coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007)

Browse source 
check_all runs every check stage even when one fails; malformed dates are
reported rather than aborting; accepted findings and closure evidence are
shown; defer requires a valid future date. Adds SCOPE.md, the scope
assessment, the open-findings source review and a unittest suite. Stops
tracking __pycache__.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 07:56:58 +02:00
parent 29f50d5143
commit bbbede5f47
25 changed files with 1007 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

14
findings/RISK-F-0008-audit-retention-legal-basis-assumed.md
View file

@ -365,3 +365,17 @@ achievable. An accepted risk still gets checked.
- **2026-08-20** — not clean: Trigger list ruled: no external determination in build mode; accepted with the legal policy set as the compensating control. Cadence instant → instant; checked again immediately.
- **2026-09-01** — not clean: the regulatory record now states target periods per category; the remaining gap is whether platform-pg co-residency can achieve them, while the keyed-commitment question is unchanged. Grade and acceptance hold. Cadence instant → instant; checked again immediately.
- **2026-09-02** — clean check: acceptance, RISK-REG-0001, and the audit-core keyed-commitment wait unchanged. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.
## Evidence inspection — 2026-09-05 (review remains due)
[RISK-V-0003](../docs/verifications/2026-09-05-open-findings-source-review.md)
records a source/inbox inspection. The technical owner still documents the
cleartext-hash limitation; no new answer to the existing wait appeared in the
fetched risk-nexus inbox. The report now displays this record's existing
accepter, ending condition, determination and review date as a recorded
acceptance obligation, rather than inventing a fix plan to fill `fix_tracking`.
This is not a clean check or a renewed acceptance. Whether the real-person or
counterparty condition has fired, and the substantive regulatory review, remain
unestablished here. The overdue review, existing grade and acceptance terms are
preserved; absence of a new inbox answer cannot certify the condition false.