coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0004-T05: establish what this register can verify, by trying it

Browse source 
Cluster reads work from this host; OpenBao returns 403, the same wall
ops-warden hit. So the register can check what the cluster admits and
cannot check what the secret store permits, and every grade touching an
OpenBao policy is a grade on a document. That asymmetry is recorded
rather than closed: a risk register holding production secret-store
access would have traded a verification problem for a worse one.

RISK-V-0001 is the first verification. It confirms RISK-F-0001's ingress
claim against the live cluster — the first grade here standing on
evidence this repo gathered — contradicts the 'egress: []' claim, which
live shows as 443/6443 to anywhere, and surfaces a third policy created
the day of the fix whose Ingress policyType carries no rules, which bears
on whether enabling ops-warden's gate would fail closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-20 08:46:06 +02:00
parent ff74a60af4
commit 97fcc56a4d
3 changed files with 185 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
workplans/RISK-WP-0004-run-the-register.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Run the register: make the cadence actually happen, and close the gaps the first week found"
domain: infotech
repo: risk-nexus
status: proposed
status: active
owner: the-custodian
topic_slug: risk-nexus
created: "2026-08-20"