RISK-WP-0005 finished: the seven gaps closed

T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/RISK-WP-0005-close-the-intent-gaps.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Close the gaps between what INTENT claims and what the register can actually do"
 domain: infotech
 repo: risk-nexus
-status: active
+status: finished
 owner: the-custodian
 topic_slug: risk-nexus
 created: "2026-08-21"
@@ -45,7 +45,7 @@ plainly at the top:
 
 ```task
 id: RISK-WP-0005-T01
-status: todo
+status: done
 priority: high
 ```
 
@@ -69,11 +69,17 @@ whether or not the register has been checking.
 Where `fix_tracking` is `unset` (`RISK-F-0004`, `RISK-F-0006`, `RISK-F-0009`),
 that absence is itself the report.
 
+Completed 2026-08-21. `tools/fix_tracker.py`, behind `make fixes` and inside `make check`. Resolves `fix_tracking` against the owning repo's workplan **file** — task-level ids do not exist in the hub, and the file is the ADR-001 source of truth anyway — and uses the file's last commit date as the honest answer to "has this moved", independent of whether the register looked. Archived workplans are searched too, so a finished-and-filed fix does not read as missing.
+
+**The first run found two things the register should have known.** `RISK-F-0005`: `AUDIT-WP-0008-T04` had read `done` since 2026-08-18 — the fix landed and this repo spent three days not knowing. Now `mitigated`, embargo lifted, `public`. `RISK-F-0002`: both tracked records were closed *before the finding was filed* — `WARDEN-WP-0007` archived 2026-07-08, `FLEX-WP-0007` finished 2026-06-29, against a finding of 2026-08-18 naming `FLEX-WP-0007` as its blocker. Routed as a question to both owners rather than a conclusion.
+
+Four findings carry no fix tracking at all, which the report now says out loud instead of leaving an empty field.
+
 ### T02 — An intake path for incidents and external reports
 
 ```task
 id: RISK-WP-0005-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -97,11 +103,15 @@ Three pieces, and only the first is this repo's alone:
 **Non-goal:** a bug bounty, a disclosure programme, or any commitment to
 outside parties. The ask is a route, not a promise.
 
+Completed 2026-08-21. `docs/method/intake.md`. Incident intake: file first and grade within the hour, `first_observed` because obligations run from it rather than from the grade, `instant` cadence until it is over, and **escalation immediately rather than batched** — the batching rule protects the operator's attention and a 72-hour notification clock outranks that. `RISK-POL-0005` is wired to `first_observed`, which is what starts the clock. Severity gained a live-incident section: `L4` is what that band was always for.
+
+External report: **no address exists anywhere in the estate** and creating one is not this repo's call. Routed to `the-custodian` and `policy-nexus` with a concrete proposal — RFC 9116 `security.txt` on the published surface, reports routed here, `reported_by: external` — and an explicit non-goal: a route in, not a bounty, a timeline or safe harbour.
+
 ### T03 — Define the production transition
 
 ```task
 id: RISK-WP-0005-T03
-status: todo
+status: done
 priority: high
 ```
 
@@ -118,11 +128,15 @@ tell the repos that carry re-score obligations.
 
 Custodian decision on the definition; the plumbing is ours.
 
+Completed 2026-08-21 as a proposal; the definition is the custodian's. `docs/method/production-transition.md` defines it by **what is held rather than what was announced**: the first moment any system holds, processes or decides about real external data. Which means it can happen by accident — one real signup, one migrated contact list — and cannot be reversed by deleting the data afterwards.
+
+Declared by the custodian, never by this register: a risk register that unilaterally declares the estate to be in production has appointed itself. What the register does is notice and ask. Five re-scores, two acceptances ending and six dormant policies activating are listed as what fires on the day.
+
 ### T04 — Stop claiming a surface we do not have
 
 ```task
 id: RISK-WP-0005-T04
-status: todo
+status: done
 priority: medium
 ```
 
@@ -137,11 +151,13 @@ the wording rather than editing it.
 Small, and exactly the class of claim this register grades other repos down
 for: a stated control that is not there.
 
+Completed 2026-08-21. `README.md` now says the repo serves nothing yet and that publication runs through `policy-nexus`, with three documents waiting for an address. `INTENT.md` is the constitutional document and its amendment is the custodian's — the wording is proposed to them rather than edited here.
+
 ### T05 — Give escalation a delivery guarantee
 
 ```task
 id: RISK-WP-0005-T05
-status: todo
+status: done
 priority: medium
 ```
 
@@ -156,11 +172,13 @@ a re-raise once, per the adopted rule's "raised again once" clause. Not a
 weekly nag; the rule is explicit that repetition until someone answers is how
 the operator becomes the queue.
 
+Completed 2026-08-21. Escalation carries a delivery state — `sent → seen → answered` — with `escalation_sent` beside it, and `make check` reports how long each has gone unacknowledged. At seven days it says so and the escalation is raised **once** more, per the adopted rule, after which the default applies and is recorded. This is the fix the register applied to its own inbox on 2026-08-19 and had not applied to the path that matters more.
+
 ### T06 — Make a lie about stability impossible to miss
 
 ```task
 id: RISK-WP-0005-T06
-status: todo
+status: done
 priority: medium
 ```
 
@@ -177,11 +195,13 @@ Two cheap defences:
   register for longer than the shortest rung by some margin, `make check` says
   so first, before anything else.
 
+Completed 2026-08-21. Two defences against the rung lying: `checked_by` recorded on every check (`RISK_CHECKED_BY`, so an agent names itself rather than inheriting a unix login), and a **heartbeat** that prints before anything else in `make check` when nothing anywhere in the register has been checked for two days. A `1q` rung means "stable for a quarter" and "nobody looked for a quarter", and the heartbeat is what separates them.
+
 ### T07 — A coverage model
 
 ```task
 id: RISK-WP-0005-T07
-status: todo
+status: done
 priority: low
 ```
 
@@ -200,6 +220,10 @@ a maturity model, and not this repo assessing anyone.
 **If this task grows past a page it becomes its own workplan.** Coverage is a
 different problem from triage and should not quietly absorb this one.
 
+Completed 2026-08-21, minimal and within its escape clause. `tools/coverage.py`, behind `make coverage`, counts what the register has heard from. First run: **7 of 117 registered repos have ever appeared in a finding; 110 never have.**
+
+That is not 110 clean repos and the report says so — it is 110 repos the register knows nothing about, against an estate whose own evidence is that looking tends to find something. Recorded as an update to `RISK-N-0003` rather than promoted: there is still no owner for estate-wide detection and still no defect to route. What changed is that the gap has a size, which is the difference between an argument and a measurement.
+
 ## Non-goals
 
 - **No monitoring.** `RISK-N-0003` stands as a note. A register that grows