T02 applies the dependency rule to this repo's own work: rather than wait
on audit-core's co-residency horizon, RISK-REG-0001 now states target
periods per category with the reasoning — 12 months for operator and
agent security records, 3 years to year-end for counterparty transaction
evidence, 8 years for accounting vouchers (shortened by BEG IV, flagged
as worth confirming), 10 years for books, 6 for commercial letters,
delete for anything with no ground. Targets, not achievements: the estate
cannot demonstrate any of them while the real horizon is the maximum
across every co-resident on platform-pg, and that gap is stated so the
table cannot be read as a compliance claim.
T03 writes the intake route from what audit-core did correctly without
one: the question as a question, what already depends on it, what becomes
expensive if the answer is no, and what you are not asking for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0001 is fixed and still owes a publication entry; it fell out of
the waiting list because that list was built from watched findings only.
A closed record with an open obligation is exactly the thing that goes
quiet, since nothing prompts anyone to look at it any more.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
policy-nexus owes entries; if none arrive by 2026-09-17 the findings sit
as disclosure: public with no address, which this register records as a
claim rather than a publication. Same rule we apply to everyone else.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruled both. Findings publish as the file a reader gets —
including RISK-F-0001's record that this register graded it critical
while its fix notice sat unread. A summary would be a second document per
finding kept in sync by hand, and drift is the failure this repo most
distrusts; and a published register containing only other repos' defects
reads as an accusation, while one containing its own reads as a record.
Method docs public except escalation, which is restricted because it
names spend thresholds and describes when the operator personally is
interrupted — a map of where attention is scarce, needed by nobody
judging a finding.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Written now rather than at the first lift, because publication arrives in
a trickle and a route improvised each time is one that eventually is not
taken. Also settles a T01 input: policy-nexus publishes a file from the
source repo, so whole-versus-summary is a question about what a finding
file contains, not about rendering.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The register had nine waits in four days, one four hops deep: F-0003's
embargo waited on F-0009, which waited on railiance-platform, which
waited on live OpenBao verification, which waited on a credential nobody
has. No single link was wrong, which is why it needed a rule.
docs/method/dependencies.md: the register never waits to decide, it
decides and revises. Every wait carries who, what, since, what it would
change, what happens if nobody answers, and the date that default
applies. Depth one — a record never waits on a record that is itself
waiting. Defaults are dates and are pessimistic: silence costs the grade
the evidence supports rather than buying a softer one, and owners are
told the default in advance because a default nobody was warned about is
an ambush.
Applied: F-0009's embargo now lifts on railiance-platform reporting
coverage, with live verification as a refinement rather than a condition,
cutting the F-0003 chain from four hops to two. All eight open waits are
typed with defaults. make check reports them with age, owner and default
date, flags defaults come due, and catches depth-two violations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).
The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.
record_check.py now handles regulatory records as well as findings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
activity-core corrected us: it governs Temporal schedule overlap, not
per-message suppression, and there is no dedupe at the sink — so an
unread message re-emits hourly until read. Removed the field rather than
leave it implying a guarantee it does not give, and kept the repetition
deliberately: an hourly line in the progress log is a cheap price for the
failure this exists to prevent, and it stops when somebody reads.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit shipped the activity definitions but a script error
left the workplan file unedited, so the task states are recorded here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two activity definitions, in the shape activity-core's own definitions
use. hourly-register-inbox-watch fires only when an unread message waits
for risk-nexus — the inbox is the trigger rather than the clock, because
an unread message is by construction a claim that something may have
moved, and 2026-08-19 proved the register will otherwise grade without
looking. daily-register-check-sweep is the unconditional floor at 07:15.
Both emit an instruction to a session that can exercise judgement, and
both say in their own text that they must never grow the ability to
record an outcome: stamping clean without doing the five questions
produces a 1q rung that is a lie about stability.
