Audit blocked work and reconcile owner dependency requirements

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-3b46-7cb0-883c-bbb4739ab936

REGISTER.md

@@ -1,6 +1,6 @@
 # Register
 
-Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-10-03.
+Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-10-04.
 
 6 live of 15 findings; 3 notes below the floor.
 

SCOPE.md

@@ -1,6 +1,6 @@
 # SCOPE — risk-nexus
 
-Updated 2026-10-03 (Europe/Berlin), including the cleanup under RISK-WP-0005 and RISK-WP-0007. This describes the checked-in capabilities;
+Updated 2026-10-04 (Europe/Berlin), including the dependency audit under RISK-WP-0005 and RISK-WP-0007. This describes the checked-in capabilities;
 [INTENT.md](INTENT.md) remains the intended remit. Evidence and remaining gaps
 are in the [dated assessment](history/2026-09-05-014333-scope-intent-assessment.md).
 
@@ -46,7 +46,8 @@ or independent scheduler, and does not itself serve `risk.coulomb.social`.
   are reported for repair. Deferrals require valid future dates.
 - Incident deadlines and production-transition events
   are procedural obligations without dedicated automated deadline/event handling.
-  The production-transition definition remains `proposed`.
+  The production-transition definition is `adopted`, reconciled from the
+  committed CUST-WP-0063-T04 owner decision; this does not declare a transition.
 - Historical verification records distinguish owner evidence, checkout evidence
   and live reads. They do not establish current infrastructure access or health.
 
@@ -57,13 +58,17 @@ three notes; one regulatory determination; four full policies out of thirteen
 catalogue entries; and three verification records. Qonto's source-only acceptance
 is now recorded with its founder decision and ending conditions, retaining the
 runtime closure path. The three Emergent findings remain open pending owner
-acceptance/provider evidence; their 0.2.3 local retest has explicit limits.
+acceptance/provider evidence; their historical 0.2.3 retest and current 0.2.6 Whitehat review have explicit limits.
+T07 accepts the bounded 0.2.6 review gate only and withholds full provider acceptance.
 Two findings are marked published, nine pending handover, and four have no
 completed handover recorded. No finding is currently embargoed. The audit
 retention acceptance and substantive regulatory reviews remain due. These are
 repository records, not fresh verification of affected systems or published sites.
 All seven workplans and 37 tasks are complete; remaining external/recurring
-obligations are reported without inventing new workplans.
+obligations are reported without inventing new workplans. The 2026-10-04
+dependency audit in RISK-WP-0007 names owner records, missing tracking and
+the evidence required for progress. The approved external contact route has
+a selected URI under CUST-IN-0011; provisioning/delivery remain unverified.
 
 ## Ownership boundary
 

STATE.md

@@ -1,6 +1,6 @@
 # STATE — risk-nexus
 
-**Updated:** 2026-10-03
+**Updated:** 2026-10-04
 **Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian
 
 ## Current posture
@@ -25,7 +25,7 @@ to `blocked`. No task or workplan was added for this cleanup.
 | RISK-WP-0002 | Initial publication and standing handover route | Later finding publication returns belong to policy-nexus |
 | RISK-WP-0003 | Regulatory intake and retained policy records | Substantive policy and activation reviews remain due |
 | RISK-WP-0004 | Review procedure, inbox checks and activity definitions | Live activity deployment/session completion remains unverified |
-| RISK-WP-0005 | Intake, remediation tracking and gap reporting | Production-transition adoption and external contact delivery remain outside this repo |
+| RISK-WP-0005 | Intake, remediation tracking and gap reporting | Transition definition adopted; external contact delivery remains unverified |
 | RISK-WP-0006 | Resilient reports and obligation visibility | Reporting does not complete the underlying reviews or handovers |
 | RISK-WP-0007 | Reconcile owner evidence and closure obligations | Deployed captures and provider/owner acceptance remain owner work |
 
@@ -47,7 +47,8 @@ A regression test also prevents reading a status from outside the target block.
 RISK-F-0013 (medium) and RISK-F-0014 (low) retain the historical 0.2.1
 binding/lifecycle defects and local 0.2.3 non-reproduction evidence; owner T07
 acceptance remains pending. RISK-F-0015 (low) records the two retained Claude
-owner-routing misses; current-release complete provider evidence remains pending.
+owner-routing misses; sealed 0.2.6 full-corpus route matches are recorded, but complete provider
+acceptance remains pending. The Whitehat observation is not T07 acceptance.
 
