Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007)

check_all runs every check stage even when one fails; malformed dates are
reported rather than aborting; accepted findings and closure evidence are
shown; defer requires a valid future date. Adds SCOPE.md, the scope
assessment, the open-findings source review and a unittest suite. Stops
tracking __pycache__.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 07:56:58 +02:00
parent 29f50d5143
commit bbbede5f47
25 changed files with 1007 additions and 43 deletions

View file

@ -0,0 +1,130 @@
---
id: RISK-WP-0006
type: workplan
title: "Keep review obligations visible when the index or records are stale"
domain: infotech
repo: risk-nexus
status: finished
owner: the-custodian
topic_slug: risk-nexus
created: "2026-09-05"
updated: "2026-09-05"
depends_on_workplans:
- RISK-WP-0005
state_hub_workstream_id: "900ba790-c5b8-523c-947f-5cd743fa1d58"
---
# RISK-WP-0006 — keep review obligations visible
## Problem and priority
The [scope assessment](../history/2026-09-05-014333-scope-intent-assessment.md)
found that `make check` stops before showing overdue work, all four full legal
policies are outside review discovery, and disclosure obligations disappear
from the work list. These are the first priorities: they hide known obligations
and can be corrected within this repository without a new service or mandate.
Malformed dates must not defeat the repaired reporting path.
## Tasks and acceptance
### T01 — Run every check stage even if another fails
```task
id: RISK-WP-0006-T01
status: done
priority: high
state_hub_task_id: "44f58905-fc81-571f-b112-e37001b02ed9"
```
Run index, register and inbox checks independently, preserving a nonzero result
if any stage fails. A stale index and a broken register stage must still allow
the inbox stage to run. No regeneration or grading as a side effect.
### T02 — Include full policies in the review workflow
```task
id: RISK-WP-0006-T02
status: done
priority: high
state_hub_task_id: "4a9cd603-7722-5e3b-833e-b65109f33d8a"
```
Discover nested regulatory records, excluding README catalogues. Full policies
must appear when due and accept recorded outcomes. `make due` must expose these
obligations to existing scheduled sessions, not filter them out. Invalid dates
must be reported without aborting the report; invalid deferrals must not write.
### T03 — Keep disclosure obligations visible after closure
```task
id: RISK-WP-0006-T03
status: done
priority: high
state_hub_task_id: "3d250ebe-1d06-55f2-a4cc-8a716b12414f"
```
Report due or missing embargo review dates and pending publication handovers
across all findings, including fixed findings. Surface them through `make due`.
Do not publish, lift embargoes or change finding statuses automatically.
### T04 — Correct the archived fix completion signal
```task
id: RISK-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "79b0c627-9fff-59e2-a400-8d3e9585504b"
```
An archived completed workplan must not be reported as an unchanged unfinished
fix just because its display status carries an archive suffix. Preserve the
archive label and the documented whole-file timestamp limitation.
### T05 — Verify, document and reconcile registration
```task
id: RISK-WP-0006-T05
status: done
priority: high
state_hub_task_id: "96d06e61-84e7-5c3a-9d79-b700408afaf7"
```
Add focused regression tests for the failures above using isolated files and
mocked external reads. Run them and the live read-only reporting path. Update
SCOPE, usage and the operational instructions, and reconcile the workplan and
task records with State Hub. Record actual registration results and residuals.
## Scope boundary and next priorities
This plan repairs visibility, not the overdue substantive reviews themselves.
External intake delivery, urgent incident handling, scheduler-to-session delivery
proof and the production declaration require separate operational decisions or
cross-repository work. They remain open in the assessment. Missing fix records
and the F-0011 notice require evidence reconciliation, not automatic closure.
No legal conclusions, grades, acknowledgements or messages are generated here.
## Verification and completion evidence
Implementation complete for T01T04. Eight isolated regression tests pass via
`make test`, covering stage failures, nested policy discovery and recorded
reviews, invalid dates and deferrals, disclosure after closure, and archived
completed fixes. `git diff --check` passes.
Live validation first ran with a stale index: every report still executed and
Make returned nonzero. After `make register`, `make check` and `make due` both
returned zero while exposing all four overdue policies, eight pending handovers,
three overdue findings and the newer F-0011 inbox notice. No finding or policy
was stamped reviewed, re-graded or closed.
Registration: the normal CLI and an outside-sandbox retry timed out on State Hub
reads. A longer-timeout full reconciliation was stopped after prolonged API
reads without a completion result. Targeted registration succeeded
through the same workplan/task API and deterministic IDs used by the reconciler.
The workplan UUID is `900ba790-c5b8-523c-947f-5cd743fa1d58`; all five task
UUIDs are recorded beside their source blocks. Completion and the file binding
are synchronized through the API; the local index uses the reconciler renderer.
Residuals: external contact delivery, incident clocks, independent execution
assurance, substantive overdue reviews, method review scheduling and production
transition decisions remain open. The updated activity definition is local
source; deployment/synchronization to activity-core was not performed.

