coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0005 finished: the seven gaps closed

Browse source 
T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 08:34:30 +02:00
parent 449307bea2
commit a05ca6822b
14 changed files with 195 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

20
notes/RISK-N-0003-defects-found-by-reading-not-monitoring.md
View file

@ -32,3 +32,23 @@ anything nobody thought to look at.
It comes back the first time a finding arrives that monitoring plausibly should
have caught and did not. That is the evidence this note is missing, and until
then filing it would be the register asserting a conclusion it cannot support.
## Update — 2026-08-21: the denominator
`RISK-WP-0005-T07` built the smallest possible coverage report, and it puts a
number on what this note could previously only gesture at:
> **7 of 117 registered repos have ever appeared in a finding. 110 never have.**
That is not 110 clean repos and this note does not claim it is. It is 110 repos
about which the register knows nothing, and the estate's own evidence — two for
two on tenant boundaries, four defects in one review round — says that looking
tends to find something.
The note stays a note. There is still no owner for "the estate's ability to
notice its own defects", and nothing here is a defect to route. What changed is
that the gap now has a size, and `make coverage` prints it, which is the
difference between an argument and a measurement.
It comes back as a finding the first time something is found in one of the 110
that a reasonable sweep would have caught earlier.