From aa0a85b8930dbdbfd50ba17b1007e1e3e8460d39 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 22 Sep 2026 08:13:56 +0200 Subject: [PATCH] Apply due defaults: escalate RISK-F-0011 stall, settle C-31 as noise RISK-F-0011: KG-WP-0005-T03 still waits on a deployed capture; medium grade stands, stall recorded, escalated to the-custodian under trigger 5. RISK-WP-0001: C-31 documented as expected noise. RISK-F-0008 acceptance review recorded clean. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 6903@bnt-lap001 Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89 --- REGISTER.md | 5 ++- STATE.md | 2 +- ...008-audit-retention-legal-basis-assumed.md | 11 ++++--- ...11-qonto-audit-deny-stream-completeness.md | 31 ++++++++++++------- ...ISK-WP-0001-make-the-register-decidable.md | 9 +----- 5 files changed, 30 insertions(+), 28 deletions(-) diff --git a/REGISTER.md b/REGISTER.md index f086667..4fca084 100644 --- a/REGISTER.md +++ b/REGISTER.md @@ -8,10 +8,10 @@ Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. La | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | -| [RISK-F-0011](findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md) | qonto-assistant audit.deny stream completeness is not established | qonto-assistant | medium | public | none | qonto-assistant | open | instant (0) | **due** | +| [RISK-F-0011](findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md) | qonto-assistant audit.deny stream completeness is not established | qonto-assistant | medium | public | **pending** (t5, sent) | qonto-assistant | open | instant (0) | **due** | | [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | low | public | none | railiance-platform | fixed | 1h (1) | 2026-09-22 07:01Z | | [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | public | none | railiance-platform | fixed | instant (0) | **due** | -| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 1h (1) | **due** | +| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | 2026-09-22 14:13Z | | [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | public | **answered** (t4, assigned) | per-consumer, on request | fixed | instant (0) | **due** | | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | fixed | instant (0) | **due** | @@ -35,7 +35,6 @@ Silence never buys a softer grade — see `docs/method/dependencies.md`. | Finding | Who | What would change | Default if silent | On | | --- | --- | --- | --- | --- | -| RISK-F-0011 | qonto-assistant | accepted deployed-instance evidence supports bounded stream completeness and permits closure; source-only evidence keeps the finding open | the medium grade stands; missing deployed acceptance is recorded as a stalled remediation, and observation remains staffed with completeness pending | 2026-09-16 | | RISK-F-0008 | audit-core | a working keyed commitment narrows RISK-REG-0001 to retained-by-obligation categories only | encrypt-then-hash recorded as the only known route, and the retention period recorded as unstateable | 2026-11-17 | ## Notes (below the floor) diff --git a/STATE.md b/STATE.md index 3478df7..ed4f021 100644 --- a/STATE.md +++ b/STATE.md @@ -139,7 +139,7 @@ statehub fix-consistency --repo risk-nexus not the identifier registrar. Needs a run with `STATEHUB_REGISTRAR=1` on the production instance. WP-0006 now has a registered Hub workplan and five task UUIDs; this implementation did not repair historical workplan registration. -- **C-31** fires on `RISK-F-` ids until canon registers the kinds. Packet sent. +- **C-31** fires on `RISK-F-` ids. This is expected noise for this repo: the RISK-WP-0001 default was applied 2026-09-22 after the-custodian did not answer by 2026-09-17. The register no longer treats it as a gap it can close. If canon later registers the kinds, the warning clears on its own. Defaults 2026-09-17. - **OpenBao is unverifiable from here** (403). Every grade touching an OpenBao policy is a grade on a document, and says so. diff --git a/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md b/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md index 7995488..5815daa 100644 --- a/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md +++ b/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md @@ -44,10 +44,10 @@ escalation_act: rule decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor" outstanding: "whether the stated target periods are achievable under platform-pg co-residency, and whether a keyed commitment restores erasability" determination: RISK-REG-0001 -last_checked: "2026-09-02T08:11:17Z" -next_check: "2026-09-02T09:11:17Z" -cadence: 1h -clean_streak: 1 +last_checked: "2026-09-22T06:13:33Z" +next_check: "2026-09-22T14:13:33Z" +cadence: 8h +clean_streak: 2 waiting_on: - who: audit-core what: "does a keyed commitment restore erasability without breaking chain verification; what is the platform-pg co-residency horizon" @@ -57,7 +57,7 @@ waiting_on: default_at: "2026-11-17" graded_by: risk-nexus ruling: