coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sweep risk inbox and reconcile findings

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 02:41:32 +02:00
parent d65aaf7484
commit 7f1424dbcf
12 changed files with 363 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

43
findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
View file

@ -2,7 +2,8 @@
id: RISK-F-0003
type: finding
title: "ops-warden agent read-boundary does not fire on ungraded catalog lanes"
status: mitigated
status: fixed
owner: risk-nexus
reported_by: ops-warden
reported_via: ops-warden
routed_by: ops-warden
@ -10,7 +11,7 @@ date_reported: "2026-08-19"
system: ops-warden
environment: production
fix_owner: ops-warden
fix_tracking: WARDEN-WP-0032-T05 (done) / T06 (structural)
fix_tracking: WARDEN-WP-0032-T05 / T06 (done 2026-08-22)
# Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md
severity: medium
severity_at_production: medium
@ -19,18 +20,25 @@ impact: I4
likelihood: L2
fidelity_modifier: false
production_rescore: false
disclosure: embargoed
embargo_condition: "RISK-F-0009 resolved — the OpenBao deny set covers every high-risk lane with a KV path"
embargo_since: "2026-08-19"
embargo_review: "2026-09-18"
disclosure: public
publication: pending-handover
publication_id: risk-f-0003-ops-warden-agent-read-boundary-blind-spot
publication_path: "findings/ops-warden-agent-read-boundary-blind-spot/v1/index.html"
publication_subtitle: "An omitted catalog grade silently bypassed the agent credential boundary; omission now fails safe and CI rejects it."
revision: "fixed-1"
last_reviewed: "2026-09-01"
review_interval: 6m
embargo_lifted: "2026-08-22 — catalog omission fails safe, CI requires explicit grades, and RISK-F-0009's direct-OpenBao layer is fixed"
embargo_was_since: "2026-08-19"
escalation: none
last_checked: "2026-08-21T06:32:10Z"
next_check: "2026-08-21T14:32:10Z"
cadence: 8h
clean_streak: 2
date_fixed: "2026-08-22"
last_checked: "2026-09-01T00:32:44Z"
next_check: "2026-09-01T00:32:44Z"
cadence: instant
clean_streak: 0
graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19
checked_by: "worsch"
checked_by: "codex/risk-nexus"
---
# RISK-F-0003 — the agent read-boundary has a fourteen-lane blind spot
@ -228,3 +236,16 @@ finding's own fix has landed.
is expired, which is also why `RISK-F-0009` rests on a file comparison.
- **2026-08-20** — clean check: checked against the inbox and the owner's record; nothing moved. Cadence instant → 1h (1 clean in a row); next check 2026-08-20 11:02Z.
- **2026-08-21** — clean check: fix state read from the owner's file: WARDEN-WP-0032-T05 done; nothing else moved. Cadence 1h → 8h (2 clean in a row); next check 2026-08-21 14:32Z.
## Closure — 2026-09-01: omission is no longer permissive
The remaining structural task is done. `RouteEntry` now resolves an absent or
unknown grade fail-safe, `is_graded` exposes the distinction, and CI rejects a
catalog lane without an explicit grade. The current focused Warden regression
set passes (**137 tests**), including the omission and OpenBao coverage checks.
The dependent direct-OpenBao gap is also fixed under `RISK-F-0009`. There is no
remaining live or structural part of this finding, so it moves from `mitigated`
to `fixed` and its embargo lifts.
- **2026-09-01** — not clean: WARDEN-WP-0032-T06 and the dependent OpenBao coverage are complete; status fixed and embargo lifted. Cadence 8h → instant; checked again immediately.