diff --git a/STATE.md b/STATE.md deleted file mode 100644 index 1faed82..0000000 --- a/STATE.md +++ /dev/null @@ -1,98 +0,0 @@ -# STATE — risk-nexus - -**Updated:** 2026-08-21 -**Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian - -## One-line posture - -**The register decides.** Nine findings graded, three notes below the floor, -one regulatory determination and a thirteen-entry legal policy set; every open -question carries a default and a date, and the check cadence is scheduled on -`activity-core` rather than on anyone remembering. - -## Workplans - -| ID | Status | Notes | -| --- | --- | --- | -| `RISK-WP-0001` | **finished** | The four instruments, the index, the first grading | -| `RISK-WP-0002` | active | Publication handover — T01 with `policy-nexus` | -| `RISK-WP-0003` | **finished** | Regulatory intake; the legal policy set | -| `RISK-WP-0004` | **finished** | Running the register: cadence, verification, inbox-before-grading | - -## The register - -| ID | Sev | Status | Disclosure | Cadence | System | -| --- | --- | --- | --- | --- | --- | -| `RISK-F-0001` | high | fixed | public | instant | flex-auth | -| `RISK-F-0002` | medium | open | embargoed | instant | ops-warden | -| `RISK-F-0003` | medium | mitigated | embargoed | 1h | ops-warden | -| `RISK-F-0004` | high | open | embargoed | 1h | tenant-engine | -| `RISK-F-0005` | medium | open | embargoed | 1h | audit-core | -| `RISK-F-0006` | high | open | embargoed | 1h | railiance-platform | -| `RISK-F-0007` | high | accepted | embargoed | instant | estate | -| `RISK-F-0008` | medium | accepted | public | instant | audit-core | -| `RISK-F-0009` | high | open | embargoed | 1h | railiance-platform | - -Notes below the floor: `RISK-N-0001` noisy neighbours · `RISK-N-0003` found by -reading not watching · `RISK-N-0004` zone lookup. - -Not one field reads `unset`. - -## How it works - -``` -findings/*.md source of truth; reporter fields + this repo's grade - ↓ tools/register_index.py -REGISTER.md generated, one screen, never hand-edited - -docs/method/ severity · disclosure · escalation · review - verification · dependencies · check-procedure -docs/rulings/ why each grade is what it is, dated -docs/regulatory/ RISK-REG-0001 + policies/ (13, keyed by activation) -docs/verifications/ RISK-V-000N — what this repo checked itself - -make due the work list -make checked ARGS=... record an outcome; moves the cadence rung -make check index + malformed + waits + inbox + escalations -``` - -**Cadence:** `instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q`. -Clean climbs one rung; anything moving resets to `instant`. The rung is the -stability signal. Operator ruling, 2026-08-20. - -**Scheduled on `activity-core`:** `hourly-register-inbox-watch` (fires only on -an unread message) and `daily-register-check-sweep` (07:15, unconditional). -Both instruct a session that exercises judgement; neither may record an -outcome. - -## Waiting on other people — 9 open, all defaulted - -| Who | On | Defaults | -| --- | --- | --- | -| ops-warden | does the flex-auth pin admit ingress, before enabling `policy.enabled` | 2026-08-27 | -| railiance-platform | deny-set coverage report (`F-0009`) | 2026-09-03 | -| tenant-engine | confirm/correct `events()`; fix tracking | 2026-09-03 | -| user-engine | tenant-boundary verification (`RISK-V-0002`) | 2026-09-03 | -| policy-nexus | publication entries for two findings + five method docs | 2026-09-17 | -| the-custodian | canon kinds packet | 2026-09-17 | -| railiance-platform | backup target, cost, demonstrated restore | 2026-09-18 | -| audit-core | is `may_read` false on every production credential | 2026-09-19 | -| audit-core | keyed commitment; `platform-pg` co-residency horizon | 2026-11-17 | - -## Verify - -``` -make check # everything, including the inbox -python3 tools/register_check.py # just the register -statehub fix-consistency --repo risk-nexus -``` - -## Known conditions - -- **Workplans are not indexed in the hub.** C-06 on all four: this instance is - not the identifier registrar. Needs a run with `STATEHUB_REGISTRAR=1` on the - production instance. The estate's read model cannot see any `risk-nexus` - workplan. -- **C-31** fires on `RISK-F-` ids until canon registers the kinds. Packet sent. -- **OpenBao is unverifiable from here** (403). Every grade touching an OpenBao - policy is a grade on a document, and says so. diff --git a/docs/assessments/2026-08-21-state-vs-intent.md b/docs/assessments/2026-08-21-state-vs-intent.md deleted file mode 100644 index 4843b31..0000000 --- a/docs/assessments/2026-08-21-state-vs-intent.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -id: RISK-ASSESS-0001 -type: assessment -title: "STATE.md against INTENT.md — what is missing" -date: "2026-08-21" -owner: risk-nexus ---- - -# What this repo promised, and what it has - -`INTENT.md` was written before the register existed. Four days in, this is what -it claimed, what is true, and what is not. - -## What it owns — six claims - -| Claim | State | Honest reading | -| --- | --- | --- | -| Finding intake, from any source: research, review, **incident, external report** | Partial | Nine findings, all from research or self-review. **No incident path and no external-report channel exist at all.** | -| Severity and triage | Yes | Scale adopted, amended twice under use, applied to nine findings with no `unset` left. | -| Remediation tracking — owner, state, whether it stalled | **Nominal** | `fix_tracking` holds strings nobody reads. See gap 2. | -| Disclosure timing | Yes | Three states, exercised, and it has bitten across two findings. | -| Regulatory intake | Yes, and beyond | One determination, thirteen-entry policy set, a written route. | -| The escalation rule | Yes | Adopted 2026-08-20 with the operator's thresholds. | - -## What it does not own — held - -Fixing, publication, blocking delivery, legal advice, amending canon. Nothing -in four days crossed those. The nearest approach was running `kubectl` against -another repo's cluster, and that is bounded in `docs/method/verification.md`: -read-only, recorded, routed as a question, never a conclusion on the owner's -behalf. - -## What good looks like — four tests from INTENT - -**"A gap that was known is recorded with a severity and an owner."