Sweep risk inbox and reconcile findings

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

findings/RISK-F-0010-embedded-backup-webdav-credential.md

@@ -3,13 +3,42 @@ id: RISK-F-0010
 type: finding
 title: "Forgejo backup source embeds a WebDAV credential default"
 status: open
+owner: risk-nexus
 reported_by: railiance-platform
 reported_via: railiance-platform
+routed_by: risk-nexus
 date_reported: "2026-08-23"
+date_filed: "2026-08-23"
 system: railiance-platform
 environment: production
 fix_owner: railiance-platform
 fix_tracking: unset
+# Graded by risk-nexus 2026-09-01 — docs/rulings/2026-09-01-inbox-sweep.md
+severity: low
+severity_at_production: low
+impact: I2
+likelihood: L2
+fidelity_modifier: false
+production_rescore: false
+disclosure: embargoed
+embargo_condition: "the provider credential is revoked or invalidated and the literal source default is removed"
+embargo_since: "2026-09-01"
+embargo_review: "2026-09-15"
+escalation: none
+last_checked: "2026-09-01T00:32:44Z"
+next_check: "2026-09-01T00:32:44Z"
+cadence: instant
+clean_streak: 0
+waiting_on:
+  - who: railiance-platform
+    what: "revoke or invalidate the provider credential, remove the source default, name fix tracking, and demonstrate governed ciphertext upload plus restore"
+    since: "2026-09-01"
+    would_change: "the finding becomes fixed and the embargo lifts"
+    default: "the low grade and embargo stand; missing fix tracking is recorded as a stalled remediation"
+    default_at: "2026-09-15"
+graded_by: risk-nexus
+ruling: RISK-RULING-2026-09-01-A
+checked_by: "codex/risk-nexus"
 ---
 
 # RISK-F-0010 — Forgejo backup source embeds a WebDAV credential default
@@ -58,3 +87,37 @@ Suggestion, owned by `railiance-platform`:
 
 Risk Nexus owns severity, disclosure, escalation, and review cadence. This
 report intentionally does not assign them.
+
+## Register ruling — 2026-09-01
+
+`low` (`I2` × `L2`), embargoed, no escalation.
+
+**`I2`: limited to one backup lane on the facts established.** If the embedded
+value remains valid, it can authorize an ungoverned write or storage injection
+at the Nextcloud file-drop endpoint. Metadata listing and reads were denied,
+backup content is ciphertext, and the age recovery private key is separate.
+Nothing here establishes disclosure of an existing backup or estate-wide
+credential reach.
+
+**`L2`: recoverable through access the estate does grant.** The value is in Git
+history and appeared in captured agent output, so a repository clone or retained
+log is a sufficient foothold. Current validity is unknown and is not tested by
+this register; unknown is not treated as either live or revoked.
+
+**Embargoed.** While the source default remains and validity is unresolved,
+publishing that a recoverable provider credential exists materially shortens the
+path beyond reading the private repository. The hold lifts only when revocation
+or invalidation and removal of the literal are both observable. The credential
+value, fingerprint, and shape remain excluded from every record and message.
+
+**No escalation.** There is no evidence of a read, loss, real-person data
+exposure, legal notification duty, new spend, ownership dispute, or a stalled
+remediation yet. Railiance Platform owns both the source and provider action.
+Silence defaults on 2026-09-15 to the existing grade and a recorded stall; it
+does not soften the assessment.
+
+Reasoning: `docs/rulings/2026-09-01-inbox-sweep.md`.
+
+## Reviews
+
+- **2026-09-01** — graded from the filed report and a redacted current-source check. The literal default remains; no fix record was found. Cadence starts at instant.