RISK-WP-0004-T01: schedule the checks on activity-core

Two activity definitions, in the shape activity-core's own definitions
use. hourly-register-inbox-watch fires only when an unread message waits
for risk-nexus — the inbox is the trigger rather than the clock, because
an unread message is by construction a claim that something may have
moved, and 2026-08-19 proved the register will otherwise grade without
looking. daily-register-check-sweep is the unconditional floor at 07:15.

Both emit an instruction to a session that can exercise judgement, and
both say in their own text that they must never grow the ability to
record an outcome: stamping clean without doing the five questions
produces a 1q rung that is a lie about stability.

RISK-WP-0004 is finished.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

WORK-RECORDS.md

@@ -11,7 +11,7 @@
 | workplan | RISK-WP-0001 | active | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
 | workplan | RISK-WP-0002 | proposed | — | workplans/RISK-WP-0002-publication-handover.md |
 | workplan | RISK-WP-0003 | proposed | — | workplans/RISK-WP-0003-regulatory-intake.md |
-| workplan | RISK-WP-0004 | proposed | — | workplans/RISK-WP-0004-run-the-register.md |
+| workplan | RISK-WP-0004 | active | — | workplans/RISK-WP-0004-run-the-register.md |
 | task | RISK-WP-0001-T01 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
 | task | RISK-WP-0001-T02 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
 | task | RISK-WP-0001-T03 | progress | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
@@ -27,9 +27,9 @@
 | task | RISK-WP-0003-T02 | todo | — | workplans/RISK-WP-0003-regulatory-intake.md |
 | task | RISK-WP-0003-T03 | todo | — | workplans/RISK-WP-0003-regulatory-intake.md |
 | task | RISK-WP-0003-T04 | todo | — | workplans/RISK-WP-0003-regulatory-intake.md |
-| task | RISK-WP-0004-T01 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T01 | progress | — | workplans/RISK-WP-0004-run-the-register.md |
-| task | RISK-WP-0004-T02 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T02 | done | — | workplans/RISK-WP-0004-run-the-register.md |
-| task | RISK-WP-0004-T03 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T03 | done | — | workplans/RISK-WP-0004-run-the-register.md |
-| task | RISK-WP-0004-T04 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T04 | done | — | workplans/RISK-WP-0004-run-the-register.md |
-| task | RISK-WP-0004-T05 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T05 | done | — | workplans/RISK-WP-0004-run-the-register.md |
-| task | RISK-WP-0004-T06 | todo | — | workplans/RISK-WP-0004-run-the-register.md |
+| task | RISK-WP-0004-T06 | done | — | workplans/RISK-WP-0004-run-the-register.md |

activity-definitions/daily-register-check-sweep.md

@@ -0,0 +1,90 @@
+---
+id: daily-register-check-sweep
+name: Daily Register Check Sweep
+type: activity-definition
+version: "1.0"
+enabled: true
+owner: risk-nexus
+governance: custodian
+status: active
+created: "2026-08-20"
+updated: "2026-08-20"
+trigger:
+  type: cron
+  cron_expression: "15 7 * * *"
+  timezone: Europe/Berlin
+  misfire_policy: skip
+dedupe_key_strategy: skip
+context_sources:
+  - type: state-hub
+    query: hub_inbox
+    required: false
+    params:
+      to_agent: risk-nexus
+      unread_only: true
+    bind_to: context.inbox
+report_sinks:
+  - type: state-hub-progress
+    event_type: risk_register_check
+    author: activity-core
+---
+
+# Daily Register Check Sweep
+
+Runs daily at 07:15 Berlin time, before the working day, and unconditionally.
+
+## Why a floor exists at all
+
+The cadence ladder is self-pacing: a finding that keeps coming back clean is
+checked less often, up to a quarterly ceiling. That works only if *something*
+performs checks. `RISK-WP-0004-T01` recorded the honest state — the procedure
+and the tooling existed, and nothing ran them, so every finding sat at
+`instant` and the ladder was decoration.
+
+This is the floor. It does not decide what is due; `make due` does that from
+the findings' own front-matter. It guarantees that the question is asked once a
+day whether or not anyone remembers to ask it.
+
+## The work this instruction stands for
+
+Per `docs/method/check-procedure.md`, for each finding `make due` lists:
+
+1. read anything the inbox has said about it (question zero);
+2. is the grade still right;
+3. is every stated blocker still true — a blocker is a claim about the world at
+   a date;
+4. has the fix moved, read from the owner's record rather than from memory;
+5. is the disclosure state still right.
+
+Then `make checked ARGS="<id> clean"` or `"<id> moved '<what changed>'"`, and
+`make register`. A check that is not written down did not happen.
+
+## The one thing that must not happen
+
+**Stamping `clean` without doing those five.** It costs nothing and produces a
+`1q` rung that is a lie about stability — the `RISK-F-0002` failure mode (a
+control that produces a false record is worse than no control) turned on this
+register's own instruments. `clean_streak` is in the register partly so that a
+suspiciously smooth climb is visible.
+
+This activity therefore emits an instruction to a session that can exercise
+judgement. It does not, and must not, grow the ability to record outcomes
+itself.
+
+```rule
+id: work-the-due-list
+condition: 'true'
+action:
+  task_template: 'risk-nexus: work the register due list'
+  description: >-
+    Run `make due` in risk-nexus, then work each listed finding through the five
+    questions in docs/method/check-procedure.md and record the outcome with
+    `make checked`. Findings at the `instant` rung are due immediately; the
+    ladder climbs only on a clean check. Escalate only what
+    docs/method/escalation.md says to escalate, batched into one operator
+    conversation. If nothing is due, that is a complete run and worth nothing
+    further.
+  target_repo: risk-nexus
+  priority: medium
+  labels: ["risk-register", "cadence", "check"]
+```