** Met. -Nine, including the estate-wide one that had lived as open question 3 of an -unratified draft. - -**"A regulation that applies was found before it was needed."** **Not met, and -this is the sharpest failure in the assessment.** The policy set found two -obligations that are *already live*: commercial and tax retention, and the -e-invoicing receiving duty in force since January 2025. Neither was found -before it was needed. They were found roughly nineteen months late, by writing -a catalogue that should have existed first. The catalogue now makes the test -passable going forward; it does not make this instance a pass. - -**"A fix that stalled was visible while it stalled."** **Untested, and weaker -than it looks.** No fix has stalled yet. The mechanism — fourteen days at the -bottom rung — measures whether the *register* is checking, not whether the -*fix* is moving. See gap 2. - -**"The things that genuinely needed the operator's judgement reached them."** -Met, four times, three answered. One was withdrawn before sending because the -fix landed first, which the register recorded as luck rather than a success. - -## The gaps, in the order they would hurt - -### 1. Nothing can report to this register from outside - -Every finding arrived from a repo reading its own code, or from this register -reading a cluster. `INTENT.md` claims intake from **incident and external -report**; neither has a path. - -There is no address an outsider could use, no `security.txt` anywhere in the -estate, and no defined route from "something is happening right now" to a -record. The severity scale assumes a latent defect; an active incident has a -different tempo, and `RISK-POL-0005` (breach notification, 72 hours) is dormant -with nothing wired to it. - -The register is currently a **self-assessment aggregator**. That is a -respectable thing to be and it is not what the intent says it is. - -### 2. Remediation tracking does not track - -`fix_tracking: FLEX-WP-0015-T02` is a string this repo writes down and never -reads. The hub knows whether that task moved; the register asks a human -instead, and "has the fix moved?" is question three of every check. - -That decays the moment nobody is looking, which is precisely the condition the -whole cadence design assumes. **The fix state should be read from the hub, and -a fix that has not moved should reset nothing and escalate on its own timer** — -independent of whether the register happened to check. - -Today, an owner who goes quiet and a fix that goes quiet look identical. - -### 3. There is no coverage model - -The register knows what was reported. It has no view of what was never looked -at. - -A system with zero findings is indistinguishable from a system nobody has -assessed, and `RISK-N-0003` records the uncomfortable evidence: every repo that -has examined its own boundary this month found a defect — two for two. -`INTENT.md`'s "nobody is surprised" cannot hold while the denominator is -unknown. - -### 4. The production transition has no owner and no definition - -Five findings owe a re-score at "the production transition", and -`RISK-F-0007`'s acceptance **expires** there. Nothing outside this repo knows -that, no one has defined what the event is, and no one has been named to -declare it. - -An acceptance that expires on an undefined event expires on nobody's calendar. - -### 5. The repo claims a surface it does not have - -`README.md` and `INTENT.md` both say `risk-nexus` serves `risk.coulomb.social`. -It serves nothing. Two documents wait on `policy-nexus` for an address, and the -site does not exist. - -Small, but it is exactly the class of claim this register grades other repos -down for: a stated control that is not there. - -### 6. Escalation has no delivery guarantee - -Escalations go to an inbox and are said aloud in whatever session is running. -If the operator does not read the inbox, the escalation is indistinguishable -from one never sent — which is the failure this register committed on -2026-08-19 and fixed *for itself* with `hourly-register-inbox-watch`. - -The same fix has not been applied to the escalation path. Nothing acknowledges, -and nothing re-raises. - -### 7. Everything runs from one checkout - -The activity definitions instruct a session that may not exist. If no agent -picks up the daily sweep, `make due` still reports and nobody reads it. The -ladder degrades to decoration silently — and a `1q` rung would then mean "no -one checked for a quarter", which reads identically to "stable for a quarter". - -`clean_streak` makes a suspiciously smooth climb visible, but only to someone -looking. - -## What is deliberately not a gap - -- **No monitoring.** `RISK-N-0003` is a note, ruled so on purpose: no repo owns - estate-wide detection and a register that grows probes becomes a second - engineering team. -- **No OpenBao access.** Bounded in `verification.md`. Acquiring production - secret-store credentials for a risk register would trade a verification - problem for a worse one. -- **No blocking.** Build mode: a finding is information. Unchanged. - -## Ranking - -If one thing is done next it is **gap 2**, because it is the only one where the -register currently reports something it cannot actually see, and INTENT names -it explicitly. Gaps 1 and 4 are the next two, and both are cheap. - -Gap 3 is the largest and the most expensive, and it is the one that decides -whether "nobody is surprised" is a claim this repo can ever make.