coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007)

Browse source 
check_all runs every check stage even when one fails; malformed dates are
reported rather than aborting; accepted findings and closure evidence are
shown; defer requires a valid future date. Adds SCOPE.md, the scope
assessment, the open-findings source review and a unittest suite. Stops
tracking __pycache__.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 07:56:58 +02:00
parent 29f50d5143
commit bbbede5f47
25 changed files with 1007 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

42
STATE.md
View file

@ -1,6 +1,6 @@
# STATE — risk-nexus
**Updated:** 2026-09-02
**Updated:** 2026-09-05
**Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian
## One-line posture
@ -20,13 +20,41 @@ backup credential, and an accepted medium on audit retention.
| `RISK-WP-0003` | **finished** | Regulatory intake; the legal policy set |
| `RISK-WP-0004` | **finished** | Running the register: cadence, verification, inbox-before-grading |
| `RISK-WP-0005` | **finished** | The seven gaps from `history/2026-08-21-intent-gap-analysis.md` |
| `RISK-WP-0006` | **finished** | Reporting survives a stale index; full policies, embargo deadlines and closed-finding handovers stay visible; regression coverage and State Hub registration. |
| `RISK-WP-0007` | **finished** | Owner evidence reconciled, runtime/provider closure conditions recorded, and accepted obligations distinguished from missing engineering fixes. |
## Scope correction and reporting repair — 2026-09-05
`SCOPE.md` now describes the checked-in capability. The timestamped assessment
in `history/2026-09-05-014333-scope-intent-assessment.md` records the remaining
gaps behind the earlier claim that WP-0005 closed them all.
WP-0006 repairs the reporting path: `make check` runs every stage even after
failure; `make due` exposes regulatory policies and disclosure obligations;
malformed date strings no longer abort reporting; invalid deferrals cannot
write; archived completed workplans no longer trigger false inactivity alarms.
Eight regression tests pass. The live report now exposes four overdue policies,
eight pending publication handovers, and the existing overdue findings.
These are visibility repairs, not substantive reviews or evidence of closure.
The daily activity source includes those obligations. Its live synchronization
and end-to-end delivery remain unverified. External intake, incident clocks,
production-transition decisions and estate assessment coverage remain open.
WP-0007 then reconciled the owner evidence in RISK-V-0003. Qonto's source
cadence/reconciliation exists; KG-WP-0005-T03 waits for deployed acceptance.
RPF-WP-0029 removed the backup fallback; T02 waits for provider invalidation
and recovery receipts. Both findings were recorded as moved and remain open
at `instant`; F-0010 remains embargoed. F-0008's substantive review remains
overdue and its existing acceptance terms are displayed explicitly. Ten tests
pass. WP-0007 and four tasks are registered in State Hub.
## The register
| ID | Sev | Status | Disclosure | Cadence | System |
| --- | --- | --- | --- | --- | --- |
| `RISK-F-0011` | medium | open | public | instant | qonto-assistant |
| `RISK-F-0010` | low | open | embargoed | 1h | railiance-platform |
| `RISK-F-0010` | low | open | embargoed | instant | railiance-platform |
| `RISK-F-0009` | high | fixed | public | instant | railiance-platform |
| `RISK-F-0008` | medium | accepted | public | 1h | audit-core |
| `RISK-F-0007` | high | fixed | public | instant | estate |
@ -76,8 +104,8 @@ outcome.
| Who | On | Defaults |
| --- | --- | --- |
| qonto-assistant | heartbeat / emission-cadence and a reconciliation view for `audit.deny` (`F-0011`) | 2026-09-16 |
| railiance-platform | revoke or invalidate the provider credential, remove the source default, name fix tracking (`F-0010`) | 2026-09-15 |
| qonto-assistant | deployed-instance capture and King's Guard acceptance under `KG-WP-0005-T03`; source cadence/reconciliation now exist (`F-0011`) | 2026-09-16 |
| railiance-platform | provider invalidation and recovery receipts under `RPF-WP-0029-T02`; source fallback removed (`F-0010`) | 2026-09-15 |
| the-custodian | canon kinds packet | 2026-09-17 |
| audit-core | keyed commitment; `platform-pg` co-residency horizon | 2026-11-17 |
@ -107,10 +135,10 @@ statehub fix-consistency --repo risk-nexus
## Known conditions
- **Workplans are not indexed in the hub.** C-06 on all four: this instance is
- **Earlier workplans were not indexed in the hub.** C-06 on the earlier set: this instance was
not the identifier registrar. Needs a run with `STATEHUB_REGISTRAR=1` on the
production instance. The estate's read model cannot see any `risk-nexus`
workplan.
production instance. WP-0006 now has a registered Hub workplan and five task
UUIDs; this implementation did not repair historical workplan registration.
- **C-31** fires on `RISK-F-` ids until canon registers the kinds. Packet sent.
Defaults 2026-09-17.
- **OpenBao is unverifiable from here** (403). Every grade touching an OpenBao