From 9a22a2adc5ebcfdf5b205cba7b7038a0e306fda2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 20 Aug 2026 23:17:31 +0200 Subject: [PATCH] RISK-WP-0003: three of four tasks done, T01 waiting on the trigger-list ruling Workplan status blocked rather than active: the only remaining task is a custodian decision, and calling that 'active' would be the register claiming progress it is not making. Co-Authored-By: Claude Opus 5 --- WORK-RECORDS.md | 2 +- workplans/RISK-WP-0003-regulatory-intake.md | 20 +++++++++++++++----- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 3b5c124..a310aac 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -10,7 +10,7 @@ | --- | --- | --- | --- | --- | | workplan | RISK-WP-0001 | active | — | workplans/RISK-WP-0001-make-the-register-decidable.md | | workplan | RISK-WP-0002 | active | — | workplans/RISK-WP-0002-publication-handover.md | -| workplan | RISK-WP-0003 | proposed | — | workplans/RISK-WP-0003-regulatory-intake.md | +| workplan | RISK-WP-0003 | active | — | workplans/RISK-WP-0003-regulatory-intake.md | | workplan | RISK-WP-0004 | finished | — | workplans/RISK-WP-0004-run-the-register.md | | task | RISK-WP-0001-T01 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T02 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md | diff --git a/workplans/RISK-WP-0003-regulatory-intake.md b/workplans/RISK-WP-0003-regulatory-intake.md index d191dc9..96cdd04 100644 --- a/workplans/RISK-WP-0003-regulatory-intake.md +++ b/workplans/RISK-WP-0003-regulatory-intake.md @@ -4,7 +4,7 @@ type: workplan title: "Make regulatory intake a working remit rather than one record" domain: infotech repo: risk-nexus -status: active +status: blocked owner: the-custodian topic_slug: risk-nexus created: "2026-08-20" @@ -51,7 +51,7 @@ From `RISK-REG-0001` and `RISK-F-0008`, both already written down: ```task id: RISK-WP-0003-T01 -status: todo +status: wait priority: high ``` @@ -59,11 +59,13 @@ Custodian decision. Cheap, and it is what stops the estate either buying advice it does not need or discovering it needed it. Until it is ruled, `RISK-F-0008` stays escalated as `partially-answered`. +Waiting 2026-08-20, typed rather than open-ended (`docs/method/dependencies.md`): the custodian rules the trigger list, and if nothing arrives by 2026-11-17 the register records the assumption **as an assumption**, which is honest and is not an answer. Carried on `RISK-F-0008`. + ### T02 — Retention periods per category ```task id: RISK-WP-0003-T02 -status: todo +status: done priority: high ``` @@ -74,11 +76,15 @@ better record than a number nobody can defend. Depends on `audit-core` answering the co-residency horizon, which has been asked for. If they cannot, that dependency is itself the answer to record. +Completed 2026-08-20 — and completed by applying this repo's own dependency rule to itself. Rather than wait on `audit-core`'s co-residency horizon, `RISK-REG-0001` now states target periods per category with the reasoning: 12 months for operator and agent security records, 3 years to year-end for counterparty transaction evidence, 8 years for accounting vouchers (shortened by the Fourth Bureaucracy Relief Act, flagged as worth confirming), 10 years for books and annual accounts, 6 for commercial letters, and delete for anything with no ground identified. + +They are **targets, not achievements**, and the record says so in its own text: the estate cannot demonstrate any of them while the real erasure horizon is the maximum across every co-resident on `platform-pg`. The gap between stated and achieved is the thing `RISK-F-0008` carries, and it is an infrastructure fact rather than a legal one. + ### T03 — Intake route for regulatory questions ```task id: RISK-WP-0003-T03 -status: todo +status: done priority: medium ``` @@ -91,11 +97,13 @@ repo must therefore do). Extend `findings/README.md` or give `docs/regulatory/README.md` the reporter's half. Do not invent an intake system. +Completed 2026-08-20. `docs/regulatory/README.md` carries the reporter's half, written from what `audit-core` did correctly before a route existed: the question as a question, what you have already decided that depends on it, what becomes expensive if the answer is no, and what you are **not** asking for. Their "we need an owner, not a legal opinion" is what made the question answerable, and it is now the documented shape. + ### T04 — Expiry ```task id: RISK-WP-0003-T04 -status: todo +status: done priority: medium ``` @@ -107,6 +115,8 @@ making the same statement a finding at `1q` makes. `make check` should report a regulatory record due for a check exactly as it reports a finding. +Closed by reference 2026-08-20. Done under `RISK-WP-0004-T06`: regulatory records ride the findings cadence ladder rather than getting a second review mechanism. `RISK-REG-0001` carries `cadence`, `clean_streak`, `last_checked` and `next_check`, and `make check` reports regulatory records due exactly as it reports findings. + ## Non-goals - **No legal advice.** `INTENT.md`, and the records say so in their own text.