coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply due defaults: escalate RISK-F-0011 stall, settle C-31 as noise

Browse source 
RISK-F-0011: KG-WP-0005-T03 still waits on a deployed capture; medium grade
stands, stall recorded, escalated to the-custodian under trigger 5.
RISK-WP-0001: C-31 documented as expected noise. RISK-F-0008 acceptance
review recorded clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 08:13:56 +02:00
parent e6208a6572
commit aa0a85b893
5 changed files with 30 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

11
findings/RISK-F-0008-audit-retention-legal-basis-assumed.md
View file

@ -44,10 +44,10 @@ escalation_act: rule
decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
outstanding: "whether the stated target periods are achievable under platform-pg co-residency, and whether a keyed commitment restores erasability"
determination: RISK-REG-0001
last_checked: "2026-09-02T08:11:17Z"
next_check: "2026-09-02T09:11:17Z"
cadence: 1h
clean_streak: 1
last_checked: "2026-09-22T06:13:33Z"
next_check: "2026-09-22T14:13:33Z"
cadence: 8h
clean_streak: 2
waiting_on:
- who: audit-core
what: "does a keyed commitment restore erasability without breaking chain verification; what is the platform-pg co-residency horizon"
@ -57,7 +57,7 @@ waiting_on:
default_at: "2026-11-17"
graded_by: risk-nexus
ruling: RISK-RULING-2026-08-19-C
checked_by: "grok/risk-nexus"
checked_by: "worsch"
---
# RISK-F-0008 — the exemption nobody has established
@ -379,3 +379,4 @@ This is not a clean check or a renewed acceptance. Whether the real-person or
counterparty condition has fired, and the substantive regulatory review, remain
unestablished here. The overdue review, existing grade and acceptance terms are
preserved; absence of a new inbox answer cannot certify the condition false.
- **2026-09-22** — clean check: Acceptance review: ending conditions not observed (no counterparty demand on record; no new real-person data intake reported); railiance 2026-09-09 message concerned F-0010 only; audit-core wait runs to 2026-11-17. Cadence 1h → 8h (2 clean in a row); next check 2026-09-22 14:13Z.

31
findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md
View file

@ -30,21 +30,17 @@ publication_subtitle: "A live deny was observed on qonto-assistant, but nothing
revision: "graded-1"
last_reviewed: "2026-09-02"
review_interval: 6m
escalation: none
last_checked: "2026-09-05T00:05:51Z"
next_check: "2026-09-05T00:05:51Z"
escalation: pending
escalation_trigger: 5
escalation_status: sent
escalation_sent: "2026-09-22"
last_checked: "2026-09-22T06:13:33Z"
next_check: "2026-09-22T06:13:33Z"
cadence: instant
clean_streak: 0
waiting_on:
- who: qonto-assistant
what: "supply runtime-owner deployed-instance capture for kings-guard acceptance under KG-WP-0005-T03; source cadence and reconciliation now exist"
since: "2026-09-02"
would_change: "accepted deployed-instance evidence supports bounded stream completeness and permits closure; source-only evidence keeps the finding open"
default: "the medium grade stands; missing deployed acceptance is recorded as a stalled remediation, and observation remains staffed with completeness pending"
default_at: "2026-09-16"
graded_by: risk-nexus
ruling: RISK-RULING-2026-09-02-A
checked_by: "codex/risk-nexus"
checked_by: "worsch"
---
# RISK-F-0011 — qonto-assistant audit.deny stream completeness is not established
@ -158,7 +154,20 @@ remains open, medium, public, no escalation: deployed completeness is still
unknown, with no evidence of suppression or an authorization bypass. The
2026-09-16 default is retained, now describing the actual remaining obligation.
## Default applied and escalated — 2026-09-22
qonto-assistant did not supply the deployed-instance capture by 2026-09-16.
KG-WP-0005-T03 is still `wait`; its 2026-09-21 change was a hub-id writeback,
not evidence. The default applies: the medium grade stands, the missing
deployed acceptance is recorded as a stalled remediation, and observation stays
staffed with completeness pending. The finding has sat at `instant` since
2026-09-05, more than fourteen days, so escalation trigger 5 fires. The
escalation went to the-custodian today and asks who authorizes and runs the
deployed capture. Default if unanswered by 2026-09-29: raise once more, then
record the stall as accepted by silence. The grade does not change.
## Reviews
- **2026-09-02** — graded from the Gate House intake, the named conformance review, and a current-source check of qonto-assistant. Local lockout is in-process; the emitted deny stream still has no cadence or reconciliation view. Cadence starts at instant.
- **2026-09-05** — not clean: Reviewed owner notice, cadence/logger/endpoint and KG-WP-0005; source remediation exists, deployed-instance acceptance remains pending under KG-WP-0005-T03. See RISK-V-0003. Cadence instant → instant; checked again immediately.
- **2026-09-22** — not clean: Default applied: KG-WP-0005-T03 still wait, no deployed capture; stall recorded; escalated to the-custodian under trigger 5 Cadence instant → instant; checked again immediately.