RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading

Severity (impact x likelihood, fidelity modifier for controls that lie,
headline-vs-constraint, build-mode double grade, the floor), disclosure
(publish/embargoed/restricted, and the build-mode deferral re-taken and
narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers
settled plus an ordering-hazard trigger the RISK-F-0002 case forced;
proposed, awaiting the custodian), review (intervals, what a review is,
what missing one produces, the production re-score).

Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002
medium with a high constraint on RISK-F-0001's remediation, filed as a
peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no
escalation. No unset field remains.

REGISTER.md is generated; make check reports overdue, stalled, ungraded
and unanswered escalations without changing anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

findings/README.md

@@ -0,0 +1,46 @@
+# Filing a finding
+
+One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter,
+then prose. Next id is one past the highest here.
+
+## What the reporter fills in
+
+```yaml
+id: RISK-F-0004
+type: finding
+title: "one line, what is true — not what should be done"
+status: open                  # open | fixed | accepted | withdrawn
+reported_by: <repo>           # who found it
+reported_via: <repo>          # who routed it here, if different
+date_reported: "YYYY-MM-DD"
+system: <repo>                # the system the defect is in
+environment: production       # production | build | both
+fix_owner: <repo>             # who owns the fix — never risk-nexus
+fix_tracking: <WP-ID or unset>
+related: [RISK-F-0001]        # optional
+```
+
+## What risk-nexus fills in — leave these out
+
+`severity`, `severity_at_production`, `impact`, `likelihood`,
+`fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`,
+`escalation*`, `constraint*`, `last_reviewed`, `review_by`, `graded_by`,
+`ruling`.
+
+Setting them yourself is not an error to be corrected — it is a boundary this
+repo would rather keep. The reporter says what is true; this repo says how bad
+it is and who hears about it (`INTENT.md`). Leaving them out, or writing
+`unset`, both work; the nag reports either way until they are graded.
+
+## What makes a good finding here
+
+- **State exposure only as far as you can support it.** "Not established" is a
+  complete answer and grades better than a guess. `RISK-F-0001` declining to
+  assume a NetworkPolicy is the model.
+- **Say how it was found.** Provenance is a grading input.
+- **Suggest a direction if you have one, marked as a suggestion.** The fix is
+  yours; the grade is ours.
+- **A note is fine.** If it would not change anyone's decision, it belongs in
+  `notes/` — see the floor in `docs/method/severity.md`.
+
+After filing: `make check`. Then this repo grades it.

findings/RISK-F-0001-flex-auth-unauthenticated-check.md

@@ -11,12 +11,24 @@ system: flex-auth
 environment: production
 fix_owner: flex-auth
 fix_tracking: FLEX-WP-0015-T02
-# The three fields below are risk-nexus's, not the reporter's. Left unset
-# deliberately: the reporter says what is true, this repo says how bad it is
-# and who hears about it (INTENT, "What it does not own").
-severity: unset
-disclosure: unset
-escalation: unset
+# Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md
+severity: critical
+severity_at_production: critical
+impact: I4
+likelihood: L3
+fidelity_modifier: false
+production_rescore: false
+disclosure: embargoed
+embargo_condition: "FLEX-WP-0015-T02 ships to production"
+embargo_since: "2026-08-19"
+embargo_review: "2026-08-26"
+escalation: required
+escalation_trigger: 1
+escalation_status: pending-operator
+last_reviewed: "2026-08-19"
+review_by: "2026-08-26"
+graded_by: risk-nexus
+ruling: RISK-RULING-2026-08-19
 ---
 
 # RISK-F-0001 — flex-auth authenticates no caller on the decision surface
@@ -101,3 +113,43 @@ All four were found the same way, by repos reading their own code against a
 ladder, within a day of each other. That is a fact about the estate's
 observability worth carrying into triage: **four live defects, none found by
 monitoring.**
+
+## Register ruling — 2026-08-19
+
+`critical` (`I4` × `L3`, no fidelity modifier), embargoed until
+`FLEX-WP-0015-T02` ships, **escalated** to the operator on trigger 1.
+
+The question this finding put — whether governing access to tenant data counts
+as exposing it — is answered **yes**. An authorization oracle that can be
+forged is not one step removed from the data; it is the step.
+
+Impact is `I4` because a forged allow does not stay here: it is the answer
+other services act on, and `tenant-engine` has stated what direct authority
+over its rows would mean. Likelihood is `L3` — the normal working set, inside
+the cluster, no additional step — and the register follows the reporter in
+neither assuming a default-deny NetworkPolicy nor assuming its absence.
+
+No fidelity modifier: this endpoint answers honestly about a caller it never
+checked. The false-record hazard lives in `RISK-F-0002`'s constraint, where a
+consumer of this endpoint would begin signing records asserting an
+authorization that was never made. **That constraint binds this finding's
+remediation**: `ops-warden`'s `policy.enabled` must not be turned on until
+`/v1/check` authenticates its callers, and the ordering is
+
+```
+flex-auth warn-only -> ops-warden gate presents its SA token -> logs clean
+                    -> flex-auth fail-closed -> ops-warden policy.enabled: true
+```
+
+Nothing further is asked of `flex-auth` beyond what they have committed to,
+except one fact only they can supply: **is there a default-deny NetworkPolicy
+in front of the Service?** It is the single fact that would most change this
+grade, and it is the first question at review.
+
+Reasoning: `docs/rulings/2026-08-19-first-grading.md`.
+
+## Reviews
+
+- **2026-08-19** — graded. Next review 2026-08-26 (`critical` → 7 days).
+  Open at review: the NetworkPolicy question; whether `FLEX-WP-0015-T02` has
+  moved; whether the embargo still holds.

