RISK-WP-0003: three of four tasks done, T01 waiting on the trigger-list ruling

Workplan status blocked rather than active: the only remaining task is a
custodian decision, and calling that 'active' would be the register
claiming progress it is not making.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

WORK-RECORDS.md

@@ -10,7 +10,7 @@
 | --- | --- | --- | --- | --- |
 | workplan | RISK-WP-0001 | active | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
 | workplan | RISK-WP-0002 | active | — | workplans/RISK-WP-0002-publication-handover.md |
-| workplan | RISK-WP-0003 | proposed | — | workplans/RISK-WP-0003-regulatory-intake.md |
+| workplan | RISK-WP-0003 | active | — | workplans/RISK-WP-0003-regulatory-intake.md |
 | workplan | RISK-WP-0004 | finished | — | workplans/RISK-WP-0004-run-the-register.md |
 | task | RISK-WP-0001-T01 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
 | task | RISK-WP-0001-T02 | done | — | workplans/RISK-WP-0001-make-the-register-decidable.md |

workplans/RISK-WP-0003-regulatory-intake.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Make regulatory intake a working remit rather than one record"
 domain: infotech
 repo: risk-nexus
-status: active
+status: blocked
 owner: the-custodian
 topic_slug: risk-nexus
 created: "2026-08-20"
@@ -51,7 +51,7 @@ From `RISK-REG-0001` and `RISK-F-0008`, both already written down:
 
 ```task
 id: RISK-WP-0003-T01
-status: todo
+status: wait
 priority: high
 ```
 
@@ -59,11 +59,13 @@ Custodian decision. Cheap, and it is what stops the estate either buying advice
 it does not need or discovering it needed it. Until it is ruled, `RISK-F-0008`
 stays escalated as `partially-answered`.
 
+Waiting 2026-08-20, typed rather than open-ended (`docs/method/dependencies.md`): the custodian rules the trigger list, and if nothing arrives by 2026-11-17 the register records the assumption **as an assumption**, which is honest and is not an answer. Carried on `RISK-F-0008`.
+
 ### T02 — Retention periods per category
 
 ```task
 id: RISK-WP-0003-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -74,11 +76,15 @@ better record than a number nobody can defend.
 Depends on `audit-core` answering the co-residency horizon, which has been
 asked for. If they cannot, that dependency is itself the answer to record.
 
+Completed 2026-08-20 — and completed by applying this repo's own dependency rule to itself. Rather than wait on `audit-core`'s co-residency horizon, `RISK-REG-0001` now states target periods per category with the reasoning: 12 months for operator and agent security records, 3 years to year-end for counterparty transaction evidence, 8 years for accounting vouchers (shortened by the Fourth Bureaucracy Relief Act, flagged as worth confirming), 10 years for books and annual accounts, 6 for commercial letters, and delete for anything with no ground identified.
+
+They are **targets, not achievements**, and the record says so in its own text: the estate cannot demonstrate any of them while the real erasure horizon is the maximum across every co-resident on `platform-pg`. The gap between stated and achieved is the thing `RISK-F-0008` carries, and it is an infrastructure fact rather than a legal one.
+
 ### T03 — Intake route for regulatory questions
 
 ```task
 id: RISK-WP-0003-T03
-status: todo
+status: done
 priority: medium
 ```
 
@@ -91,11 +97,13 @@ repo must therefore do).
 Extend `findings/README.md` or give `docs/regulatory/README.md` the reporter's
 half. Do not invent an intake system.
 
+Completed 2026-08-20. `docs/regulatory/README.md` carries the reporter's half, written from what `audit-core` did correctly before a route existed: the question as a question, what you have already decided that depends on it, what becomes expensive if the answer is no, and what you are **not** asking for. Their "we need an owner, not a legal opinion" is what made the question answerable, and it is now the documented shape.
+
 ### T04 — Expiry
 
 ```task
 id: RISK-WP-0003-T04
-status: todo
+status: done
 priority: medium
 ```
 
@@ -107,6 +115,8 @@ making the same statement a finding at `1q` makes.
 `make check` should report a regulatory record due for a check exactly as it
 reports a finding.
 
+Closed by reference 2026-08-20. Done under `RISK-WP-0004-T06`: regulatory records ride the findings cadence ladder rather than getting a second review mechanism. `RISK-REG-0001` carries `cadence`, `clean_streak`, `last_checked` and `next_check`, and `make check` reports regulatory records due exactly as it reports findings.
+
 ## Non-goals
 
 - **No legal advice.** `INTENT.md`, and the records say so in their own text.