Updated by fix-consistency on 2026-08-25:
- update .custodian-brief.md for risk-nexus
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
RISK-F-0002's fix_tracking now names ZONE-WP-0001 / WARDEN-WP-0032, with
the superseded pair kept beside it — the register had told ops-warden the
path had changed and then left the old ids in the file.
An unresolvable fix_tracking (TEN-IN-0002 is an intake, not a workplan)
printed nothing at all, which reads identically to a finding with no
tracking. It now says so by name. Both ZONE-WP-0001 and WARDEN-WP-0032
read proposed, which is the true state of the successor.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0006 fixed and public — railiance-platform's restore evidence was
read, not taken: 56s restore, all 13 coulomb_social row counts matching,
plus the BestEffort QoS this register had graded on, plus a failed first
WAL attempt recorded alongside the successful one.
RISK-F-0004 high -> medium. tenant-engine corrected in both directions:
payloads are returned (worse than graded) but there is no HTTP event-read
route, so the live network-reachable read this register wrote down does
not exist. L3 was a reachability claim inherited from a summary and never
tested.
RISK-F-0002: reading (c) confirmed — nothing blocks policy.enabled, it is
off by decision. ADR-0006 retires it in favour of zone-scoped
enforcement. Ruled: the framing is superseded, the risk is not. A control
retired before its replacement exists is still an absent control. The
successor's blocker is 26 of 27 lanes having no identifiable workload,
which is RISK-N-0004 with a number on it.
RISK-F-0009: uncovered count 8 -> 6, corrected by the reporter against
themselves; the token was never expired; and the deployed policy differs
from the file, which moves 'a file is not a safe proxy for the server'
from suspicion to evidence and amends verification.md — including the
admission that fix_tracker.py reads records, and a record can be stale.
RISK-V-0001 reconciled: ops-warden reaches the pin from the node through
a tunnel, so a podSelector ingress rule does not constrain it. The
observation was right and the inference was not.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T02: docs/method/intake.md names all four sources INTENT claims and
builds the two that had none. An incident files first and grades within
the hour, carries first_observed because obligations run from it, sits at
instant until it is over, and escalates immediately rather than batched —
a 72-hour notification clock outranks the rule that protects the
operator's attention. External report has no address anywhere in the
estate, and where one lives is policy-nexus's and the custodian's, so it
is routed with a proposal rather than invented here.
T03: the production transition defined by what is held rather than what
was announced — the first moment any system holds real external data,
which can happen by accident and cannot be reversed. Declared by the
custodian; noticed and asked about by this register. Lists what fires:
five re-scores, two acceptances ending, six policies activating.
T04: the README no longer claims a surface this repo does not have.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fix_tracker.py resolves fix_tracking against the owning repo's workplan
file — the ADR-001 source of truth — and uses the file's last commit date
as the honest answer to 'has this moved', independent of whether the
register looked. Archived workplans are searched too, so a finished fix
that was filed away does not read as missing.
First run, three findings it should have known about:
RISK-F-0005 — AUDIT-WP-0008-T04 has read done since 2026-08-18. The fix
this finding asked for has landed and the register spent three days not
knowing. Now mitigated, embargo lifted, disclosure public. Not fixed:
that needs a probe, and T05's adversarial evidence artifact still reads
wait.
RISK-F-0002 — both tracked records were closed before the finding was
filed: WARDEN-WP-0007 archived 2026-07-08, FLEX-WP-0007 finished
2026-06-29, against a finding of 2026-08-18 that names FLEX-WP-0007 as
the blocker. Routed as a question, not a conclusion.
Four findings carry no fix tracking at all, which the report now says out
loud rather than leaving as an empty field.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
history/2026-08-21-intent-gap-analysis.md follows the estate's history
convention. RISK-WP-0005 carries the seven gaps, ordered so the one place
the register misreports goes first: fix_tracking is a string nobody
reads, so a stalled fix and a silent owner are currently the same thing.
The two INTENT claims with no implementation at all — incident intake and
external report — are T02. STATE.md now says both of those out loud
rather than leaving them to the assessment.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 'a regulation that applies was found before it was needed' test is
not met and cannot be retro-fitted: the policy set found two obligations
already live, the e-invoicing one by about nineteen months. The catalogue
makes the test passable going forward; it does not make that instance a
pass.
Also: remediation tracking does not track — fix_tracking is a string
nobody reads, so an owner who goes quiet and a fix that goes quiet look
identical; there is no intake path for incidents or external reports, so
the register is a self-assessment aggregator rather than what INTENT
claims; and no coverage model, so a system with zero findings is
indistinguishable from one nobody assessed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ops-warden filed this static, saying its OpenBao token was expired. It was not --
bao policy read succeeded, so the deployed policy has now been compared directly.
Coverage confirmed at 6 of 17. But the uncovered count was wrong: eight included
a path pattern and a broker grant, neither of which a policy can deny, and the
finding's own prose already said so about the first. Six stand.
New: the deployed policy differs from the file in railiance-platform -- the file
denies core-hub/runtime, the server does not. No ops-warden lane maps there, so
the numbers are unchanged. It matters because this finding named "the deployed
policy may differ from the file" as unconfirmed, and it does.
