coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-WP-0005 finished: the seven gaps closed

Browse source 
T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 08:34:30 +02:00
parent 449307bea2
commit a05ca6822b
14 changed files with 195 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

32
tools/register_check.py
View file

@ -66,7 +66,7 @@ def main() -> int:
for ref in (f.get("related") or []):
if ref not in ids:
malformed.append(f"{fid} — related names {ref}, which does not exist")
if f.get("embargo_condition") and f.get("disclosure") != "embargoed":
if f.get("embargo_condition") and f.get("disclosure") != "embargoed": # a lift is recorded as embargo_lifted
malformed.append(f"{fid} — carries an embargo_condition but disclosure is '{f.get('disclosure')}'")
if f.get("disclosure") == "embargoed" and not f.get("embargo_condition"):
malformed.append(f"{fid} — embargoed with no condition; a hold with no lift is a silence")
@ -159,11 +159,20 @@ def main() -> int:
]
section("Embargoed", embargo, "none")
esc = [
f"{f['id']} — trigger {f.get('escalation_trigger')}, {f.get('escalation_status')}"
for f in fs
if f.get("escalation") == "required" and f.get("escalation_status") != "answered"
]
# T05 — an escalation nobody acknowledged is indistinguishable from one
# never sent, which is the failure this register fixed for its own inbox
# and not, until now, for the path that matters more.
esc = []
for f in fs:
if f.get("escalation") != "required" or f.get("escalation_status") == "answered":
continue
sent = lib.moment(f.get("escalation_sent"))
age = f", sent {(NOW - sent).days}d ago" if sent else ", never marked sent"
state = f.get("escalation_status", "unknown")
tail = " ← unacknowledged; raise once more, then record the default" if (
sent and (NOW - sent).days >= 7 and state not in ("seen", "answered")
) else ""
esc.append(f"{f['id']} — trigger {f.get('escalation_trigger')}, {state}{age}{tail}")
section("Escalations awaiting the operator", esc, "none")
rescore = [
@ -182,6 +191,17 @@ def main() -> int:
reg.append(f"{r.get('id')} — due {when:%Y-%m-%d}: {str(r.get('title','')).strip()}")
section("Regulatory records due", reg, "none")
# T06 — a 1q rung means "stable for a quarter" and "nobody looked for a
# quarter", and those read identically. The heartbeat separates them.
checks = [m for f in lib.findings() if (m := lib.moment(f.get("last_checked")))]
if checks:
newest = max(checks)
quiet = (NOW - newest).days
if quiet >= 2:
lines.insert(0, "")
lines.insert(0, f" Nothing anywhere in the register has been checked for {quiet} days.")
lines.insert(0, "HEARTBEAT — THE LADDER IS NOT BEING CLIMBED:")
print(f"Register check — {NOW:%Y-%m-%d %H:%MZ}\n{len(fs)} live finding(s)\n")
print("\n".join(lines).rstrip())
return 0