risk: complete Policy Nexus publication handover

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

findings/RISK-F-0001-flex-auth-unauthenticated-check.md

@@ -3,6 +3,7 @@ id: RISK-F-0001
 type: finding
 title: "flex-auth /v1/check authenticates no caller"
 status: fixed
+owner: risk-nexus
 reported_by: flex-auth
 reported_via: rapp-postgres
 routed_by: rapp-postgres
@@ -20,11 +21,13 @@ likelihood: L2
 fidelity_modifier: false
 production_rescore: false
 disclosure: public
-publication: requested
+publication: published
 publication_id: risk-f-0001-flex-auth-unauthenticated-check
 publication_path: "findings/flex-auth-unauthenticated-check/v1/index.html"
+publication_url: "https://policy.coulomb.social/findings/flex-auth-unauthenticated-check/v1/"
+published_on: "2026-09-01"
 publication_subtitle: "The estate's authorization oracle authenticated no caller for as long as the endpoint existed. Found by reading, not by monitoring; fixed in two days."
-revision: "graded-1"
+revision: "published-1"
 last_reviewed: "2026-08-20"
 review_interval: 6m
 embargo_lifted: "2026-08-19 — FLEX-WP-0015 finished, live probes return 401"
@@ -38,13 +41,6 @@ last_checked: "2026-08-20T20:44:46Z"
 next_check: "2026-08-20T20:44:46Z"
 cadence: instant
 clean_streak: 0
-waiting_on:
-  - who: policy-nexus
-    what: "publication.json entries for RISK-F-0001, RISK-F-0008 and the five public method documents"
-    since: "2026-08-20"
-    would_change: "publication: published plus the permanent URL comes back onto each record"
-    default: "the findings stay disclosure: public with no address, which the register records as a claim rather than a publication"
-    default_at: "2026-09-17"
 graded_by: risk-nexus
 ruling: RISK-RULING-2026-08-19
 ---

findings/RISK-F-0008-audit-retention-legal-basis-assumed.md

@@ -3,6 +3,7 @@ id: RISK-F-0008
 type: finding
 title: "The legal basis for retaining audit facts against an erasure request has been assumed, never established"
 status: accepted
+owner: risk-nexus
 reported_by: audit-core
 reported_via: audit-core
 routed_by: audit-core
@@ -22,11 +23,13 @@ likelihood: L2
 fidelity_modifier: false
 production_rescore: true
 disclosure: public
-publication: requested
+publication: published
 publication_id: risk-f-0008-audit-retention-legal-basis
 publication_path: "findings/audit-retention-legal-basis/v1/index.html"
+publication_url: "https://policy.coulomb.social/findings/audit-retention-legal-basis/v1/"
+published_on: "2026-09-01"
 publication_subtitle: "The estate retains personal data in audit records on grounds nobody had actually established. Published as a question, because it is one."
-revision: "graded-1"
+revision: "published-1"
 last_reviewed: "2026-08-20"
 review_interval: 6m
 escalation: answered