 ## Remaining register obligations
 
@@ -59,8 +60,9 @@ owner-routing misses; current-release complete provider evidence remains pending
   This cleanup supplies no new legal research or activation assurance.
 - Nine finding publication handovers remain pending. A disclosure grade is
   not publication. No new external message or publication was sent here.
-- Scheduled-session execution, external contact delivery and production-transition
-  adoption remain unverified; their definitions/routes are completed local work.
+- Scheduled-session execution and external contact delivery remain unverified.
+  CUST-WP-0063 records adoption of the production-transition definition and
+  approval of the bounded contact route; the local methods now reflect it.
 
 Completed implementation tasks stay finished while those recurring or external
 obligations remain on the register. Findings stay watched until concrete closure
@@ -72,3 +74,23 @@ or valid acceptance; owner workplan completion alone does not close them.
 `make check` checks index, register obligations and inbox; overdue work remains
 visible. `statehub fix-consistency` reconciles the seven workplans and pushes.
 Historical records retain the provenance of file evidence versus live reads.
+
+## Dependency audit — 2026-10-04
+
+Re-read all seven workplans and all 37 tasks in files and their matching Hub
+projections: finished/done throughout. No local blocked task or unfinished
+parent exists. Kept completed statuses and recorded owner-return requirements
+in [RISK-WP-0007](workplans/RISK-WP-0007-reconcile-owner-evidence.md).
+
+EMERGENT-WP-0002 remains blocked with T07 waiting: its owner accepted only
+the bounded Whitehat 0.2.6 review gate, withholding full provider acceptance.
+KG-WP-0005 remains blocked with T03 waiting for deployed-stream receipts.
+Qonto e-invoice owner tracking and audit-core technical refinements remain
+missing from the reviewed local owner workplans. Their existing defaults stand.
+CUST-IN-0011 names the selected security contact but still needs policy-nexus
+provisioning and monitored private delivery proof. No external message was sent.
+
+Implemented local reconciliation of the adopted transition and approved contact
+route from committed CUST-WP-0063-T04 (direct decision lookups returned 404),
+and rebuilt REGISTER.md. This is not a production declaration, full finding
+check or substantive policy review; existing due dates, grades and statuses stand.

docs/method/intake.md

@@ -49,7 +49,7 @@ the loss is occurring, while the record is being written.
   becoming aware. **`first_observed` is what starts that clock**, and this is
   the one place the register puts a hard deadline on itself. Escalation is
   immediate under trigger 1 or 2 — not batched, notwithstanding the batching
-  rule, because batching exists to protect the operator's attention and a
+  rule, because batching exists to protect the founder's attention and a
   72-hour clock outranks that.
 - **Severity is scored on what is happening, not what could.** The `L4`
   likelihood band — "already happening" — exists for exactly this and is
@@ -66,7 +66,7 @@ stopwatch.
 
 Someone outside the estate finding something and having somewhere to send it.
 
-**No such place exists.** There is no `security.txt` anywhere in the estate, no
+**At proposal time (2026-08-21), no such place was recorded.** There was no `security.txt` in the reviewed records, no
 published address, and no route from an outsider to this register. If someone
 found a flaw in a coulomb.social surface tomorrow, their options would be to
 guess an email address or say nothing.
@@ -86,6 +86,22 @@ approve. Routed on 2026-08-21 with a proposal:
 Until that exists, this register's claim to accept external reports is
 aspirational and `STATE.md` says so.
 