Severity, disclosure and embargo left untouched -- risk-nexus's to set. The
embargo condition is a coverage report from railiance-platform, which this does
not satisfy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Escalation rule adopted as written. RISK-F-0008 accepted with the legal
policy set as the compensating control. Canon kinds packet sent to
the-custodian, with note offered lifecycle-free and verifications
deliberately withheld as an unsettled species.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The triggers survive as what ends the acceptance rather than as what
starts a purchase. Accepted is not closed — it keeps its cadence, and
audit-core's two questions stay open under it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruling: no external determination in build mode, but keep the
set of legal policies for reuse when a work context needs one in place.
docs/regulatory/policies/ catalogues thirteen, keyed by activation
condition rather than by regime, with a retrieval table so a context
pulls a slice: first real user account pulls six of them; a
consumer-facing product in Germany pulls those plus accessibility. Two
are already active and nobody had noticed — commercial and tax retention,
and the e-invoicing receiving obligation that has been live since 2025
with no named owner in the estate. Four written in full; the rest carry
their trigger now and get their text when a context approaches, which is
the point.
RISK-POL-0011 is the argument for the whole catalogue: accessibility
cannot be retrofitted cheaply, so a policy retrieved at launch is a
rebuild while one read at design time is just a constraint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adopting a rule is nobody's finding; neither is registering a canon kind
or publishing a document. Each obligation that lived outside the
mechanism was invisible to it. RISK-WP-0001 now carries both of its
custodian waits, and the escalation-rule one has the register's most
uncomfortable default pointed inward: unadopted by 2026-09-17 means
recorded as de facto in force but unratified, said on the face of every
escalation sent under it. A draft that quietly governs is exactly what
this register exists to notice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Workplan status blocked rather than active: the only remaining task is a
custodian decision, and calling that 'active' would be the register
claiming progress it is not making.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T02 applies the dependency rule to this repo's own work: rather than wait
on audit-core's co-residency horizon, RISK-REG-0001 now states target
periods per category with the reasoning — 12 months for operator and
agent security records, 3 years to year-end for counterparty transaction
evidence, 8 years for accounting vouchers (shortened by BEG IV, flagged
as worth confirming), 10 years for books, 6 for commercial letters,
delete for anything with no ground. Targets, not achievements: the estate
cannot demonstrate any of them while the real horizon is the maximum
across every co-resident on platform-pg, and that gap is stated so the
table cannot be read as a compliance claim.
T03 writes the intake route from what audit-core did correctly without
one: the question as a question, what already depends on it, what becomes
expensive if the answer is no, and what you are not asking for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0001 is fixed and still owes a publication entry; it fell out of
the waiting list because that list was built from watched findings only.
A closed record with an open obligation is exactly the thing that goes
quiet, since nothing prompts anyone to look at it any more.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
policy-nexus owes entries; if none arrive by 2026-09-17 the findings sit
as disclosure: public with no address, which this register records as a
claim rather than a publication. Same rule we apply to everyone else.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruled both. Findings publish as the file a reader gets —
including RISK-F-0001's record that this register graded it critical
while its fix notice sat unread. A summary would be a second document per
finding kept in sync by hand, and drift is the failure this repo most
distrusts; and a published register containing only other repos' defects
reads as an accusation, while one containing its own reads as a record.
Method docs public except escalation, which is restricted because it
names spend thresholds and describes when the operator personally is
interrupted — a map of where attention is scarce, needed by nobody
judging a finding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Written now rather than at the first lift, because publication arrives in
a trickle and a route improvised each time is one that eventually is not
taken. Also settles a T01 input: policy-nexus publishes a file from the
source repo, so whole-versus-summary is a question about what a finding
file contains, not about rendering.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The register had nine waits in four days, one four hops deep: F-0003's
embargo waited on F-0009, which waited on railiance-platform, which
waited on live OpenBao verification, which waited on a credential nobody
has. No single link was wrong, which is why it needed a rule.
docs/method/dependencies.md: the register never waits to decide, it
decides and revises. Every wait carries who, what, since, what it would
change, what happens if nobody answers, and the date that default
applies. Depth one — a record never waits on a record that is itself
waiting. Defaults are dates and are pessimistic: silence costs the grade
the evidence supports rather than buying a softer one, and owners are
told the default in advance because a default nobody was warned about is
an ambush.
Applied: F-0009's embargo now lifts on railiance-platform reporting
coverage, with live verification as a refinement rather than a condition,
cutting the F-0003 chain from four hops to two. All eight open waits are
typed with defaults. make check reports them with age, owner and default
date, flags defaults come due, and catches depth-two violations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).
The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.
record_check.py now handles regulatory records as well as findings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
activity-core corrected us: it governs Temporal schedule overlap, not
per-message suppression, and there is no dedupe at the sink — so an
unread message re-emits hourly until read. Removed the field rather than
leave it implying a guarantee it does not give, and kept the repetition
deliberately: an hourly line in the progress log is a cheap price for the
failure this exists to prevent, and it stops when somebody reads.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit shipped the activity definitions but a script error
left the workplan file unedited, so the task states are recorded here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two activity definitions, in the shape activity-core's own definitions
use. hourly-register-inbox-watch fires only when an unread message waits
for risk-nexus — the inbox is the trigger rather than the clock, because
an unread message is by construction a claim that something may have
moved, and 2026-08-19 proved the register will otherwise grade without
looking. daily-register-check-sweep is the unconditional floor at 07:15.
