Missing capability, not a defect — same instrument that made the
noisy-neighbour characterisation a note. Records the requirement, the
three findings that already wait on it (F-0003 maturity default, F-0008
zone guarantees, F-0007 boundary verification scoping), and four consumer
needs, including that unknown must read as unknown rather than as a low
default — otherwise the facility repeats the defect F-0003 is about.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).
Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The reframe is that the un-erasable set grows daily, so the decision to
take now is whether to keep manufacturing records that could never be
erased while the legal question is settled. Suggests a keyed commitment
(HMAC or per-subject salt) as a cheaper hedge than encrypt-then-hash,
since the confirmation oracle exists only because the digest is over
cleartext with no secret in it. Not sent to audit-core: the hedge is an
engineering ask and waits on the operator.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Static comparison of ops-warden's catalog against the policy file: 8 high-risk
lanes with concrete KV paths are not denied, four of which were already graded
high before the 2026-08-19 regrade, so the divergence is pre-existing.
ops-warden's CLI layer only protects the ops-warden path; the OpenBao policy is
what protects a direct bao kv get, which is the actual 2026-07-16 vector.
Not confirmed against the live OpenBao — ops-warden's token is expired, so the
deployed policy may differ from the file. Stated as such.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The on-request path from the operator's RISK-F-0007 ruling is only useful
if the repos that would use it can find it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0007 moved to accepted and dropped out of the production-rescore
list, which contradicts what the finding itself says: an acceptance that
expires at the production transition has to be visible at that
transition. accepted is carried, not closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
F-0006: backup spend approved, no ceiling stated. Permission is no longer
the blocker; the embargo still needs a demonstrated restore.
F-0007: pragmatic default before production — accepted (not closed, keeps
its severity, review interval and production re-score, stays visible in
the register), with a written on-request path so a named consumer
boundary can be verified when someone asks. The acceptance expires at the
production transition, which is an event and not a date.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read the repo inbox after grading, which is the wrong order and is now
recorded as such. flex-auth had answered the NetworkPolicy question on
2026-08-18 (narrow ingress, not default-deny — L3 becomes L2, critical
becomes high) and reported RISK-F-0001 fixed at 12:35 today with live 401
probes. F-0001 closes fixed and public; its escalation is withdrawn
before it was ever sent. RISK-F-0002's ordering constraint lifts with it
and its trigger-6 escalation is withdrawn.
audit-core had routed the erasure-versus-audit legal question here on
2026-08-18 asking for an owner. RISK-N-0002 was wrong to call it a note:
the remedy is not retrofittable, so the decision can only be taken early.
Promoted to RISK-F-0008, owned by this repo as regulatory intake,
escalated on trigger 2.
Accepted rapp-postgres's record format and ops-warden's typed-act
escalation vocabulary. Reading the inbox is now question zero of every
review.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01, T02, T04-T08 done. T03 stays in progress: the escalation rule is
written and proposed, and it is not adopted until the custodian rules on
it — an unadopted rule is worse than an unwritten one because it looks
like coverage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Four in as findings — tenant-engine unfiltered event read (high),
audit-core read path bounded by a flag not by code (medium), apps-pg with
no backup at all (high, escalated on spend), and the unverified tenant
boundary itself (high now, critical at production, escalated on
ownership, fix_owner deliberately unset). Two out as notes — noisy
neighbours and erasure-versus-audit, both real, neither changing a
decision this month, both carrying an event to be re-read at.
The round amended the scale twice: build mode lowers impact as well as
likelihood, and non-adversarial findings get their own likelihood
reading. The escalation rule gained a ratio test that distinguishes a
first sweep from steady-state intake, and a batching rule.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Severity (impact x likelihood, fidelity modifier for controls that lie,
headline-vs-constraint, build-mode double grade, the floor), disclosure
(publish/embargoed/restricted, and the build-mode deferral re-taken and
narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers
settled plus an ordering-hazard trigger the RISK-F-0002 case forced;
proposed, awaiting the custodian), review (intervals, what a review is,
what missing one produces, the production re-score).
Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002
medium with a high constraint on RISK-F-0001's remediation, filed as a
peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no
escalation. No unset field remains.