RISK-WP-0004 is finished.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T02 inbox check, wired into make check and verified against the actual
2026-08-19 failure — replayed at that moment it surfaces all three
messages that were already waiting. T03 sweeps the rest of the
quietly-tolerated class: bad dates, cadence off the ladder, undefined
disclosure states, dangling constraint_on and related refs, embargoes
without conditions, escalations without triggers. T04 requests
verification of user-engine's tenant boundary — the first walk down the
on-request path, chosen as a consumer not already known to fail it. T05
established by trying what this register can verify: cluster yes, OpenBao
403. T06 puts regulatory records on the findings ladder.
T01 stays in progress: the procedure, make due and make checked exist,
but arming something that runs them on schedule is a standing compute
commitment and the operator's to make.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cluster reads work from this host; OpenBao returns 403, the same wall
ops-warden hit. So the register can check what the cluster admits and
cannot check what the secret store permits, and every grade touching an
OpenBao policy is a grade on a document. That asymmetry is recorded
rather than closed: a risk register holding production secret-store
access would have traded a verification problem for a worse one.
RISK-V-0001 is the first verification. It confirms RISK-F-0001's ingress
claim against the live cluster — the first grade here standing on
evidence this repo gathered — contradicts the 'egress: []' claim, which
live shows as 443/6443 to anywhere, and surfaces a third policy created
the day of the fix whose Ingress policyType carries no rules, which bears
on whether enabling ops-warden's gate would fail closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
'security' warned as an unrecognised family tag; risk, governance,
compliance and audit are the canonical ones and are closer to what this
repo does anyway — it holds risk and judges compliance, it does not
build security.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Publication handover (two findings ready, three tasks, one of which is a
paragraph); regulatory intake as a working remit rather than one record,
carrying RISK-REG-0001's open items; and running the register, where
every task traces to something that actually went wrong in week one —
grading before reading the inbox, a status the tooling did not know, an
id collision, two gradings resting on file comparison because a token
expired, and an on-request path nobody has walked.
All three are status: proposed. The custodian decides which become active
and in what order.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
record_check.py moves a finding along the cadence ladder and writes the
dated line into the finding at the same time — a check that is not
written down did not happen, which is the rule the register applies to
everyone else. make checked ARGS="RISK-F-0002 clean".
make check now also reports duplicate finding ids. The RISK-F-0004
collision was resolved by hand yesterday; the next one gets caught by the
tooling instead of by someone noticing a file listed twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.
The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.
Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The outstanding half of RISK-F-0008 that needed no authorisation. Grounds
stated per category rather than as a blanket exemption: Art 6(1)(f) with
Art 32 for operator and agent records, Art 17(3)(e) for counterparty
transaction evidence, Art 17(3)(b) only where a commercial or tax duty
independently applies. The weak part is named as duration rather than
existence, and audit-core's co-residency horizon is identified as the
most likely point of failure in the whole position. Not legal advice, and
the record says so.
Also opens docs/regulatory/ with the record format — dated, sourced, and
reviewed, because a regulatory answer expires.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Missing capability, not a defect — same instrument that made the
noisy-neighbour characterisation a note. Records the requirement, the
three findings that already wait on it (F-0003 maturity default, F-0008
zone guarantees, F-0007 boundary verification scoping), and four consumer
needs, including that unknown must read as unknown rather than as a low
default — otherwise the facility repeats the defect F-0003 is about.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).
Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The reframe is that the un-erasable set grows daily, so the decision to
take now is whether to keep manufacturing records that could never be
erased while the legal question is settled. Suggests a keyed commitment
(HMAC or per-subject salt) as a cheaper hedge than encrypt-then-hash,
since the confirmation oracle exists only because the digest is over
cleartext with no secret in it. Not sent to audit-core: the hedge is an
engineering ask and waits on the operator.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Static comparison of ops-warden's catalog against the policy file: 8 high-risk
lanes with concrete KV paths are not denied, four of which were already graded
high before the 2026-08-19 regrade, so the divergence is pre-existing.
ops-warden's CLI layer only protects the ops-warden path; the OpenBao policy is
what protects a direct bao kv get, which is the actual 2026-07-16 vector.
