Severity (impact x likelihood, fidelity modifier for controls that lie,
headline-vs-constraint, build-mode double grade, the floor), disclosure
(publish/embargoed/restricted, and the build-mode deferral re-taken and
narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers
settled plus an ordering-hazard trigger the RISK-F-0002 case forced;
proposed, awaiting the custodian), review (intervals, what a review is,
what missing one produces, the production re-score).
Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002
medium with a high constraint on RISK-F-0001's remediation, filed as a
peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no
escalation. No unset field remains.
REGISTER.md is generated; make check reports overdue, stalled, ungraded
and unanswered escalations without changing anything.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routed by ops-warden, which owns the defect and is the affected PEP.
ops-warden ships a flex-auth pre-sign authorization gate and runs with
policy.enabled: false in production (warden.production.example.yaml:22,
policy.py:33). Every production warden sign proceeds with no authorization
decision; possession of the scoped VAULT_TOKEN is the whole model.
That was a known, boring availability blocker (FLEX-WP-0007) until yesterday.
RISK-F-0001 changes its shape: the production config points the gate at
flex-auth.flex-auth.svc.cluster.local:8080 — the exact ClusterIP surface that
authenticates no caller. Enabling the gate before RISK-F-0001 is fixed would
convert an absent control into a false attestation, writing a
policy_decision_id into the signature log for issuances an attacker authorized
by forging the oracle. An authorization check that can be forged is worse than
none, because only one of the two lies in the record afterwards.
severity, disclosure and escalation left unset — risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
