Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007)
check_all runs every check stage even when one fails; malformed dates are reported rather than aborting; accepted findings and closure evidence are shown; defer requires a valid future date. Adds SCOPE.md, the scope assessment, the open-findings source review and a unittest suite. Stops tracking __pycache__. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 6903@bnt-lap001 Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
parent
29f50d5143
commit
bbbede5f47
25 changed files with 1007 additions and 43 deletions
130
workplans/RISK-WP-0006-keep-review-obligations-visible.md
Normal file
130
workplans/RISK-WP-0006-keep-review-obligations-visible.md
Normal file
|
|
@ -0,0 +1,130 @@
|
|||
---
|
||||
id: RISK-WP-0006
|
||||
type: workplan
|
||||
title: "Keep review obligations visible when the index or records are stale"
|
||||
domain: infotech
|
||||
repo: risk-nexus
|
||||
status: finished
|
||||
owner: the-custodian
|
||||
topic_slug: risk-nexus
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-05"
|
||||
depends_on_workplans:
|
||||
- RISK-WP-0005
|
||||
state_hub_workstream_id: "900ba790-c5b8-523c-947f-5cd743fa1d58"
|
||||
---
|
||||
|
||||
# RISK-WP-0006 — keep review obligations visible
|
||||
|
||||
## Problem and priority
|
||||
|
||||
The [scope assessment](../history/2026-09-05-014333-scope-intent-assessment.md)
|
||||
found that `make check` stops before showing overdue work, all four full legal
|
||||
policies are outside review discovery, and disclosure obligations disappear
|
||||
from the work list. These are the first priorities: they hide known obligations
|
||||
and can be corrected within this repository without a new service or mandate.
|
||||
Malformed dates must not defeat the repaired reporting path.
|
||||
|
||||
## Tasks and acceptance
|
||||
|
||||
### T01 — Run every check stage even if another fails
|
||||
|
||||
```task
|
||||
id: RISK-WP-0006-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "44f58905-fc81-571f-b112-e37001b02ed9"
|
||||
```
|
||||
|
||||
Run index, register and inbox checks independently, preserving a nonzero result
|
||||
if any stage fails. A stale index and a broken register stage must still allow
|
||||
the inbox stage to run. No regeneration or grading as a side effect.
|
||||
|
||||
### T02 — Include full policies in the review workflow
|
||||
|
||||
```task
|
||||
id: RISK-WP-0006-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "4a9cd603-7722-5e3b-833e-b65109f33d8a"
|
||||
```
|
||||
|
||||
Discover nested regulatory records, excluding README catalogues. Full policies
|
||||
must appear when due and accept recorded outcomes. `make due` must expose these
|
||||
obligations to existing scheduled sessions, not filter them out. Invalid dates
|
||||
must be reported without aborting the report; invalid deferrals must not write.
|
||||
|
||||
### T03 — Keep disclosure obligations visible after closure
|
||||
|
||||
```task
|
||||
id: RISK-WP-0006-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3d250ebe-1d06-55f2-a4cc-8a716b12414f"
|
||||
```
|
||||
|
||||
Report due or missing embargo review dates and pending publication handovers
|
||||
across all findings, including fixed findings. Surface them through `make due`.
|
||||
Do not publish, lift embargoes or change finding statuses automatically.
|
||||
|
||||
### T04 — Correct the archived fix completion signal
|
||||
|
||||
```task
|
||||
id: RISK-WP-0006-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "79b0c627-9fff-59e2-a400-8d3e9585504b"
|
||||
```
|
||||
|
||||
An archived completed workplan must not be reported as an unchanged unfinished
|
||||
fix just because its display status carries an archive suffix. Preserve the
|
||||
archive label and the documented whole-file timestamp limitation.
