RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading

Severity (impact x likelihood, fidelity modifier for controls that lie,
headline-vs-constraint, build-mode double grade, the floor), disclosure
(publish/embargoed/restricted, and the build-mode deferral re-taken and
narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers
settled plus an ordering-hazard trigger the RISK-F-0002 case forced;
proposed, awaiting the custodian), review (intervals, what a review is,
what missing one produces, the production re-score).

Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002
medium with a high constraint on RISK-F-0001's remediation, filed as a
peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no
escalation. No unset field remains.

REGISTER.md is generated; make check reports overdue, stalled, ungraded
and unanswered escalations without changing anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

findings/README.md

@@ -0,0 +1,46 @@
+# Filing a finding
+
+One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter,
+then prose. Next id is one past the highest here.
+
+## What the reporter fills in
+
+```yaml
+id: RISK-F-0004
+type: finding
+title: "one line, what is true — not what should be done"
+status: open                  # open | fixed | accepted | withdrawn
+reported_by: <repo>           # who found it
+reported_via: <repo>          # who routed it here, if different
+date_reported: "YYYY-MM-DD"
+system: <repo>                # the system the defect is in
+environment: production       # production | build | both
+fix_owner: <repo>             # who owns the fix — never risk-nexus
+fix_tracking: <WP-ID or unset>
+related: [RISK-F-0001]        # optional
+```
+
+## What risk-nexus fills in — leave these out
+
+`severity`, `severity_at_production`, `impact`, `likelihood`,
+`fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`,
+`escalation*`, `constraint*`, `last_reviewed`, `review_by`, `graded_by`,
+`ruling`.
+
+Setting them yourself is not an error to be corrected — it is a boundary this
+repo would rather keep. The reporter says what is true; this repo says how bad
+it is and who hears about it (`INTENT.md`). Leaving them out, or writing
+`unset`, both work; the nag reports either way until they are graded.
+
+## What makes a good finding here
+
+- **State exposure only as far as you can support it.** "Not established" is a
+  complete answer and grades better than a guess. `RISK-F-0001` declining to
+  assume a NetworkPolicy is the model.
+- **Say how it was found.** Provenance is a grading input.
+- **Suggest a direction if you have one, marked as a suggestion.** The fix is
+  yours; the grade is ours.
+- **A note is fine.** If it would not change anyone's decision, it belongs in
+  `notes/` — see the floor in `docs/method/severity.md`.
+
+After filing: `make check`. Then this repo grades it.