RISK-RULING-2026-08-19-C -checked_by: "grok/risk-nexus" +checked_by: "worsch" --- # RISK-F-0008 — the exemption nobody has established @@ -379,3 +379,4 @@ This is not a clean check or a renewed acceptance. Whether the real-person or counterparty condition has fired, and the substantive regulatory review, remain unestablished here. The overdue review, existing grade and acceptance terms are preserved; absence of a new inbox answer cannot certify the condition false. +- **2026-09-22** — clean check: Acceptance review: ending conditions not observed (no counterparty demand on record; no new real-person data intake reported); railiance 2026-09-09 message concerned F-0010 only; audit-core wait runs to 2026-11-17. Cadence 1h → 8h (2 clean in a row); next check 2026-09-22 14:13Z. diff --git a/findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md b/findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md index 4bb3078..7711c2e 100644 --- a/findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md +++ b/findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md @@ -30,21 +30,17 @@ publication_subtitle: "A live deny was observed on qonto-assistant, but nothing revision: "graded-1" last_reviewed: "2026-09-02" review_interval: 6m -escalation: none -last_checked: "2026-09-05T00:05:51Z" -next_check: "2026-09-05T00:05:51Z" +escalation: pending +escalation_trigger: 5 +escalation_status: sent +escalation_sent: "2026-09-22" +last_checked: "2026-09-22T06:13:33Z" +next_check: "2026-09-22T06:13:33Z" cadence: instant clean_streak: 0 -waiting_on: - - who: qonto-assistant - what: "supply runtime-owner deployed-instance capture for kings-guard acceptance under KG-WP-0005-T03; source cadence and reconciliation now exist" - since: "2026-09-02" - would_change: "accepted deployed-instance evidence supports bounded stream completeness and permits closure; source-only evidence keeps the finding open" - default: "the medium grade stands; missing deployed acceptance is recorded as a stalled remediation, and observation remains staffed with completeness pending" - default_at: "2026-09-16" graded_by: risk-nexus ruling: RISK-RULING-2026-09-02-A -checked_by: "codex/risk-nexus" +checked_by: "worsch" --- # RISK-F-0011 — qonto-assistant audit.deny stream completeness is not established @@ -158,7 +154,20 @@ remains open, medium, public, no escalation: deployed completeness is still unknown, with no evidence of suppression or an authorization bypass. The 2026-09-16 default is retained, now describing the actual remaining obligation. +## Default applied and escalated — 2026-09-22 + +qonto-assistant did not supply the deployed-instance capture by 2026-09-16. +KG-WP-0005-T03 is still `wait`; its 2026-09-21 change was a hub-id writeback, +not evidence. The default applies: the medium grade stands, the missing +deployed acceptance is recorded as a stalled remediation, and observation stays +staffed with completeness pending. The finding has sat at `instant` since +2026-09-05, more than fourteen days, so escalation trigger 5 fires. The +escalation went to the-custodian today and asks who authorizes and runs the +deployed capture. Default if unanswered by 2026-09-29: raise once more, then +record the stall as accepted by silence. The grade does not change. + ## Reviews - **2026-09-02** — graded from the Gate House intake, the named conformance review, and a current-source check of qonto-assistant. Local lockout is in-process; the emitted deny stream still has no cadence or reconciliation view. Cadence starts at instant. - **2026-09-05** — not clean: Reviewed owner notice, cadence/logger/endpoint and KG-WP-0005; source remediation exists, deployed-instance acceptance remains pending under KG-WP-0005-T03. See RISK-V-0003. Cadence instant → instant; checked again immediately. +- **2026-09-22** — not clean: Default applied: KG-WP-0005-T03 still wait, no deployed capture; stall recorded; escalated to the-custodian under trigger 5 Cadence instant → instant; checked again immediately. diff --git a/workplans/RISK-WP-0001-make-the-register-decidable.md b/workplans/RISK-WP-0001-make-the-register-decidable.md index 04a8161..989fe7f 100644 --- a/workplans/RISK-WP-0001-make-the-register-decidable.md +++ b/workplans/RISK-WP-0001-make-the-register-decidable.md @@ -8,14 +8,7 @@ status: finished owner: the-custodian topic_slug: risk-nexus created: "2026-08-19" -updated: "2026-08-20" -waiting_on: - - who: the-custodian - what: "register finding / note / regulatory-record as canon work-record kinds, or rule that the register is a different ontology" - since: "2026-08-20" - would_change: "C-31 stops being a standing warning; the estate's work-record backbone gains four species it currently cannot name" - default: "C-31 documented as expected noise for this repo, and the register stops treating it as a gap it can close" - default_at: "2026-09-17" +updated: "2026-09-22" state_hub_workstream_id: "dadd2aa5-6c2a-5f38-ab30-f442f875b6a1" ---