From bb199ff2ac62c37738ede7b635ef70362b401086 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 22 Sep 2026 10:26:00 +0200 Subject: [PATCH] Add AGENTS.md and use Mode of Authority wording AGENTS.md was required (C-35) and missing. Replace bare "operator" in this session's ruling and help text per the environment orientation. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 6903@bnt-lap001 Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89 --- AGENTS.md | 60 ++++++++++++++++++++++++ Makefile | 2 +- docs/rulings/2026-09-22-f0010-closure.md | 2 +- 3 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..39f5f34 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,60 @@ +# risk-nexus — Agent Instructions + +## Repo Identity + +**Purpose:** the estate's risk register. It grades, reviews, escalates and hands +over findings for publication, and keeps regulatory records. It is headless: +files are the source of truth, and `make` is the interface. See `SCOPE.md` for +what the repository does and does not do. + +**Domain:** infotech +**Repo slug:** risk-nexus +**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a` +**Workplan prefix:** `RISK-WP-` +**Record prefixes:** `RISK-F-` findings, `RISK-REG-` regulatory records, +`RISK-POL-` legal policies, `RISK-V-` verifications, `RISK-RULING-` rulings + +--- + +## Working the register + +Run `make` to list every target with examples. The usual session is: + +```bash +make check # full sweep; the inbox comes first ("question zero") +make list # live findings, most severe first +make show ID=RISK-F-0012 # one record +make checked ID= OUTCOME=clean|moved NOTE="what was seen" +make test # before committing tool changes +``` + +Method is in `docs/method/`: severity, disclosure, review, escalation, intake +and verification. Rulings go in `docs/rulings/`. Never record credential values, +fingerprints, lengths or shapes in any file or message. + +## State Hub + +Workstation: `http://127.0.0.1:8000`. On railiance01, in-cluster: +`http://10.43.68.154:8000`. The hub is a read model. + +- **Start:** `cat .custodian-brief.md`, then + `GET /messages/?to_agent=risk-nexus&unread_only=true`, and mark messages read + once they have been acted on. +- **Close:** `POST /progress/` with a summary. After any change to a workplan + file, run `statehub fix-consistency`; its sync step pushes. +- Never register workplans or tasks by hand. Write the file, commit, and sync. +- Stage by explicit path, and leave other people's uncommitted files alone. + +## Environment and authority + +Read `~/the-custodian/docs/agent-environment-orientation.md` before any +production, credential or GitOps work. Write authority in Mode of Authority +terms: the founder's decisions are "the founder, exercising `GOVERN @ estate`". +Never write a bare "operator". Older records in this repository still use that +word; correct it only when you are editing the record anyway. + +## Credential and access routing + +This repository needs no credentials. If that ever changes, run +`warden route find "" --json` first. ops-warden issues SSH certificates +only; every other credential belongs to another subsystem. diff --git a/Makefile b/Makefile index fe33544..dfae203 100644 --- a/Makefile +++ b/Makefile @@ -69,4 +69,4 @@ help: ## List targets with examples (the default) /^##@/ {printf "\n\033[1m%s\033[0m\n", substr($$0, 5); next} \ /^[a-z][a-zA-Z_-]*:.*## / {printf " \033[36m%-12s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) @echo - @echo "Defer a check (operator decision): make checked ARGS='RISK-F-0012 defer 2026-10-15 \"reason\"'" + @echo "Defer a check (founder decision): make checked ARGS='RISK-F-0012 defer 2026-10-15 \"reason\"'" diff --git a/docs/rulings/2026-09-22-f0010-closure.md b/docs/rulings/2026-09-22-f0010-closure.md index 3bba193..ef68c2c 100644 --- a/docs/rulings/2026-09-22-f0010-closure.md +++ b/docs/rulings/2026-09-22-f0010-closure.md @@ -12,7 +12,7 @@ default, which does not apply: railiance-platform answered (message | Literal source default removed | `tools/cmd/forgejo-backup` names the variable only in a comment; `lib/railiance-backup-common.sh` returns 1 when the governed token is absent, before the URL template is built. Re-read 2026-09-22 without displaying any value. | Observed source | | Governed ciphertext upload | `docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json`: upload 201, download 200, matching ciphertext hash, decrypted | Receipt | | Restore | `docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`: isolated restore, database import, application health, 2040 package blobs verified, cleanup | Receipt | -| Predecessor invalidated | `docs/evidence/2026-09-15-rpf-wp-0029-predecessor-share-invalidated.json`: the operator attests the personal file-drop share was unshared; no HTTP probe | Owner attestation | +| Predecessor invalidated | `docs/evidence/2026-09-15-rpf-wp-0029-predecessor-share-invalidated.json`: railiance-platform records the founder's attestation that the personal file-drop share was unshared; no HTTP probe | Owner attestation | ## Decision