The triggers survive as what ends the acceptance rather than as what
starts a purchase. Accepted is not closed — it keeps its cadence, and
audit-core's two questions stay open under it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruled both. Findings publish as the file a reader gets —
including RISK-F-0001's record that this register graded it critical
while its fix notice sat unread. A summary would be a second document per
finding kept in sync by hand, and drift is the failure this repo most
distrusts; and a published register containing only other repos' defects
reads as an accusation, while one containing its own reads as a record.
Method docs public except escalation, which is restricted because it
names spend thresholds and describes when the operator personally is
interrupted — a map of where attention is scarce, needed by nobody
judging a finding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The register had nine waits in four days, one four hops deep: F-0003's
embargo waited on F-0009, which waited on railiance-platform, which
waited on live OpenBao verification, which waited on a credential nobody
has. No single link was wrong, which is why it needed a rule.
docs/method/dependencies.md: the register never waits to decide, it
decides and revises. Every wait carries who, what, since, what it would
change, what happens if nobody answers, and the date that default
applies. Depth one — a record never waits on a record that is itself
waiting. Defaults are dates and are pessimistic: silence costs the grade
the evidence supports rather than buying a softer one, and owners are
told the default in advance because a default nobody was warned about is
an ambush.
Applied: F-0009's embargo now lifts on railiance-platform reporting
coverage, with live verification as a refinement rather than a condition,
cutting the F-0003 chain from four hops to two. All eight open waits are
typed with defaults. make check reports them with age, owner and default
date, flags defaults come due, and catches depth-two violations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).
The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.
record_check.py now handles regulatory records as well as findings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.
The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.
Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).
Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The reframe is that the un-erasable set grows daily, so the decision to
take now is whether to keep manufacturing records that could never be
erased while the legal question is settled. Suggests a keyed commitment
(HMAC or per-subject salt) as a cheaper hedge than encrypt-then-hash,
since the confirmation oracle exists only because the digest is over
cleartext with no secret in it. Not sent to audit-core: the hedge is an
engineering ask and waits on the operator.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read the repo inbox after grading, which is the wrong order and is now
recorded as such. flex-auth had answered the NetworkPolicy question on
2026-08-18 (narrow ingress, not default-deny — L3 becomes L2, critical
becomes high) and reported RISK-F-0001 fixed at 12:35 today with live 401
probes. F-0001 closes fixed and public; its escalation is withdrawn
before it was ever sent. RISK-F-0002's ordering constraint lifts with it
and its trigger-6 escalation is withdrawn.
audit-core had routed the erasure-versus-audit legal question here on
2026-08-18 asking for an owner. RISK-N-0002 was wrong to call it a note:
the remedy is not retrofittable, so the decision can only be taken early.
Promoted to RISK-F-0008, owned by this repo as regulatory intake,
escalated on trigger 2.
Accepted rapp-postgres's record format and ops-warden's typed-act
escalation vocabulary. Reading the inbox is now question zero of every
review.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
