coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

The inbox round: two grades corrected, one note promoted

Browse source 
Read the repo inbox after grading, which is the wrong order and is now
recorded as such. flex-auth had answered the NetworkPolicy question on
2026-08-18 (narrow ingress, not default-deny — L3 becomes L2, critical
becomes high) and reported RISK-F-0001 fixed at 12:35 today with live 401
probes. F-0001 closes fixed and public; its escalation is withdrawn
before it was ever sent. RISK-F-0002's ordering constraint lifts with it
and its trigger-6 escalation is withdrawn.

audit-core had routed the erasure-versus-audit legal question here on
2026-08-18 asking for an owner. RISK-N-0002 was wrong to call it a note:
the remedy is not retrofittable, so the decision can only be taken early.
Promoted to RISK-F-0008, owned by this repo as regulatory intake,
escalated on trigger 2.

Accepted rapp-postgres's record format and ops-warden's typed-act
escalation vocabulary. Reading the inbox is now question zero of every
review.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 23:38:07 +02:00
parent 37906c3a22
commit 7d6ded5743
10 changed files with 431 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/method/review.md
View file

@ -31,9 +31,15 @@ to let the date slide.
## What a review is
Four questions, answered in writing on the finding. It takes minutes; it is not
Five questions, answered in writing on the finding. It takes minutes; it is not
an investigation.
0. **Has the inbox said anything?** Read the messages addressed to this repo
before anything else. This is question zero because on 2026-08-19 the
register graded `RISK-F-0001` `critical` while two messages sat unread in
its own inbox — one narrowing the exposure, one reporting the fix. Both
changed the grade. A register that does not read its own inbox is guessing
with a straight face.
1. **Is the grade still right?** Re-read impact and likelihood against what has
changed. New facts move the grade in both directions.
2. **Is the blocker still true?** This is the one `RISK-F-0002` bought with