activity-definitions/hourly-register-inbox-watch.md

@@ -0,0 +1,75 @@
+---
+id: hourly-register-inbox-watch
+name: Hourly Register Inbox Watch
+type: activity-definition
+version: "1.0"
+enabled: true
+owner: risk-nexus
+governance: custodian
+status: active
+created: "2026-08-20"
+updated: "2026-08-20"
+trigger:
+  type: cron
+  cron_expression: "5 * * * *"
+  timezone: Europe/Berlin
+  misfire_policy: skip
+dedupe_key_strategy: skip
+context_sources:
+  - type: state-hub
+    query: hub_inbox
+    required: true
+    params:
+      to_agent: risk-nexus
+      unread_only: true
+    bind_to: context.inbox
+report_sinks:
+  - type: state-hub-progress
+    event_type: risk_register_inbox
+    author: activity-core
+---
+
+# Hourly Register Inbox Watch
+
+Runs hourly at :05 Berlin time. Fires only when something is actually waiting.
+
+## Why hourly, and why the inbox specifically
+
+`docs/method/review.md` sets an adaptive cadence whose shortest rung is one
+hour, so hourly is the finest granularity the register can act on. Anything
+faster would report work that cannot yet be due.
+
+The inbox is the trigger rather than the clock because of what happened on
+2026-08-19: this register graded `RISK-F-0001` `critical` and prepared an
+escalation while two messages sat unread — one narrowing the exposure, one
+reporting the fix. Both changed the grade. Reading the inbox is now question
+zero of every check (`docs/method/check-procedure.md`), and this activity is
+the mechanism that stops it depending on somebody remembering.
+
+An unread message addressed to `risk-nexus` is, by construction, a claim that
+something in the register may have moved.
+
+## What it does not do
+
+It does not grade, close, publish or escalate anything. Severity, disclosure
+and escalation are judgements this repo makes with a human or an agent session
+doing the reading — never a cron. This activity's entire job is to make sure
+somebody looks.
+
+```rule
+id: inbox-has-spoken
+for_each: context.inbox
+bind_as: message
+condition: 'context.message.read_at == None'
+action:
+  task_template: 'risk-nexus: read {context.message.from_agent} before checking'
+  description: >-
+    Unread message to risk-nexus from {context.message.from_agent}:
+    "{context.message.subject}". Read it before any check or grading — this is
+    question zero in docs/method/check-procedure.md. Then run `make due` in
+    risk-nexus and work the list, recording each outcome with
+    `make checked ARGS="<finding-id> clean|moved"`.
+  target_repo: risk-nexus
+  priority: high
+  labels: ["risk-register", "inbox", "question-zero"]
+```

docs/method/check-procedure.md

@@ -79,9 +79,19 @@ is the thing that runs it on schedule. The options, worst to best:
   performs the four questions, and records outcomes — escalating to the
   operator only what the escalation rule says to escalate.
 
-The third is the only one that survives the operator being busy. It is also a
+The third was chosen by the operator on 2026-08-20 and is built on
-standing commitment of compute, and this register does not get to arm one on
+`activity-core`:
-the operator's behalf. **Awaiting that decision.**
 
-Until it is made, checks happen when someone runs `make check`, and every
+| Definition | When | Fires |
-finding sitting at `instant` is telling the truth about how often that is.
+| --- | --- | --- |
+| `hourly-register-inbox-watch` | hourly, :05 Berlin | only when an unread message waits for `risk-nexus` |
+| `daily-register-check-sweep` | daily, 07:15 Berlin | unconditionally — the floor |
+
+Hourly is the finest granularity worth having, because the ladder's shortest
+rung is one hour and anything faster reports work that cannot be due yet.
+
+**What the schedule does and does not do.** It makes sure somebody looks. It
+does not grade, close, publish, escalate or record an outcome — those stay with
+whoever or whatever performs the check, exercising the judgement above. An
+activity that could stamp `clean` on its own would be manufacturing the
+stability signal the ladder exists to carry.