Both emit an instruction to a session that can exercise judgement, and
both say in their own text that they must never grow the ability to
record an outcome: stamping clean without doing the five questions
produces a 1q rung that is a lie about stability.
RISK-WP-0004 is finished.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T02 inbox check, wired into make check and verified against the actual
2026-08-19 failure — replayed at that moment it surfaces all three
messages that were already waiting. T03 sweeps the rest of the
quietly-tolerated class: bad dates, cadence off the ladder, undefined
disclosure states, dangling constraint_on and related refs, embargoes
without conditions, escalations without triggers. T04 requests
verification of user-engine's tenant boundary — the first walk down the
on-request path, chosen as a consumer not already known to fail it. T05
established by trying what this register can verify: cluster yes, OpenBao
403. T06 puts regulatory records on the findings ladder.
T01 stays in progress: the procedure, make due and make checked exist,
but arming something that runs them on schedule is a standing compute
commitment and the operator's to make.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cluster reads work from this host; OpenBao returns 403, the same wall
ops-warden hit. So the register can check what the cluster admits and
cannot check what the secret store permits, and every grade touching an
OpenBao policy is a grade on a document. That asymmetry is recorded
rather than closed: a risk register holding production secret-store
access would have traded a verification problem for a worse one.
RISK-V-0001 is the first verification. It confirms RISK-F-0001's ingress
claim against the live cluster — the first grade here standing on
evidence this repo gathered — contradicts the 'egress: []' claim, which
live shows as 443/6443 to anywhere, and surfaces a third policy created
the day of the fix whose Ingress policyType carries no rules, which bears
on whether enabling ops-warden's gate would fail closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
'security' warned as an unrecognised family tag; risk, governance,
compliance and audit are the canonical ones and are closer to what this
repo does anyway — it holds risk and judges compliance, it does not
build security.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Publication handover (two findings ready, three tasks, one of which is a
paragraph); regulatory intake as a working remit rather than one record,
carrying RISK-REG-0001's open items; and running the register, where
every task traces to something that actually went wrong in week one —
grading before reading the inbox, a status the tooling did not know, an
id collision, two gradings resting on file comparison because a token
expired, and an on-request path nobody has walked.
All three are status: proposed. The custodian decides which become active
and in what order.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
record_check.py moves a finding along the cadence ladder and writes the
dated line into the finding at the same time — a check that is not
written down did not happen, which is the rule the register applies to
everyone else. make checked ARGS="RISK-F-0002 clean".
make check now also reports duplicate finding ids. The RISK-F-0004
collision was resolved by hand yesterday; the next one gets caught by the
tooling instead of by someone noticing a file listed twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.
The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.
Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The outstanding half of RISK-F-0008 that needed no authorisation. Grounds
stated per category rather than as a blanket exemption: Art 6(1)(f) with
Art 32 for operator and agent records, Art 17(3)(e) for counterparty
transaction evidence, Art 17(3)(b) only where a commercial or tax duty
independently applies. The weak part is named as duration rather than
existence, and audit-core's co-residency horizon is identified as the
most likely point of failure in the whole position. Not legal advice, and
the record says so.
Also opens docs/regulatory/ with the record format — dated, sourced, and
reviewed, because a regulatory answer expires.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Missing capability, not a defect — same instrument that made the
noisy-neighbour characterisation a note. Records the requirement, the
three findings that already wait on it (F-0003 maturity default, F-0008
zone guarantees, F-0007 boundary verification scoping), and four consumer
needs, including that unknown must read as unknown rather than as a low
default — otherwise the facility repeats the defect F-0003 is about.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).
Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The reframe is that the un-erasable set grows daily, so the decision to
take now is whether to keep manufacturing records that could never be
erased while the legal question is settled. Suggests a keyed commitment
(HMAC or per-subject salt) as a cheaper hedge than encrypt-then-hash,
since the confirmation oracle exists only because the digest is over
cleartext with no secret in it. Not sent to audit-core: the hedge is an
engineering ask and waits on the operator.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Static comparison of ops-warden's catalog against the policy file: 8 high-risk
lanes with concrete KV paths are not denied, four of which were already graded
high before the 2026-08-19 regrade, so the divergence is pre-existing.
ops-warden's CLI layer only protects the ops-warden path; the OpenBao policy is
what protects a direct bao kv get, which is the actual 2026-07-16 vector.
Not confirmed against the live OpenBao — ops-warden's token is expired, so the
deployed policy may differ from the file. Stated as such.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The on-request path from the operator's RISK-F-0007 ruling is only useful
if the repos that would use it can find it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0007 moved to accepted and dropped out of the production-rescore
list, which contradicts what the finding itself says: an acceptance that
expires at the production transition has to be visible at that
transition. accepted is carried, not closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