|
||||
|
||||
### T05 — Verify, document and reconcile registration
|
||||
|
||||
```task
|
||||
id: RISK-WP-0006-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "96d06e61-84e7-5c3a-9d79-b700408afaf7"
|
||||
```
|
||||
|
||||
Add focused regression tests for the failures above using isolated files and
|
||||
mocked external reads. Run them and the live read-only reporting path. Update
|
||||
SCOPE, usage and the operational instructions, and reconcile the workplan and
|
||||
task records with State Hub. Record actual registration results and residuals.
|
||||
|
||||
## Scope boundary and next priorities
|
||||
|
||||
This plan repairs visibility, not the overdue substantive reviews themselves.
|
||||
External intake delivery, urgent incident handling, scheduler-to-session delivery
|
||||
proof and the production declaration require separate operational decisions or
|
||||
cross-repository work. They remain open in the assessment. Missing fix records
|
||||
and the F-0011 notice require evidence reconciliation, not automatic closure.
|
||||
No legal conclusions, grades, acknowledgements or messages are generated here.
|
||||
|
||||
## Verification and completion evidence
|
||||
|
||||
Implementation complete for T01–T04. Eight isolated regression tests pass via
|
||||
`make test`, covering stage failures, nested policy discovery and recorded
|
||||
reviews, invalid dates and deferrals, disclosure after closure, and archived
|
||||
completed fixes. `git diff --check` passes.
|
||||
|
||||
Live validation first ran with a stale index: every report still executed and
|
||||
Make returned nonzero. After `make register`, `make check` and `make due` both
|
||||
returned zero while exposing all four overdue policies, eight pending handovers,
|
||||
three overdue findings and the newer F-0011 inbox notice. No finding or policy
|
||||
was stamped reviewed, re-graded or closed.
|
||||
|
||||
Registration: the normal CLI and an outside-sandbox retry timed out on State Hub
|
||||
reads. A longer-timeout full reconciliation was stopped after prolonged API
|
||||
reads without a completion result. Targeted registration succeeded
|
||||
through the same workplan/task API and deterministic IDs used by the reconciler.
|
||||
The workplan UUID is `900ba790-c5b8-523c-947f-5cd743fa1d58`; all five task
|
||||
UUIDs are recorded beside their source blocks. Completion and the file binding
|
||||
are synchronized through the API; the local index uses the reconciler renderer.
|
||||
|
||||
Residuals: external contact delivery, incident clocks, independent execution
|
||||
assurance, substantive overdue reviews, method review scheduling and production
|
||||
transition decisions remain open. The updated activity definition is local
|
||||
source; deployment/synchronization to activity-core was not performed.
|
||||
113
workplans/RISK-WP-0007-reconcile-owner-evidence.md
Normal file
113
workplans/RISK-WP-0007-reconcile-owner-evidence.md
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
---
|
||||
id: RISK-WP-0007
|
||||
type: workplan
|
||||
title: "Reconcile owner evidence and keep runtime closure obligations visible"
|
||||
domain: infotech
|
||||
repo: risk-nexus
|
||||
status: finished
|
||||
owner: the-custodian
|
||||
topic_slug: custodian
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-05"
|
||||
depends_on_workplans:
|
||||
- RISK-WP-0006
|
||||
state_hub_workstream_id: "ac12733f-3f4b-5c7b-aee7-7115b9c4db72"
|
||||
---
|
||||
|
||||
# RISK-WP-0007 — reconcile owner evidence
|
||||
|
||||
The repaired reports expose work the register had not read. Reconcile it before
|
||||
building another mechanism. Source remediation is progress; deployed acceptance
|
||||
and credential invalidation require their own evidence.
|
||||
|
||||
## T01 — Reconcile the qonto return
|
||||
|
||||
```task
|
||||
id: RISK-WP-0007-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d3f0a9b7-4374-5350-b0b4-d7ac4f782acb"
|
||||
```
|
||||
|
||||
Read the newer inbox notice, source cadence/logger/endpoint and observer workplan.
|
||||
Link QONTO-WP-0005 and KG-WP-0005-T03 to F-0011; replace the stale missing-source
|
||||
claim with the concrete runtime acceptance obligation. Keep the medium grade
|
||||
and open status until that obligation is demonstrated. Record a moved check.
