coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0002-T03: the standing handover route

Browse source 
Written now rather than at the first lift, because publication arrives in
a trickle and a route improvised each time is one that eventually is not
taken. Also settles a T01 input: policy-nexus publishes a file from the
source repo, so whole-versus-summary is a question about what a finding
file contains, not about rendering.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 22:41:18 +02:00
parent d5147bfaea
commit 7dc8d01a63
2 changed files with 31 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/method/disclosure.md
View file

@ -114,3 +114,28 @@ is not recoverable.
A `public` finding is handed to `policy-nexus` under its publication contract
and gets a permanent address there. This repo never serves it and never
edits it after handover; corrections go through the same route as the original.
## The standing route, when an embargo lifts
`RISK-WP-0002-T03`. Written down because publication will arrive in a trickle
as conditions clear, not as a batch, and a route improvised each time is a
route that eventually is not taken.
1. **The check that lifts the embargo records it.** `make checked` on the
finding, with the lift as the reason. An embargo lifting is never a clean
check — something moved.
2. **The finding gets publication front-matter**, in the shape `policy-nexus`
already requires of everyone: `owner`, `revision`, `last_reviewed`,
`review_interval`. No body rewrite.
3. **This repo asks `policy-nexus` for an entry**, giving `source_repo`,
`source_path`, a proposed `canonical_path` under `findings/<id>/<version>/`,
and a one-line subtitle. Addressing and permanence are theirs
(`POLICY-NEXUS-WP-0001`); this repo does not invent a scheme.
4. **`publication: published` is recorded back on the finding**, with the URL.
A finding that says `public` but has no address is a claim, not a
publication — the same class of error as a backup nobody has restored from.
The contract publishes **a file from the owning repo**, so what is handed over
is exactly what a reader gets. That makes the whole-versus-summary decision
(T01) a decision about what a finding *file* contains, not about how it is
rendered.