Operator ruled both. Findings publish as the file a reader gets —
including RISK-F-0001's record that this register graded it critical
while its fix notice sat unread. A summary would be a second document per
finding kept in sync by hand, and drift is the failure this repo most
distrusts; and a published register containing only other repos' defects
reads as an accusation, while one containing its own reads as a record.
Method docs public except escalation, which is restricted because it
names spend thresholds and describes when the operator personally is
interrupted — a map of where attention is scarce, needed by nobody
judging a finding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Written now rather than at the first lift, because publication arrives in
a trickle and a route improvised each time is one that eventually is not
taken. Also settles a T01 input: policy-nexus publishes a file from the
source repo, so whole-versus-summary is a question about what a finding
file contains, not about rendering.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Publication handover (two findings ready, three tasks, one of which is a
paragraph); regulatory intake as a working remit rather than one record,
carrying RISK-REG-0001's open items; and running the register, where
every task traces to something that actually went wrong in week one —
grading before reading the inbox, a status the tooling did not know, an
id collision, two gradings resting on file comparison because a token
expired, and an on-request path nobody has walked.
All three are status: proposed. The custodian decides which become active
and in what order.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