Not confirmed against the live OpenBao — ops-warden's token is expired, so the
deployed policy may differ from the file. Stated as such.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The on-request path from the operator's RISK-F-0007 ruling is only useful
if the repos that would use it can find it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RISK-F-0007 moved to accepted and dropped out of the production-rescore
list, which contradicts what the finding itself says: an acceptance that
expires at the production transition has to be visible at that
transition. accepted is carried, not closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
F-0006: backup spend approved, no ceiling stated. Permission is no longer
the blocker; the embargo still needs a demonstrated restore.
F-0007: pragmatic default before production — accepted (not closed, keeps
its severity, review interval and production re-score, stays visible in
the register), with a written on-request path so a named consumer
boundary can be verified when someone asks. The acceptance expires at the
production transition, which is an event and not a date.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read the repo inbox after grading, which is the wrong order and is now
recorded as such. flex-auth had answered the NetworkPolicy question on
2026-08-18 (narrow ingress, not default-deny — L3 becomes L2, critical
becomes high) and reported RISK-F-0001 fixed at 12:35 today with live 401
probes. F-0001 closes fixed and public; its escalation is withdrawn
before it was ever sent. RISK-F-0002's ordering constraint lifts with it
and its trigger-6 escalation is withdrawn.
audit-core had routed the erasure-versus-audit legal question here on
2026-08-18 asking for an owner. RISK-N-0002 was wrong to call it a note:
the remedy is not retrofittable, so the decision can only be taken early.
Promoted to RISK-F-0008, owned by this repo as regulatory intake,
escalated on trigger 2.
Accepted rapp-postgres's record format and ops-warden's typed-act
escalation vocabulary. Reading the inbox is now question zero of every
review.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01, T02, T04-T08 done. T03 stays in progress: the escalation rule is
written and proposed, and it is not adopted until the custodian rules on
it — an unadopted rule is worse than an unwritten one because it looks
like coverage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Four in as findings — tenant-engine unfiltered event read (high),
audit-core read path bounded by a flag not by code (medium), apps-pg with
no backup at all (high, escalated on spend), and the unverified tenant
boundary itself (high now, critical at production, escalated on
ownership, fix_owner deliberately unset). Two out as notes — noisy
neighbours and erasure-versus-audit, both real, neither changing a
decision this month, both carrying an event to be re-read at.
The round amended the scale twice: build mode lowers impact as well as
likelihood, and non-adversarial findings get their own likelihood
reading. The escalation rule gained a ratio test that distinguishes a
first sweep from steady-state intake, and a batching rule.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Severity (impact x likelihood, fidelity modifier for controls that lie,
headline-vs-constraint, build-mode double grade, the floor), disclosure
(publish/embargoed/restricted, and the build-mode deferral re-taken and
narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers
settled plus an ordering-hazard trigger the RISK-F-0002 case forced;
proposed, awaiting the custodian), review (intervals, what a review is,
what missing one produces, the production re-score).
Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002
medium with a high constraint on RISK-F-0001's remediation, filed as a
peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no
escalation. No unset field remains.
REGISTER.md is generated; make check reports overdue, stalled, ungraded
and unanswered escalations without changing anything.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
work-record-types_v0.1 pins workplan ids to ^[A-Z]+-WP-[0-9]{4}$ and tasks
to that plus -TNN; a hyphenated RISK-NEXUS prefix trips the sidetrack
detector. RISK-WP also matches the register's existing RISK-F finding
prefix. Renamed before the workplan was indexed anywhere.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The three open findings all leave severity, disclosure and escalation
unset, correctly: those are this repo's to set and the instruments to set
them with do not exist yet. The workplan writes the severity scale, the
disclosure states (re-taking the deferral with RISK-F-0001 in hand), the
escalation rule INTENT.md says is unwritten, and the review/expiry rule —
then grades the three findings and rules on what is waiting outside the
register.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ADR-0004 reads as a categorical rule; the implementation is an opt-in list.
is_high_risk is risk == "high", and risk is optional — 14 of 27 catalog lanes
carry no value, so the boundary never fires for them. Five are exec_capable,
so warden access --fetch can stream a real value to an agent session.
