Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).
The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.
record_check.py now handles regulatory records as well as findings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
record_check.py moves a finding along the cadence ladder and writes the
dated line into the finding at the same time — a check that is not
written down did not happen, which is the rule the register applies to
everyone else. make checked ARGS="RISK-F-0002 clean".
make check now also reports duplicate finding ids. The RISK-F-0004
collision was resolved by hand yesterday; the next one gets caught by the
tooling instead of by someone noticing a file listed twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