+### Owner disposition reconciled — 2026-10-04
+
+The custodian's committed `CUST-WP-0063-T04` records approval of the bounded
+RFC 9116 route on 2026-08-22, decision
+`051de446-7ae9-4eca-a766-14345655ab35`. The decision-API lookup returned
+404; this is an owner-file reconciliation. `the-custodian/intakes.md`
+records `CUST-IN-0011` as `routed`, owned by `policy-nexus`, with selected
+Contact URI `https://security.coulomb.social/` on 2026-08-23. Selection is
+complete; provisioning and monitored delivery are not established here.
+
+Required owner return: the production host grant, certificate/ingress,
+monitored private receipt mechanism and an end-to-end report-to-risk-nexus
+receipt, followed by the published `security.txt` location and expiry.
+The intake's 2026-08-23 DNS/TLS observation is historical, not a fresh probe.
+Risk-nexus does not provision the endpoint or publish an untested contact.
+
 ## What all four share
 
 The reporter says what is true and how they know. This register says how bad it

docs/method/production-transition.md

@@ -2,10 +2,12 @@
 id: RISK-METHOD-PRODUCTION
 type: method
 title: "The production transition: what expires, and who says when"
-status: proposed
+status: adopted
 owner: the-custodian
 drafted_by: risk-nexus
 drafted: "2026-08-21"
+adopted: "2026-08-22"
+decision: "937bf962-9297-40d5-a3e4-356532f179c7"
 workplan: RISK-WP-0005-T03
 review_interval: 6m
 ---
@@ -18,10 +20,15 @@ the event, named who declares it, or told the repos that carry the obligations.
 
 An acceptance that expires on an undefined event expires on nobody's calendar.
 
-**Status: `proposed`.** The definition is the custodian's; the plumbing is
-this repo's.
+**Status: `adopted`.** The custodian records adoption on 2026-08-22 in
+`the-custodian/workplans/CUST-WP-0063-inbox-governance-packets.md`, T04,
+decision `937bf962-9297-40d5-a3e4-356532f179c7`. Risk-nexus reconciled that
+owner record on 2026-10-04, at commit
+`01e7c7b4e46c360c60ed1cd9677cc4a455cbb332`. The State Hub decision lookup
+returned 404; adoption is attributed to the committed owner record, not a
+successful decision-API read. This does not declare that the transition occurred.
 
-## Proposed definition
+## Adopted definition
 
 > **The production transition is the first moment any system in the estate
 > holds, processes or decides about the data of a real external person or
@@ -44,7 +51,7 @@ usable:
 
 ## Who declares it
 
-The operator, through `the-custodian`. Not this register: `INTENT.md` keeps
+The founder, exercising `GOVERN @ estate`, through `the-custodian`. Not this register: `INTENT.md` keeps
 "deciding what canon says" and estate-level facts with the custodian, and a
 risk register that unilaterally declares the estate to be in production has
 appointed itself.

workplans/RISK-WP-0005-close-the-intent-gaps.md

@@ -8,7 +8,7 @@ status: finished
 owner: the-custodian
 topic_slug: risk-nexus
 created: "2026-08-21"
-updated: "2026-10-03"
+updated: "2026-10-04"
 depends_on_workplans:
   - RISK-WP-0001
   - RISK-WP-0004
@@ -106,7 +106,7 @@ Three pieces, and only the first is this repo's alone:
 **Non-goal:** a bug bounty, a disclosure programme, or any commitment to
 outside parties. The ask is a route, not a promise.
 
-Completed 2026-08-21. `docs/method/intake.md`. Incident intake: file first and grade within the hour, `first_observed` because obligations run from it rather than from the grade, `instant` cadence until it is over, and **escalation immediately rather than batched** — the batching rule protects the operator's attention and a 72-hour notification clock outranks that. `RISK-POL-0005` is wired to `first_observed`, which is what starts the clock. Severity gained a live-incident section: `L4` is what that band was always for.
+Completed 2026-08-21. `docs/method/intake.md`. Incident intake: file first and grade within the hour, `first_observed` because obligations run from it rather than from the grade, `instant` cadence until it is over, and **escalation immediately rather than batched** — the batching rule protects the founder's attention and a 72-hour notification clock outranks that. `RISK-POL-0005` is wired to `first_observed`, which is what starts the clock. Severity gained a live-incident section: `L4` is what that band was always for.
 
