coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Review the overdue regulatory records

Browse source 
RISK-REG-0001: eight-year voucher period (BEG IV) confirmed against
secondary sources and §147 AO. RISK-POL-0009/0002: positions unchanged; new
restore evidence noted as partial. RISK-POL-0012: receiving duty still
unowned; issuing phase-in dates added, flagged for confirmation.
RISK-POL-0011: stays dormant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 08:26:43 +02:00
parent aa0a85b893
commit 5a7e4ac2d4
5 changed files with 85 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md
View file

@ -8,10 +8,11 @@ activates_when: "any personal data is held — the commercial half (RISK-POL-000
owner: risk-nexus
written: "2026-08-20"
related: [RISK-POL-0009, RISK-REG-0001, RISK-F-0008]
cadence: instant
clean_streak: 0
last_checked: "2026-08-20T21:30:00Z"
next_check: "2026-08-20T21:30:00Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-09-22T06:26:12Z"
next_check: "2026-09-22T07:26:12Z"
checked_by: "worsch"
---
# RISK-POL-0002 — retention and erasure
@ -61,3 +62,19 @@ and verified co-residency horizon; a demonstrated restore proving the retained
side works too.
None of those exist yet, and `RISK-F-0008` carries the gap.
**2026-09-22 review.** The position is unchanged and `RISK-F-0008` still
carries the gap. Two partial inputs have arrived since 2026-08-20:
- `audit-core` (AUDIT-WP-0008) states it declares nothing above the 30-day
`platform-pg` default and will not extend any co-resident's horizon. That is
a *stated* contribution to the co-residency horizon. It does not verify the
instance maximum, which also depends on the other co-residents and on backup
retention.
- Restores from the retained side are demonstrated for `apps-pg` and Forgejo
(RPF-WP-0029, RPF-WP-0038). That shows the retained side works, but it
proves no deletion at expiry.
## Reviews
- **2026-09-22** — clean check: Position unchanged; audit-core states a 30-day contribution (unverified instance maximum); restore evidence exists, no deletion evidence; F-0008 carries the gap. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

30
docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md
View file

@ -7,10 +7,11 @@ status: active
activates_when: "the estate keeps commercial books or issues and receives invoices — already true"
owner: risk-nexus
written: "2026-08-20"
cadence: instant
clean_streak: 0
last_checked: "2026-08-20T21:30:00Z"
next_check: "2026-08-20T21:30:00Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-09-22T06:26:01Z"
next_check: "2026-09-22T07:26:01Z"
checked_by: "worsch"
---
# RISK-POL-0009 — commercial and tax retention
@ -31,9 +32,11 @@ made or the document created — not from the document's own date. That detail
is the one most often got wrong, and it always extends the period rather than
shortening it.
**The eight-year figure is recent and this repo has not verified it against the
current text.** Confirm before relying on it for a deletion decision; ten years
is the safe reading if nobody has.
**The eight-year figure was confirmed on 2026-09-22** (see `RISK-REG-0001`). It
comes from BEG IV, promulgated 2024-10-29, and has applied since 2025-01-01,
including to vouchers whose period had not run out by then. This rests on
secondary sources and the published §147 AO text, not on a qualified review.
Books and annual accounts stay at ten years.
## What it requires of systems
@ -64,3 +67,16 @@ retained period; a deletion routine that actually runs at expiry.
None of those exist yet. This policy is `active` in the sense that the duty
applies, not in the sense that it is demonstrably satisfied — and the register
says which.
**2026-09-22 review.** Some new evidence exists but it does not satisfy the
duty. Restores are now proven for `apps-pg` from the Scaleway primary and for
Forgejo from the Nextcloud secondary (RPF-WP-0029, RPF-WP-0038). Neither is a
restore from the oldest retained period, and neither lane holds books or
vouchers as a named record class. The secondary lane's 10 GiB quota holds about
two archives, which is far short of an eight-year horizon. There is still no
retention schedule and no expiry deletion routine, so the position above is
unchanged.
## Reviews
- **2026-09-22** — clean check: Position unchanged: duty applies, not demonstrably met; eight-year voucher period confirmed; new restore evidence (apps-pg, Forgejo) does not cover book/voucher classes or the oldest period. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

17
docs/regulatory/policies/RISK-POL-0011-accessibility.md
View file

@ -7,10 +7,11 @@ status: dormant
activates_when: "a consumer-facing digital service or product is offered in Germany — e-commerce, banking, e-books, ticketing, or a consumer app"
owner: risk-nexus
written: "2026-08-20"
cadence: instant
clean_streak: 0
last_checked: "2026-08-20T21:30:00Z"
next_check: "2026-08-20T21:30:00Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-09-22T06:26:29Z"
next_check: "2026-09-22T07:26:29Z"
checked_by: "worsch"
---
# RISK-POL-0011 — accessibility
@ -58,3 +59,11 @@ statement; automated and manual test results in the release path.
Nothing here binds any repo today. `whynot-design` and the consumer-domain
repos are where it will land, and naming the owner is theirs, not the
register's.
**2026-09-22 review.** The policy stays dormant. No consumer-facing digital
service offered in Germany is on record. The micro-enterprise exemption for
services is still the fragile basis described above.
## Reviews
- **2026-09-22** — clean check: Dormant: no consumer-facing service on record. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.

24
docs/regulatory/policies/RISK-POL-0012-e-invoicing.md
View file

@ -7,10 +7,11 @@ status: active
activates_when: "the estate is a German business receiving B2B invoices — already true"
owner: risk-nexus
written: "2026-08-20"
cadence: instant
clean_streak: 0
last_checked: "2026-08-20T21:30:00Z"
next_check: "2026-08-20T21:30:00Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-09-22T06:26:29Z"
next_check: "2026-09-22T07:26:29Z"
checked_by: "worsch"
---
# RISK-POL-0012 — e-invoicing
@ -53,3 +54,18 @@ structured form, retrievable at eight years.
Not established. If a supplier sends one tomorrow, nobody here can say what
happens to it — which is a small, ordinary, entirely fixable gap, and exactly
the kind that only becomes visible when it is written down.
**2026-09-22 review.** The position is unchanged. The receiving duty is live
and still has no named owner in the estate, five weeks after this record was
written. The issuing dates under §27(38) UStG are:
- **2027-01-01** for businesses with prior-year turnover above EUR 800,000;
- **2028-01-01** for everyone else.
A turnover below the threshold therefore leaves about fifteen months, not
three. This is from general knowledge of the Wachstumschancengesetz and has
not been re-read against the current text. Confirm it before planning to it.
## Reviews
- **2026-09-22** — clean check: Receiving duty live, still no named owner; issuing phase-in dates noted (2027/2028), to be confirmed. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.