grading | -| `RISK-WP-0005` | active | Closing the seven gaps in `history/2026-08-21-intent-gap-analysis.md` | +| `RISK-WP-0005` | **finished** | The seven gaps from `history/2026-08-21-intent-gap-analysis.md` | ## The register @@ -53,6 +53,8 @@ docs/regulatory/ RISK-REG-0001 + policies/ (13, keyed by activation) docs/verifications/ RISK-V-000N — what this repo checked itself make due the work list +make fixes state of every tracked fix, from the owner's file +make coverage what the register has never heard from make checked ARGS=... record an outcome; moves the cadence rung make check index + malformed + waits + inbox + escalations ``` @@ -88,17 +90,21 @@ python3 tools/register_check.py # just the register statehub fix-consistency --repo risk-nexus ``` -## Known, and being worked +## What the gap analysis changed `history/2026-08-21-intent-gap-analysis.md` graded this repo against its own -`INTENT.md`. Five of six ownership claims hold; seven gaps do not, and -`RISK-WP-0005` carries them. The two worth knowing without reading it: +`INTENT.md` and `RISK-WP-0005` closed all seven gaps the same day. -- **`fix_tracking` is a string nobody reads.** The register claims to track - remediation and does not — an owner who goes quiet and a fix that goes quiet - look identical. -- **Incident and external-report intake do not exist**, though `INTENT.md` - claims both. Every finding so far came from a repo reading its own code. +- **Fix state is read, not remembered.** `make fixes` resolves every + `fix_tracking` against the owning repo's workplan file. Its first run found + `RISK-F-0005`'s fix already landed three days earlier, and both of + `RISK-F-0002`'s tracked records closed *before that finding was filed*. +- **Incident intake exists**, with `first_observed` starting the 72-hour clock + in `RISK-POL-0005` and escalation that is not batched. +- **External report still has no address** — proposed to `policy-nexus` and the + custodian, since a published surface is not this repo's to create. +- **Coverage has a number:** `make coverage` — 7 of 117 registered repos have + ever appeared in a finding. The other 110 are unknown, not clean. ## Known conditions diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index dea4c71..01c9d99 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,7 +12,7 @@ | workplan | RISK-WP-0002 | active | — | workplans/RISK-WP-0002-publication-handover.md | | workplan | RISK-WP-0003 | finished | — | workplans/RISK-WP-0003-regulatory-intake.md | | workplan | RISK-WP-0004 | finished | — | workplans/RISK-WP-0004-run-the-register.md | -| workplan | RISK-WP-0005 | active | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| workplan | RISK-WP-0005 | finished | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | | task | RISK-WP-0001-T01 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T02 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T03 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md | @@ -34,10 +34,10 @@ | task | RISK-WP-0004-T04 | done | — | workplans/RISK-WP-0004-run-the-register.md | | task | RISK-WP-0004-T05 | done | — | workplans/RISK-WP-0004-run-the-register.md | | task | RISK-WP-0004-T06 | done | — | workplans/RISK-WP-0004-run-the-register.md | -| task | RISK-WP-0005-T01 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T02 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T03 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T04 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T05 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T06 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | -| task | RISK-WP-0005-T07 | todo | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T01 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T02 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T03 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T04 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T05 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T06 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md | +| task | RISK-WP-0005-T07 | done | — | workplans/RISK-WP-0005-close-the-intent-gaps.md |