RISK-WP-0003 T02/T03: state the retention periods, and write the intake route

T02 applies the dependency rule to this repo's own work: rather than wait
on audit-core's co-residency horizon, RISK-REG-0001 now states target
periods per category with the reasoning — 12 months for operator and
agent security records, 3 years to year-end for counterparty transaction
evidence, 8 years for accounting vouchers (shortened by BEG IV, flagged
as worth confirming), 10 years for books, 6 for commercial letters,
delete for anything with no ground. Targets, not achievements: the estate
cannot demonstrate any of them while the real horizon is the maximum
across every co-resident on platform-pg, and that gap is stated so the
table cannot be read as a compliance claim.

T03 writes the intake route from what audit-core did correctly without
one: the question as a question, what already depends on it, what becomes
expensive if the answer is no, and what you are not asking for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/RISK-WP-0003-regulatory-intake.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Make regulatory intake a working remit rather than one record"
 domain: infotech
 repo: risk-nexus
-status: proposed
+status: active
 owner: the-custodian
 topic_slug: risk-nexus
 created: "2026-08-20"