'security' warned as an unrecognised family tag; risk, governance,
compliance and audit are the canonical ones and are closer to what this
repo does anyway — it holds risk and judges compliance, it does not
build security.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01, T02, T04-T08 done. T03 stays in progress: the escalation rule is
written and proposed, and it is not adopted until the custodian rules on
it — an unadopted rule is worse than an unwritten one because it looks
like coverage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