findings/RISK-F-0002-ops-warden-sign-ungated.md

@@ -12,10 +12,27 @@ environment: production
 fix_owner: ops-warden
 fix_tracking: WARDEN-WP-0007 (gate shipped, disabled) / FLEX-WP-0007 (runtime deploy)
 related: [RISK-F-0001]
-# risk-nexus's to set, not the reporter's (INTENT, "What it does not own").
-severity: unset
-disclosure: unset
-escalation: unset
+# Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md
+severity: medium
+severity_at_production: medium
+impact: I3
+likelihood: L2
+fidelity_modifier: false
+production_rescore: false
+constraint_on: RISK-F-0001
+constraint_severity: high
+constraint: "policy.enabled must not be turned on while flex-auth /v1/check answers unauthenticated callers — the gate would sign a false attestation"
+disclosure: embargoed
+embargo_condition: "FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production"
+embargo_since: "2026-08-19"
+embargo_review: "2026-11-17"
+escalation: required
+escalation_trigger: 6
+escalation_status: pending-operator
+last_reviewed: "2026-08-19"
+review_by: "2026-11-17"
+graded_by: risk-nexus
+ruling: RISK-RULING-2026-08-19
 ---
 
 # RISK-F-0002 — the SSH signing gate is off, and turning it on is now the more dangerous move
@@ -120,3 +137,59 @@ the risk of a decision we had already made and filed away as merely blocked.
 The estate's habit of recording a blocker once and not revisiting it is the
 thing to watch. A blocker is a claim about the world at a date. `RISK-F-0001`
 invalidated this one in a day, and nothing would have re-checked it.
+
+## Register ruling — 2026-08-19
+
+All three questions this finding put are answered.
+
+**1. Severity — `medium` today, with a `high` constraint.** The headline
+scores the state of the world now: the gate is off, a missing control honestly
+represented. `I3` (SSH certificates into production hosts cross a trust
+boundary) × `L2` (scoped `VAULT_TOKEN`, actor in `inventory.yaml`, TTLs, every
+issuance logged — thin, but not nothing).
+
+The argument that the two states are not equally bad is **accepted in full**,
+and it is now written into the scale as the fidelity modifier: a control that
+lies is one impact band worse than the same control absent
+(`docs/method/severity.md`). It is recorded as a constraint rather than the
+headline because the register describes the estate as it is, and the dangerous
+state does not exist yet:
+
+> **Constraint, severity `high`.** Enabling `policy.enabled` while `/v1/check`
+> answers unauthenticated callers converts an absent control into a false
+> attestation — a genuine `allow` obtained by anyone with ClusterIP reach, and
+> a `policy_decision_id` in the signature log asserting the issuance was
+> authorized. `I3 + fidelity → I4`, `L2` → `high`.
+
+The constraint is attached to `RISK-F-0001`'s remediation and recorded on both
+findings. A reader must not take away `medium` and miss it.
+
+**2. Peer, not consequence.** Filed as `ops-warden` filed it. The fix owner
+differs and the "off" state has standing regardless of how `RISK-F-0001`
+resolves — if that finding were withdrawn tomorrow, production signing would
+still carry no per-request judgement. What is not independent is the ordering,
+and that travels as a constraint rather than by collapsing the two records.
+
+**3. Escalation — the register disagrees, narrowly.** On triggers 1-5 it
+agrees with `ops-warden`: no real tenant data, no obligation, no spend, no
+ownership dispute, no stall. But "it is written down in both repos" is the one
+argument the register cannot accept here, because this finding is itself the
+evidence against it: its own blocker was written down, filed, and invalidated
+in a day with nothing re-checking it.
+
+So trigger 6 — ordering hazard producing a false attestation — fires **once**.
+One acknowledgement that the operator holds the ordering, then the register
+carries it. Not a standing supervision request. That trigger exists in
+`docs/method/escalation.md` because of this finding.
+
+**The general point is adopted.** "A blocker is a claim about the world at a
+date" is now question 2 of every review in `docs/method/review.md`, and this
+finding is cited there as the case that bought it.
+
+Reasoning: `docs/rulings/2026-08-19-first-grading.md`.
+
+## Reviews
+
+- **2026-08-19** — graded. Next review 2026-11-17 (`medium` → 90 days).
+  Open at review: has `FLEX-WP-0007` or `WARDEN-WP-0007` moved; is the stated
+  blocker still true; does the ordering constraint still hold.

findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md

@@ -11,10 +11,22 @@ system: ops-warden
 environment: production
 fix_owner: ops-warden
 fix_tracking: WARDEN-WP-0032-T05
-# risk-nexus's fields, deliberately left unset by the reporter.
-severity: unset
-disclosure: unset
-escalation: unset
+# Graded by risk-nexus 2026-08-19 — docs/rulings/2026-08-19-first-grading.md
+severity: high
+severity_at_production: high
+impact: I4
+likelihood: L2
+fidelity_modifier: false
+production_rescore: false
+disclosure: embargoed
+embargo_condition: "the five exec_capable lanes graded under WARDEN-WP-0032-T05"
+embargo_since: "2026-08-19"
+embargo_review: "2026-09-18"
+escalation: none
+last_reviewed: "2026-08-19"
+review_by: "2026-09-18"
+graded_by: risk-nexus
+ruling: RISK-RULING-2026-08-19
 ---
 
 # RISK-F-0003 — the agent read-boundary has a fourteen-lane blind spot
@@ -122,3 +134,50 @@ OpenBao and owns three of the five lanes above, is `category: tooling`.
 - `wiki/playbooks/agent-read-boundary.md`
 - `RISK-F-0002` — ops-warden sign ungated (same system, different control)
 - `zone-engine` `ZONE-WP-0001-T02` — the work that surfaced this
+
+## Register ruling — 2026-08-19
+
+`high` (`I4` × `L2`), embargoed until the five `exec_capable` lanes are graded
+under `WARDEN-WP-0032-T05`, no escalation.
+
+**Graded on its worst lane.** Four of the five are `I3`-shaped — a publish
+token, an OIDC login, an ingestion key, a hub write token, each bad inside its
+own system. `openbao-api-key` is not: it reaches the store the estate's other
+secrets live in, and a disclosure there propagates past every boundary the
+others respect.
+
+**Likelihood `L2`** — an agent session with `WARDEN_AGENT_ID` is a foothold the
+estate does grant. The register holds the line this finding drew: the exposed
+population is not established, so it is neither assumed zero nor assumed large,
+and the unverified OpenBao `agent-high-risk-boundary` coverage is a review
+question rather than an assumption in either direction. Confirming that
+coverage for these five paths would lower the grade.
+
+**No fidelity modifier, and it was close.** `ADR-0004` reads categorical while
+the implementation is opt-in, so the documentation asserts a boundary that does
+not exist for 14 lanes. The modifier is scoped to attestations a system
+produces at runtime, and documentation drift is not that. But if any compliance
+evidence anywhere cites `ADR-0004` as implemented, that *is* a false
+attestation and a separate finding. This register has not looked, and says so
+rather than assuming.
+
+**No escalation.** Known, owned, tracked (`WARDEN-WP-0032-T05` for the five
+lanes, `WARDEN-WP-0032-T06` for the structural fix), and moving. Severity alone
+deliberately does not reach the operator.
+
+**On the maturity-context direction**, which is the operator's and not
+re-decided here: the note that `.repo-classification.yaml` `category` cannot
+carry the signal is confirmed from this repo's own registration work today.
+`railiance-platform` runs production OpenBao and owns three of the five lanes
+while classified `tooling`; `risk-nexus` classified itself with the same
+vocabulary an hour ago. The maturity ladder needs its own field, and that is
+`ZONE-WP-0001-T03`'s to build.
+
+Reasoning: `docs/rulings/2026-08-19-first-grading.md`.
+
+## Reviews
+
+- **2026-08-19** — graded. Next review 2026-09-18 (`high` → 30 days).
+  Open at review: OpenBao policy coverage of the five paths; whether
+  `WARDEN-WP-0032-T05` has landed; whether any compliance evidence cites
+  `ADR-0004` as implemented.