2 changed files with 0 additions and 250 deletions
--- a/STATE.md
+++ b/STATE.md
@ -1,98 +0,0 @@
 # STATE — risk-nexus
 **Updated:** 2026-08-21
 **Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian
 ## One-line posture
 **The register decides.** Nine findings graded, three notes below the floor,
 one regulatory determination and a thirteen-entry legal policy set; every open
 question carries a default and a date, and the check cadence is scheduled on
 `activity-core` rather than on anyone remembering.
 ## Workplans
 | ID | Status | Notes |
 | --- | --- | --- |
 | `RISK-WP-0001` | **finished** | The four instruments, the index, the first grading |
 | `RISK-WP-0002` | active | Publication handover — T01 with `policy-nexus` |
 | `RISK-WP-0003` | **finished** | Regulatory intake; the legal policy set |
 | `RISK-WP-0004` | **finished** | Running the register: cadence, verification, inbox-before-grading |
 ## The register
 | ID | Sev | Status | Disclosure | Cadence | System |
 | --- | --- | --- | --- | --- | --- |
 | `RISK-F-0001` | high | fixed | public | instant | flex-auth |
 | `RISK-F-0002` | medium | open | embargoed | instant | ops-warden |
 | `RISK-F-0003` | medium | mitigated | embargoed | 1h | ops-warden |
 | `RISK-F-0004` | high | open | embargoed | 1h | tenant-engine |
 | `RISK-F-0005` | medium | open | embargoed | 1h | audit-core |
 | `RISK-F-0006` | high | open | embargoed | 1h | railiance-platform |
 | `RISK-F-0007` | high | accepted | embargoed | instant | estate |
 | `RISK-F-0008` | medium | accepted | public | instant | audit-core |
 | `RISK-F-0009` | high | open | embargoed | 1h | railiance-platform |
 Notes below the floor: `RISK-N-0001` noisy neighbours · `RISK-N-0003` found by
 reading not watching · `RISK-N-0004` zone lookup.
 Not one field reads `unset`.
 ## How it works
 ```
 findings/*.md            source of truth; reporter fields + this repo's grade
  ↓ tools/register_index.py
 REGISTER.md              generated, one screen, never hand-edited
 docs/method/             severity · disclosure · escalation · review
                         verification · dependencies · check-procedure
 docs/rulings/            why each grade is what it is, dated
 docs/regulatory/         RISK-REG-0001 + policies/ (13, keyed by activation)
 docs/verifications/      RISK-V-000N — what this repo checked itself
 make due                 the work list
 make checked ARGS=...    record an outcome; moves the cadence rung
 make check               index + malformed + waits + inbox + escalations
 ```
 **Cadence:** `instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q`.
 Clean climbs one rung; anything moving resets to `instant`. The rung is the
 stability signal. Operator ruling, 2026-08-20.
 **Scheduled on `activity-core`:** `hourly-register-inbox-watch` (fires only on
 an unread message) and `daily-register-check-sweep` (07:15, unconditional).
 Both instruct a session that exercises judgement; neither may record an
 outcome.
 ## Waiting on other people — 9 open, all defaulted
 | Who | On | Defaults |
 | --- | --- | --- |
 | ops-warden | does the flex-auth pin admit ingress, before enabling `policy.enabled` | 2026-08-27 |
 | railiance-platform | deny-set coverage report (`F-0009`) | 2026-09-03 |
 | tenant-engine | confirm/correct `events()`; fix tracking | 2026-09-03 |
 | user-engine | tenant-boundary verification (`RISK-V-0002`) | 2026-09-03 |
 | policy-nexus | publication entries for two findings + five method docs | 2026-09-17 |
 | the-custodian | canon kinds packet | 2026-09-17 |
 | railiance-platform | backup target, cost, demonstrated restore | 2026-09-18 |
 | audit-core | is `may_read` false on every production credential | 2026-09-19 |
 | audit-core | keyed commitment; `platform-pg` co-residency horizon | 2026-11-17 |
 ## Verify
 ```
 make check                       # everything, including the inbox
 python3 tools/register_check.py  # just the register
 statehub fix-consistency --repo risk-nexus
 ```
 ## Known conditions
 - **Workplans are not indexed in the hub.** C-06 on all four: this instance is
  not the identifier registrar. Needs a run with `STATEHUB_REGISTRAR=1` on the
  production instance. The estate's read model cannot see any `risk-nexus`
  workplan.