View file

@ -0,0 +1,113 @@
---
id: RISK-WP-0007
type: workplan
title: "Reconcile owner evidence and keep runtime closure obligations visible"
domain: infotech
repo: risk-nexus
status: finished
owner: the-custodian
topic_slug: custodian
created: "2026-09-05"
updated: "2026-09-05"
depends_on_workplans:
- RISK-WP-0006
state_hub_workstream_id: "ac12733f-3f4b-5c7b-aee7-7115b9c4db72"
---
# RISK-WP-0007 — reconcile owner evidence
The repaired reports expose work the register had not read. Reconcile it before
building another mechanism. Source remediation is progress; deployed acceptance
and credential invalidation require their own evidence.
## T01 — Reconcile the qonto return
```task
id: RISK-WP-0007-T01
status: done
priority: high
state_hub_task_id: "d3f0a9b7-4374-5350-b0b4-d7ac4f782acb"
```
Read the newer inbox notice, source cadence/logger/endpoint and observer workplan.
Link QONTO-WP-0005 and KG-WP-0005-T03 to F-0011; replace the stale missing-source
claim with the concrete runtime acceptance obligation. Keep the medium grade
and open status until that obligation is demonstrated. Record a moved check.
## T02 — Reconcile backup source remediation
```task
id: RISK-WP-0007-T02
status: done
priority: high
state_hub_task_id: "215b8b0b-aef0-5575-bf12-b08dc2941cbe"
```
Read RPF-WP-0029 and verify source fallback removal without displaying, testing
or copying credential material. Link provider invalidation/recovery tracking;
keep the low grade, open status and embargo until the original conditions hold.
Record a moved check, retaining the existing deadline.
## T03 — Distinguish accepted obligations from missing fixes
```task
id: RISK-WP-0007-T03
status: done
priority: high
state_hub_task_id: "a17feb05-2c2c-5372-adbb-9d2c095f55fd"
```
Report an accepted record's accepter, expiry condition, determination and review
date when those fields resolve to a real record. Do not invent a fix workplan
for F-0008 or suppress incomplete acceptance records. Surface closure conditions
even when the source workplan is completed. Cover both paths with regression
tests. Inspect F-0008's technical evidence without renewing legal conclusions
or certifying that its real-data trigger remains false.
## T04 — Record verification boundaries and register the result
```task
id: RISK-WP-0007-T04
status: done
priority: medium
state_hub_task_id: "ebf1edad-6e0e-5fdc-9781-5e79cff8b117"
```
Retain dated source evidence, explicit next evidence and owners. Inspect local
external-intake/publication and activity evidence; state exactly what remains
unverified. Update scope/state/index, run tests and reports, register this
workplan and its tasks, and verify completion in State Hub.
## Boundaries
No messages, acknowledgements, deployments, credential actions, publication,
new spending or automatic finding closure. Existing source-owner workplans
remain authoritative. This plan closes the register's reconciliation work,
not the owners' unresolved runtime obligations or the substantive legal reviews.
## Completion evidence
Completed 2026-09-05. RISK-V-0003 retains the inspected source evidence,
provenance and runtime/provider acceptance requirements. F-0011 now tracks
QONTO-WP-0005 and KG-WP-0005-T03; F-0010 tracks RPF-WP-0029-T02. Both received
`moved` outcomes and remain at `instant`; no same-sitting clean check was made.
Grades, open statuses, the credential embargo and original default dates remain.
F-0008's technical inspection is explicitly not a completed substantive review.
Its existing acceptance is now reported with its determination and due date;
invalid/incomplete acceptances still produce missing-tracking warnings. The
closure-evidence section survives completed source workplans.
Ten isolated tests pass via `make test`; document links and `git diff --check`
pass. The generated register and live checker expose the two waiting owner tasks,
recorded acceptance, four overdue full policies and eight publication handovers.
State Hub registration succeeded for workplan
`ac12733f-3f4b-5c7b-aee7-7115b9c4db72` and all four tasks (UUIDs in source).
Completion status and backing-file binding are reconciled through the same API;
the local WORK-RECORDS index is regenerated with the State Hub renderer.
Still external or unverified: runtime capture/observer acceptance, provider
invalidation/recovery receipts, acceptance-trigger facts and legal reviews,
external contact delivery and scheduled-session completion. Source searches
establish no stronger conclusion. No messages or acknowledgements were sent.