Reported by ops-warden about ops-warden, found while partitioning the estate
for zone-engine's ZONE-WP-0001-T02. Severity, disclosure and escalation left
unset — those are risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routed by ops-warden, which owns the defect and is the affected PEP.
ops-warden ships a flex-auth pre-sign authorization gate and runs with
policy.enabled: false in production (warden.production.example.yaml:22,
policy.py:33). Every production warden sign proceeds with no authorization
decision; possession of the scoped VAULT_TOKEN is the whole model.
That was a known, boring availability blocker (FLEX-WP-0007) until yesterday.
RISK-F-0001 changes its shape: the production config points the gate at
flex-auth.flex-auth.svc.cluster.local:8080 — the exact ClusterIP surface that
authenticates no caller. Enabling the gate before RISK-F-0001 is fixed would
convert an absent control into a false attestation, writing a
policy_decision_id into the signature log for issuances an attacker authorized
by forging the oracle. An authorization check that can be forged is worse than
none, because only one of the two lies in the record afterwards.
severity, disclosure and escalation left unset — risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Controlled disclosure was deferred to production on the reasoning that build
mode has no users to expose. The first finding to arrive is a live
authorization bypass in the service every other service trusts, where the
choice today is publish or hold with nothing between. The deferral may still be
right; it is now a decision with a real case in hand.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
First finding, and it establishes the record format by being one. Kept minimal
on purpose - inventing a schema before there is a second finding to test it
against would be designing in the dark.
The substance: POST /v1/check and /v1/batch_check authenticate no caller, so
any workload with network reach can assert any subject and any tenant and
receive an authoritative allow from the estate's authorization oracle.
Self-reported by flex-auth during their Tenancy Posture review, and their own
note says they did not know they were carrying it.
Severity, disclosure and escalation are left unset. Per INTENT this repo owns
those and the reporter does not, and filling them in as the routing party would
collapse the separation on the first record.
Two things stated rather than assumed. Exposure depends on whether a
default-deny NetworkPolicy fronts the service; flex-auth did not say, and I did
not check, because that would be reporting on a system I do not own. And the
disclosure question is genuinely live here - build mode is public-by-default,
this is a live authorization bypass, and the controlled-disclosure mechanism
this repo anticipates does not exist yet, so the choice today is publish or
hold with nothing in between.
Three related defects from the same review round are recorded as visible but
not filed, since filing them was not asked for. All four were found by repos
reading their own code against a ladder within a day of each other, and none
was found by monitoring - which is itself a fact worth carrying into triage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Owned by the-custodian alongside policy-nexus, with the duty of deciding what
must reach the operator personally.
Three things had nowhere to live. Findings landed in whichever document
discovered them - the estate's largest known gap is currently open question 3
in an unratified draft, with no owner, severity or date. Disclosure had no
mechanism, only publish-now or forget, which is fine in build mode and wrong at
production. And regulation was researched at the moment it was needed and never
retained.
Regulatory intake moves here from policy-nexus T06: deciding what a rule
demands of us is a judgement about risk, not an act of publishing. That also
leaves policy-nexus doing one thing, which was the point.
Two constraints written in deliberately. This repo does not fix - findings
route to the repo owning the defect, because a risk service that fixes becomes
a second engineering team with no boundary. And it does not block delivery in
build mode; if that changes it will be a decision recorded here, not a habit
that accretes.
The escalation rule is named as unwritten rather than invented. Getting it
wrong in either direction fails: escalate everything and the operator becomes
the queue, escalate nothing and the register is where serious things go quiet.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
