coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RISK-F-0003: record the maturity-derived fix direction and set fix_tracking

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 23:24:34 +02:00
parent e8ee138ad2
commit e268259f94
2 changed files with 28 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
WORK-RECORDS.md
View file

@ -8,12 +8,12 @@
| Kind | ID | Status | Lane | Source | | Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- | | --- | --- | --- | --- | --- |
| workplan | RISK-NEXUS-WP-0001 | active | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | workplan | RISK-WP-0001 | active | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T01 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T01 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T02 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T02 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T03 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T03 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T04 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T04 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T05 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T05 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T06 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T06 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T07 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T07 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |
| task | RISK-NEXUS-WP-0001-T08 | todo | — | workplans/RISK-NEXUS-WP-0001-make-the-register-decidable.md | | task | RISK-WP-0001-T08 | todo | — | workplans/RISK-WP-0001-make-the-register-decidable.md |

20
findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md
View file

@ -10,7 +10,7 @@ date_reported: "2026-08-19"
system: ops-warden system: ops-warden
environment: production environment: production
fix_owner: ops-warden fix_owner: ops-warden
fix_tracking: unset fix_tracking: WARDEN-WP-0032-T05
# risk-nexus's fields, deliberately left unset by the reporter. # risk-nexus's fields, deliberately left unset by the reporter.
severity: unset severity: unset
disclosure: unset disclosure: unset
@ -97,6 +97,24 @@ Two candidate fixes, both ops-warden's to choose between:
Either way the grading is real work with real judgement in it, and the five Either way the grading is real work with real judgement in it, and the five
`exec_capable` lanes are the ones that matter first. `exec_capable` lanes are the ones that matter first.
**Update 2026-08-19 — a third direction, and the one being taken.** The operator
has directed that the default derive from **maturity context**: in an early or
experimental context an absent grade is tolerable and explicitly accepted; in a
production context an absent grade resolves to `high`, or `critical` where the
context is critical. This validates against the data here — all five exposed
lanes are owned by production-serving components, so the rule would have caught
every one.
The durable form of that is a zone-model question (`ZONE-WP-0001-T03`), because
the `M0`-`M3` maturity ladder that would drive it has no join to catalog lanes
today. That work is months out, so the two are being run separately: the five
lanes are graded explicitly now under `WARDEN-WP-0032-T05`, and the structural
fix that makes absence impossible follows under `WARDEN-WP-0032-T06`.
Note for whoever sets severity: `.repo-classification.yaml` `category` is **not**
usable as the maturity signal. `railiance-platform`, which runs production
OpenBao and owns three of the five lanes above, is `category: tooling`.
## Related ## Related
- ops-warden `ADR-0004` — high-risk lanes refuse raw value streaming - ops-warden `ADR-0004` — high-risk lanes refuse raw value streaming