Draft RISK-WP-0002, RISK-WP-0003, RISK-WP-0004

Publication handover (two findings ready, three tasks, one of which is a
paragraph); regulatory intake as a working remit rather than one record,
carrying RISK-REG-0001's open items; and running the register, where
every task traces to something that actually went wrong in week one —
grading before reading the inbox, a status the tooling did not know, an
id collision, two gradings resting on file comparison because a token
expired, and an on-request path nobody has walked.

All three are status: proposed. The custodian decides which become active
and in what order.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/RISK-WP-0002-publication-handover.md

@@ -0,0 +1,110 @@
+---
+id: RISK-WP-0002
+type: workplan
+title: "Hand the publishable findings to policy-nexus, and decide what else is a public document"
+domain: infotech
+repo: risk-nexus
+status: proposed
+owner: the-custodian
+topic_slug: risk-nexus
+created: "2026-08-20"
+updated: "2026-08-20"
+depends_on_workplans:
+  - RISK-WP-0001
+---
+
+# RISK-WP-0002 — publication handover
+
+**Draft.** Sized deliberately small: two documents are ready and the rest is a
+decision, not a project.
+
+## Goal
+
+`RISK-F-0001` and `RISK-F-0008` carry `disclosure: public` and
+`publication: pending-handover`. Get them onto `policy.coulomb.social` under
+`policy-nexus`'s existing contract, and settle whether this repo's method
+documents are public too.
+
+Done means: both findings have a permanent address, `publication: published`,
+and a recorded answer on the method documents.
+
+## Why now
+
+Six findings are embargoed with lift conditions, and `RISK-F-0009` has already
+demonstrated that a condition can be met and the embargo still hold. When those
+conditions start clearing, publication will happen in a trickle rather than a
+batch — so the route wants to exist before it is needed, not during.
+
+`policy-nexus` has been told this is coming (2026-08-20) and asked for nothing.
+
+## Tasks
+
+### T01 — Publish the two ready findings
+
+```task
+id: RISK-WP-0002-T01
+status: todo
+priority: high
+```
+
+Follow `policy-nexus`'s publication contract as it stands. Do not invent an
+address scheme: `POLICY-NEXUS-WP-0001` settled addressing and permanence, and
+this repo is a consumer of that decision.
+
+Open question for T01 rather than an assumption: **is a finding published whole,
+or as a summary?** `RISK-F-0001` contains a full ruling, a re-grade, a review
+log and this register's own process defect. Some of that is register-internal
+work product. Decide once, here, and apply it to every later publication.
+
+### T02 — Rule on the method documents
+
+```task
+id: RISK-WP-0002-T02
+status: todo
+priority: medium
+```
+
+`docs/method/severity.md`, `disclosure.md`, `escalation.md`, `review.md`.
+
+The case for publishing: they say how the estate grades and holds risk, which
+is exactly what an outside reader needs to judge whether a published finding
+means anything.
+
+The case against: the escalation rule names the operator's own thresholds, and
+the severity scale is a judgement instrument this repo revises freely. A
+published instrument invites argument about the instrument.
+
+Suggested split, to be ruled on rather than assumed: severity and disclosure
+public, escalation and review internal. Escalation in particular describes when
+the operator is interrupted, which is not the estate's business to advertise.
+
+### T03 — The standing route
+
+```task
+id: RISK-WP-0002-T03
+status: todo
+priority: medium
+```
+
+Write down what happens when an embargo lifts: who hands over, in what shape,
+and how `publication: published` gets recorded back on the finding.
+
+Small. It is a paragraph in `docs/method/disclosure.md` plus whatever
+`policy-nexus` needs on their side, not a mechanism.
+
+## Non-goals
+
+- No publication surface here. `policy-nexus` hosts; this repo hands over.
+- No timed release, no coordinated disclosure, no notification tiers. Those stay
+  deferred (`docs/method/disclosure.md`) until there are real users.
+- No re-grading of anything to make it publishable.
+
+## Risks
+
+**A finding is published with an internal ruling attached.** Mitigation: T01
+decides whole-versus-summary before anything ships.
+
+**The handover becomes a project.** Mitigation: three tasks, one of which is a
+paragraph. If it grows, that is a signal the publication contract does not fit
+findings, and that is a conversation with `policy-nexus` rather than more tasks
+here.