 External report: **no address exists anywhere in the estate** and creating one is not this repo's call. Routed to `the-custodian` and `policy-nexus` with a concrete proposal — RFC 9116 `security.txt` on the published surface, reports routed here, `reported_by: external` — and an explicit non-goal: a route in, not a bounty, a timeline or safe harbour.
 
@@ -176,7 +176,7 @@ the path that matters more.
 Needs: an acknowledgement state on the escalation (sent → seen → answered), and
 a re-raise once, per the adopted rule's "raised again once" clause. Not a
 weekly nag; the rule is explicit that repetition until someone answers is how
-the operator becomes the queue.
+the founder becomes the queue.
 
 Completed 2026-08-21. Escalation carries a delivery state — `sent → seen → answered` — with `escalation_sent` beside it, and `make check` reports how long each has gone unacknowledged. At seven days it says so and the escalation is raised **once** more, per the adopted rule, after which the default applies and is recorded. This is the fix the register applied to its own inbox on 2026-08-19 and had not applied to the path that matters more.
 
@@ -280,3 +280,15 @@ status cannot be borrowed from another block or prose. All 14 tests pass.
 No tasks were added or reopened. All seven local workplans and their Hub
 projections are finished; all 37 local tasks are done. External adoption,
 contact provisioning and recurring reviews remain the stated residuals.
+
+## Dependency reconciliation — 2026-10-04
+
+T02/T03 remain done. Read the custodian's committed CUST-WP-0063-T04:
+the production-transition definition and bounded external-report route were
+adopted on 2026-08-22. Reconciled the local method records rather than leaving
+adoption falsely pending. The owner record is at commit
+`01e7c7b4e46c360c60ed1cd9677cc4a455cbb332`; direct decision-API lookups
+returned 404, so provenance is the owner file. No production declaration was
+made. CUST-IN-0011 records the selected Contact URI and still requires
+policy-nexus provisioning and private delivery proof. Remaining evidence
+requirements are consolidated in RISK-WP-0007's 2026-10-04 audit.

