coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0005 finished: the seven gaps closed

Browse source 
T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 08:34:30 +02:00
parent 449307bea2
commit a05ca6822b
14 changed files with 195 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

6
findings/RISK-F-0001-flex-auth-unauthenticated-check.md
View file

@ -27,9 +27,9 @@ publication_subtitle: "The estate's authorization oracle authenticated no caller
revision: "graded-1"
last_reviewed: "2026-08-20"
review_interval: 6m
embargo_condition: "met 2026-08-19 — FLEX-WP-0015 finished, live probes return 401"
embargo_since: "2026-08-19"
embargo_review: "2026-08-19"
embargo_lifted: "2026-08-19 — FLEX-WP-0015 finished, live probes return 401"
embargo_was_since: "2026-08-19"
escalation: withdrawn
escalation_trigger: 1
escalation_status: withdrawn-before-sending

10
findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
View file

@ -24,12 +24,13 @@ embargo_condition: "RISK-F-0009 resolved — the OpenBao deny set covers every h
embargo_since: "2026-08-19"
embargo_review: "2026-09-18"
escalation: none
last_checked: "2026-08-20T10:02:42Z"
next_check: "2026-08-20T11:02:42Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-08-21T06:32:10Z"
next_check: "2026-08-21T14:32:10Z"
cadence: 8h
clean_streak: 2
graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19
checked_by: "worsch"
---
# RISK-F-0003 — the agent read-boundary has a fourteen-lane blind spot
@ -226,3 +227,4 @@ finding's own fix has landed.
`ops-warden`'s report and this register has not probed it. Their operator token
is expired, which is also why `RISK-F-0009` rests on a file comparison.
- **2026-08-20** — clean check: checked against the inbox and the owner's record; nothing moved. Cadence instant → 1h (1 clean in a row); next check 2026-08-20 11:02Z.
- **2026-08-21** — clean check: fix state read from the owner's file: WARDEN-WP-0032-T05 done; nothing else moved. Cadence 1h → 8h (2 clean in a row); next check 2026-08-21 14:32Z.

6
findings/RISK-F-0005-audit-core-unfiltered-read-path.md
View file

@ -22,9 +22,9 @@ fidelity_modifier: false
production_rescore: true
disclosure: public
publication: pending-handover
embargo_condition: "met 2026-08-18 — AUDIT-WP-0008-T04 reads done in audit-core's workplan"
embargo_since: "2026-08-19"
embargo_review: "2026-11-17"
embargo_lifted: "2026-08-18 — AUDIT-WP-0008-T04 reads done in audit-core's workplan"
embargo_was_since: "2026-08-19"
escalation: none
last_checked: "2026-08-21T06:29:38Z"
next_check: "2026-08-21T06:29:38Z"