From ace941ef05f57bc3950d0c9fbcca68ee15f6b106 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 21 Aug 2026 08:16:43 +0200 Subject: [PATCH] Assess STATE against INTENT: seven gaps, one sharp failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'a regulation that applies was found before it was needed' test is not met and cannot be retro-fitted: the policy set found two obligations already live, the e-invoicing one by about nineteen months. The catalogue makes the test passable going forward; it does not make that instance a pass. Also: remediation tracking does not track — fix_tracking is a string nobody reads, so an owner who goes quiet and a fix that goes quiet look identical; there is no intake path for incidents or external reports, so the register is a self-assessment aggregator rather than what INTENT claims; and no coverage model, so a system with zero findings is indistinguishable from one nobody assessed. Co-Authored-By: Claude Opus 5 --- .../assessments/2026-08-21-state-vs-intent.md | 152 ++++++++++++++++++ 1 file changed, 152 insertions(+) create mode 100644 docs/assessments/2026-08-21-state-vs-intent.md diff --git a/docs/assessments/2026-08-21-state-vs-intent.md b/docs/assessments/2026-08-21-state-vs-intent.md new file mode 100644 index 0000000..4843b31 --- /dev/null +++ b/docs/assessments/2026-08-21-state-vs-intent.md @@ -0,0 +1,152 @@ +--- +id: RISK-ASSESS-0001 +type: assessment +title: "STATE.md against INTENT.md — what is missing" +date: "2026-08-21" +owner: risk-nexus +--- + +# What this repo promised, and what it has + +`INTENT.md` was written before the register existed. Four days in, this is what +it claimed, what is true, and what is not. + +## What it owns — six claims + +| Claim | State | Honest reading | +| --- | --- | --- | +| Finding intake, from any source: research, review, **incident, external report** | Partial | Nine findings, all from research or self-review. **No incident path and no external-report channel exist at all.** | +| Severity and triage | Yes | Scale adopted, amended twice under use, applied to nine findings with no `unset` left. | +| Remediation tracking — owner, state, whether it stalled | **Nominal** | `fix_tracking` holds strings nobody reads. See gap 2. | +| Disclosure timing | Yes | Three states, exercised, and it has bitten across two findings. | +| Regulatory intake | Yes, and beyond | One determination, thirteen-entry policy set, a written route. | +| The escalation rule | Yes | Adopted 2026-08-20 with the operator's thresholds. | + +## What it does not own — held + +Fixing, publication, blocking delivery, legal advice, amending canon. Nothing +in four days crossed those. The nearest approach was running `kubectl` against +another repo's cluster, and that is bounded in `docs/method/verification.md`: +read-only, recorded, routed as a question, never a conclusion on the owner's +behalf. + +## What good looks like — four tests from INTENT + +**"A gap that was known is recorded with a severity and an owner."** Met. +Nine, including the estate-wide one that had lived as open question 3 of an +unratified draft. + +**"A regulation that applies was found before it was needed."** **Not met, and +this is the sharpest failure in the assessment.** The policy set found two +obligations that are *already live*: commercial and tax retention, and the +e-invoicing receiving duty in force since January 2025. Neither was found +before it was needed. They were found roughly nineteen months late, by writing +a catalogue that should have existed first. The catalogue now makes the test +passable going forward; it does not make this instance a pass. + +**"A fix that stalled was visible while it stalled."** **Untested, and weaker +than it looks.** No fix has stalled yet. The mechanism — fourteen days at the +bottom rung — measures whether the *register* is checking, not whether the +*fix* is moving. See gap 2. + +**"The things that genuinely needed the operator's judgement reached them."** +Met, four times, three answered. One was withdrawn before sending because the +fix landed first, which the register recorded as luck rather than a success. + +## The gaps, in the order they would hurt + +### 1. Nothing can report to this register from outside + +Every finding arrived from a repo reading its own code, or from this register +reading a cluster. `INTENT.md` claims intake from **incident and external +report**; neither has a path. + +There is no address an outsider could use, no `security.txt` anywhere in the +estate, and no defined route from "something is happening right now" to a +record. The severity scale assumes a latent defect; an active incident has a +different tempo, and `RISK-POL-0005` (breach notification, 72 hours) is dormant +with nothing wired to it. + +The register is currently a **self-assessment aggregator**. That is a +respectable thing to be and it is not what the intent says it is. + +### 2. Remediation tracking does not track + +`fix_tracking: FLEX-WP-0015-T02` is a string this repo writes down and never +reads. The hub knows whether that task moved; the register asks a human +instead, and "has the fix moved?" is question three of every check. + +That decays the moment nobody is looking, which is precisely the condition the +whole cadence design assumes. **The fix state should be read from the hub, and +a fix that has not moved should reset nothing and escalate on its own timer** — +independent of whether the register happened to check. + +Today, an owner who goes quiet and a fix that goes quiet look identical. + +### 3. There is no coverage model + +The register knows what was reported. It has no view of what was never looked +at. + +A system with zero findings is indistinguishable from a system nobody has +assessed, and `RISK-N-0003` records the uncomfortable evidence: every repo that +has examined its own boundary this month found a defect — two for two. +`INTENT.md`'s "nobody is surprised" cannot hold while the denominator is +unknown. + +### 4. The production transition has no owner and no definition + +Five findings owe a re-score at "the production transition", and +`RISK-F-0007`'s acceptance **expires** there. Nothing outside this repo knows +that, no one has defined what the event is, and no one has been named to +declare it. + +An acceptance that expires on an undefined event expires on nobody's calendar. + +### 5. The repo claims a surface it does not have + +`README.md` and `INTENT.md` both say `risk-nexus` serves `risk.coulomb.social`. +It serves nothing. Two documents wait on `policy-nexus` for an address, and the +site does not exist. + +Small, but it is exactly the class of claim this register grades other repos +down for: a stated control that is not there. + +### 6. Escalation has no delivery guarantee + +Escalations go to an inbox and are said aloud in whatever session is running. +If the operator does not read the inbox, the escalation is indistinguishable +from one never sent — which is the failure this register committed on +2026-08-19 and fixed *for itself* with `hourly-register-inbox-watch`. + +The same fix has not been applied to the escalation path. Nothing acknowledges, +and nothing re-raises. + +### 7. Everything runs from one checkout + +The activity definitions instruct a session that may not exist. If no agent +picks up the daily sweep, `make due` still reports and nobody reads it. The +ladder degrades to decoration silently — and a `1q` rung would then mean "no +one checked for a quarter", which reads identically to "stable for a quarter". + +`clean_streak` makes a suspiciously smooth climb visible, but only to someone +looking. + +## What is deliberately not a gap + +- **No monitoring.** `RISK-N-0003` is a note, ruled so on purpose: no repo owns + estate-wide detection and a register that grows probes becomes a second + engineering team. +- **No OpenBao access.** Bounded in `verification.md`. Acquiring production + secret-store credentials for a risk register would trade a verification + problem for a worse one. +- **No blocking.** Build mode: a finding is information. Unchanged. + +## Ranking + +If one thing is done next it is **gap 2**, because it is the only one where the +register currently reports something it cannot actually see, and INTENT names +it explicitly. Gaps 1 and 4 are the next two, and both are cheap. + +Gap 3 is the largest and the most expensive, and it is the one that decides +whether "nobody is surprised" is a claim this repo can ever make.