REGISTER.md is generated; make check reports overdue, stalled, ungraded
and unanswered escalations without changing anything.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
work-record-types_v0.1 pins workplan ids to ^[A-Z]+-WP-[0-9]{4}$ and tasks
to that plus -TNN; a hyphenated RISK-NEXUS prefix trips the sidetrack
detector. RISK-WP also matches the register's existing RISK-F finding
prefix. Renamed before the workplan was indexed anywhere.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The three open findings all leave severity, disclosure and escalation
unset, correctly: those are this repo's to set and the instruments to set
them with do not exist yet. The workplan writes the severity scale, the
disclosure states (re-taking the deferral with RISK-F-0001 in hand), the
escalation rule INTENT.md says is unwritten, and the review/expiry rule —
then grades the three findings and rules on what is waiting outside the
register.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ADR-0004 reads as a categorical rule; the implementation is an opt-in list.
is_high_risk is risk == "high", and risk is optional — 14 of 27 catalog lanes
carry no value, so the boundary never fires for them. Five are exec_capable,
so warden access --fetch can stream a real value to an agent session.
Reported by ops-warden about ops-warden, found while partitioning the estate
for zone-engine's ZONE-WP-0001-T02. Severity, disclosure and escalation left
unset — those are risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routed by ops-warden, which owns the defect and is the affected PEP.
ops-warden ships a flex-auth pre-sign authorization gate and runs with
policy.enabled: false in production (warden.production.example.yaml:22,
policy.py:33). Every production warden sign proceeds with no authorization
decision; possession of the scoped VAULT_TOKEN is the whole model.
That was a known, boring availability blocker (FLEX-WP-0007) until yesterday.
RISK-F-0001 changes its shape: the production config points the gate at
flex-auth.flex-auth.svc.cluster.local:8080 — the exact ClusterIP surface that
authenticates no caller. Enabling the gate before RISK-F-0001 is fixed would
convert an absent control into a false attestation, writing a
policy_decision_id into the signature log for issuances an attacker authorized
by forging the oracle. An authorization check that can be forged is worse than
none, because only one of the two lies in the record afterwards.
severity, disclosure and escalation left unset — risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Controlled disclosure was deferred to production on the reasoning that build
mode has no users to expose. The first finding to arrive is a live
authorization bypass in the service every other service trusts, where the
choice today is publish or hold with nothing between. The deferral may still be
right; it is now a decision with a real case in hand.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
First finding, and it establishes the record format by being one. Kept minimal
on purpose - inventing a schema before there is a second finding to test it
against would be designing in the dark.
The substance: POST /v1/check and /v1/batch_check authenticate no caller, so
any workload with network reach can assert any subject and any tenant and
receive an authoritative allow from the estate's authorization oracle.
Self-reported by flex-auth during their Tenancy Posture review, and their own
note says they did not know they were carrying it.
Severity, disclosure and escalation are left unset. Per INTENT this repo owns
those and the reporter does not, and filling them in as the routing party would
collapse the separation on the first record.
Two things stated rather than assumed. Exposure depends on whether a
default-deny NetworkPolicy fronts the service; flex-auth did not say, and I did
not check, because that would be reporting on a system I do not own. And the
disclosure question is genuinely live here - build mode is public-by-default,
this is a live authorization bypass, and the controlled-disclosure mechanism
this repo anticipates does not exist yet, so the choice today is publish or
hold with nothing in between.
Three related defects from the same review round are recorded as visible but
not filed, since filing them was not asked for. All four were found by repos
reading their own code against a ladder within a day of each other, and none
was found by monitoring - which is itself a fact worth carrying into triage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Owned by the-custodian alongside policy-nexus, with the duty of deciding what
must reach the operator personally.
Three things had nowhere to live. Findings landed in whichever document
discovered them - the estate's largest known gap is currently open question 3
in an unratified draft, with no owner, severity or date. Disclosure had no
mechanism, only publish-now or forget, which is fine in build mode and wrong at
production. And regulation was researched at the moment it was needed and never
retained.
Regulatory intake moves here from policy-nexus T06: deciding what a rule
demands of us is a judgement about risk, not an act of publishing. That also
leaves policy-nexus doing one thing, which was the point.
Two constraints written in deliberately. This repo does not fix - findings
route to the repo owning the defect, because a risk service that fixes becomes
a second engineering team with no boundary. And it does not block delivery in
build mode; if that changes it will be a decision recorded here, not a habit
that accretes.
The escalation rule is named as unwritten rather than invented. Getting it
wrong in either direction fails: escalate everything and the operator becomes
the queue, escalate nothing and the register is where serious things go quiet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