|
||||
|
||||
## T02 — Reconcile backup source remediation
|
||||
|
||||
```task
|
||||
id: RISK-WP-0007-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "215b8b0b-aef0-5575-bf12-b08dc2941cbe"
|
||||
```
|
||||
|
||||
Read RPF-WP-0029 and verify source fallback removal without displaying, testing
|
||||
or copying credential material. Link provider invalidation/recovery tracking;
|
||||
keep the low grade, open status and embargo until the original conditions hold.
|
||||
Record a moved check, retaining the existing deadline.
|
||||
|
||||
## T03 — Distinguish accepted obligations from missing fixes
|
||||
|
||||
```task
|
||||
id: RISK-WP-0007-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "a17feb05-2c2c-5372-adbb-9d2c095f55fd"
|
||||
```
|
||||
|
||||
Report an accepted record's accepter, expiry condition, determination and review
|
||||
date when those fields resolve to a real record. Do not invent a fix workplan
|
||||
for F-0008 or suppress incomplete acceptance records. Surface closure conditions
|
||||
even when the source workplan is completed. Cover both paths with regression
|
||||
tests. Inspect F-0008's technical evidence without renewing legal conclusions
|
||||
or certifying that its real-data trigger remains false.
|
||||
|
||||
## T04 — Record verification boundaries and register the result
|
||||
|
||||
```task
|
||||
id: RISK-WP-0007-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ebf1edad-6e0e-5fdc-9781-5e79cff8b117"
|
||||
```
|
||||
|
||||
Retain dated source evidence, explicit next evidence and owners. Inspect local
|
||||
external-intake/publication and activity evidence; state exactly what remains
|
||||
unverified. Update scope/state/index, run tests and reports, register this
|
||||
workplan and its tasks, and verify completion in State Hub.
|
||||
|
||||
## Boundaries
|
||||
|
||||
No messages, acknowledgements, deployments, credential actions, publication,
|
||||
new spending or automatic finding closure. Existing source-owner workplans
|
||||
remain authoritative. This plan closes the register's reconciliation work,
|
||||
not the owners' unresolved runtime obligations or the substantive legal reviews.
|
||||
|
||||
## Completion evidence
|
||||
|
||||
Completed 2026-09-05. RISK-V-0003 retains the inspected source evidence,
|
||||
provenance and runtime/provider acceptance requirements. F-0011 now tracks
|
||||
QONTO-WP-0005 and KG-WP-0005-T03; F-0010 tracks RPF-WP-0029-T02. Both received
|
||||
`moved` outcomes and remain at `instant`; no same-sitting clean check was made.
|
||||
Grades, open statuses, the credential embargo and original default dates remain.
|
||||
|
||||
F-0008's technical inspection is explicitly not a completed substantive review.
|
||||
Its existing acceptance is now reported with its determination and due date;
|
||||
invalid/incomplete acceptances still produce missing-tracking warnings. The
|
||||
closure-evidence section survives completed source workplans.
|
||||
|
||||
Ten isolated tests pass via `make test`; document links and `git diff --check`
|
||||
pass. The generated register and live checker expose the two waiting owner tasks,
|
||||
recorded acceptance, four overdue full policies and eight publication handovers.
|
||||
|
||||
State Hub registration succeeded for workplan
|
||||
`ac12733f-3f4b-5c7b-aee7-7115b9c4db72` and all four tasks (UUIDs in source).
|
||||
Completion status and backing-file binding are reconciled through the same API;
|
||||
the local WORK-RECORDS index is regenerated with the State Hub renderer.
|
||||
|
||||
Still external or unverified: runtime capture/observer acceptance, provider
|
||||
invalidation/recovery receipts, acceptance-trigger facts and legal reviews,
|
||||
external contact delivery and scheduled-session completion. Source searches
|
||||
establish no stronger conclusion. No messages or acknowledgements were sent.
|
||||
Loading…
Add table
Add a link
Reference in a new issue