workplans/RISK-WP-0007-reconcile-owner-evidence.md

@@ -8,7 +8,7 @@ status: finished
 owner: the-custodian
 topic_slug: custodian
 created: "2026-09-05"
-updated: "2026-10-03"
+updated: "2026-10-04"
 depends_on_workplans:
   - RISK-WP-0006
 state_hub_workstream_id: "ac12733f-3f4b-5c7b-aee7-7115b9c4db72"
@@ -123,3 +123,43 @@ or the next scheduled risk review after 2026-12-31, whichever occurs first.
 QONTO-WP-0005 is finished; KG-WP-0005 is blocked with T03 waiting. This is a
 checkout reconciliation, not live runtime acceptance. Updated STATE/SCOPE and
 reconciled inbox handling. No local blocked tasks remain; no new tasks/plans.
+
+## Blocked-work audit and dependency requirements — 2026-10-04
+
+All seven local workplans and their matching State Hub projections are finished;
+all 37 source tasks and matching Hub tasks are done. No unfinished local task
+needs a blocked status and no active parent needs moving to blocked. Completed
+implementation is retained; external acceptance and recurring reviews do not
+reopen it. Implemented the available local corrections: rebuild the dated index,
+reconcile transition/contact decisions under RISK-WP-0005 and update STATE/SCOPE.
+
+These are requirements on owner returns, not new risk-nexus tasks or authority
+to change other repositories. Findings retain grades, statuses, closure
+conditions and defaults. Source reads are not complete finding or legal reviews.
+
+| Obligation | Owner record and observed state | Required return / condition for progress |
+| --- | --- | --- |
+| RISK-F-0015 provider routes | emergent-security, EMERGENT-WP-0002-T07 `wait`, parent `blocked`; source commit `9f4530bb4394a3e748a782824510a67418da4fbe` | Explicit T07 acceptance of complete current-release provider evidence resolving both routes. Only the bounded Whitehat 0.2.6 review gate is accepted. Full acceptance still requires source reconciliation, exact Codex server-model evidence, route grading and continuity/governed-session evidence. The other eleven tokens per provider remain ungraded here. Retain the pin/seal; no re-pin or reseal by this register. |
+| RISK-F-0013 / RISK-F-0014 | emergent-security, T04 `done`, T07 `wait`, parent `blocked` | T07 acceptance of exact-digest remediation and review-independence limits, with supported release use recorded. Completed source remediation and bounded library passes do not supply acceptance. |
+| RISK-F-0011 deployed stream | kings-guard, KG-WP-0005-T03 `wait`, parent `blocked`; QONTO-WP-0005 finished | Runtime-owner capture of authorized qonto-assistant startup, allow/deny transition, heartbeat timing, contiguous sequence/instance evidence and same-instance reconciliation; King's Guard receiver read/mapping and acceptance. Preserve bounded source acceptance and its deployed-instance/after-2026-12-31 ending conditions. |
+| RISK-F-0012 receiving/custody | qonto-assistant; no matching e-invoice workplan found in local workplans | Owner task ID naming provider formats/original retrieval, existing receipts, estate custody and retention measures. Closure still requires one real EN 16931 invoice received through Qonto, its structured original archived unaltered under the existing voucher schedule and retrieved. Default 2026-10-06 remains; absent tracking does not soften the finding. |
+| RISK-F-0008 technical refinements | audit-core; no matching keyed-commitment/horizon task found in local workplans | Answer on keyed commitments preserving verification and erasability, plus evidenced platform-pg co-residency/recovery horizon. Default 2026-11-17 remains. Risk-nexus owns the due determination/acceptance-trigger review; technical input does not block all regulatory work. |
+| Nine pending handovers | policy-nexus; publication.json lists F-0001/F-0008 and five methods, not the nine pending finding IDs | Manifest entries and publication receipts identifying source revisions, canonical and immutable revision addresses for F-0002–F-0007 and F-0009–F-0011. Record published only on owner return. F-0012 handover still needs owner tracking; F-0013–F-0015 have no completed handover recorded. |
+| External report delivery | policy-nexus, CUST-IN-0011 `routed` in the-custodian/intakes.md | Selected https://security.coulomb.social/ contact needs host grant, certificate/ingress, monitored private receipt mechanism, end-to-end risk-nexus delivery receipt and security.txt publication/expiry. Selection and route approval are complete; delivery remains unverified. |
+| Scheduled register sessions | activity-core; two local definitions, no risk-specific completion proof found in reviewed owner workplans | Receipt for deployed definition versions/schedules, triggered instruction, session/run identity and completed review linked to outcome/progress evidence. A definition or instruction alone does not prove review completion. |
+
+Production-transition adoption is no longer unresolved: CUST-WP-0063-T04
+records the decision. Transition/acceptance-ending facts still require evidence
+and a register review. Four full policies and RISK-REG-0001 remain due; ordinary
+local review work is not marked blocked on another repo by this task audit.
+
+No external owner files, deployments, credentials, packets, new messages or
+finding grades/statuses were changed. No dependency acceptance is inferred
+from silence. The remaining owner implementation workplans already carry their
+blocked status; this repo has no corresponding unfinished implementation task.
+
+Validation: `make register` rebuilt the dated index; `make check` returned zero
+with the index current and outstanding obligations visible. The inbox report
+still flags evidence newer than finding check timestamps, including the already
+recorded Whitehat observation; an observation is not a completed check.
+`git diff --check` passes. No tool code changed, so no new tests were required.