 - **C-31** fires on `RISK-F-` ids until canon registers the kinds. Packet sent.
 - **OpenBao is unverifiable from here** (403). Every grade touching an OpenBao
  policy is a grade on a document, and says so.
--- a/docs/assessments/2026-08-21-state-vs-intent.md
+++ b/docs/assessments/2026-08-21-state-vs-intent.md
@ -1,152 +0,0 @@
 ---
 id: RISK-ASSESS-0001
 type: assessment
 title: "STATE.md against INTENT.md — what is missing"
 date: "2026-08-21"
 owner: risk-nexus
 ---
 # What this repo promised, and what it has
 `INTENT.md` was written before the register existed. Four days in, this is what
 it claimed, what is true, and what is not.
 ## What it owns — six claims
 | Claim | State | Honest reading |
 | --- | --- | --- |
 | Finding intake, from any source: research, review, **incident, external report** | Partial | Nine findings, all from research or self-review. **No incident path and no external-report channel exist at all.** |
 | Severity and triage | Yes | Scale adopted, amended twice under use, applied to nine findings with no `unset` left. |
 | Remediation tracking — owner, state, whether it stalled | **Nominal** | `fix_tracking` holds strings nobody reads. See gap 2. |
 | Disclosure timing | Yes | Three states, exercised, and it has bitten across two findings. |
 | Regulatory intake | Yes, and beyond | One determination, thirteen-entry policy set, a written route. |
 | The escalation rule | Yes | Adopted 2026-08-20 with the operator's thresholds. |
 ## What it does not own — held
 Fixing, publication, blocking delivery, legal advice, amending canon. Nothing
 in four days crossed those. The nearest approach was running `kubectl` against
 another repo's cluster, and that is bounded in `docs/method/verification.md`:
 read-only, recorded, routed as a question, never a conclusion on the owner's
 behalf.
 ## What good looks like — four tests from INTENT
 **"A gap that was known is recorded with a severity and an owner."** Met.
 Nine, including the estate-wide one that had lived as open question 3 of an
 unratified draft.
 **"A regulation that applies was found before it was needed."** **Not met, and
 this is the sharpest failure in the assessment.** The policy set found two
 obligations that are *already live*: commercial and tax retention, and the
 e-invoicing receiving duty in force since January 2025. Neither was found
 before it was needed. They were found roughly nineteen months late, by writing
 a catalogue that should have existed first. The catalogue now makes the test
 passable going forward; it does not make this instance a pass.
 **"A fix that stalled was visible while it stalled."** **Untested, and weaker
 than it looks.** No fix has stalled yet. The mechanism — fourteen days at the
 bottom rung — measures whether the *register* is checking, not whether the
 *fix* is moving. See gap 2.
 **"The things that genuinely needed the operator's judgement reached them."**
 Met, four times, three answered. One was withdrawn before sending because the
 fix landed first, which the register recorded as luck rather than a success.
 ## The gaps, in the order they would hurt
 ### 1. Nothing can report to this register from outside
 Every finding arrived from a repo reading its own code, or from this register
 reading a cluster. `INTENT.md` claims intake from **incident and external
 report**; neither has a path.
 There is no address an outsider could use, no `security.txt` anywhere in the
 estate, and no defined route from "something is happening right now" to a
 record. The severity scale assumes a latent defect; an active incident has a
 different tempo, and `RISK-POL-0005` (breach notification, 72 hours) is dormant
 with nothing wired to it.
 The register is currently a **self-assessment aggregator**. That is a
 respectable thing to be and it is not what the intent says it is.
 ### 2. Remediation tracking does not track
 `fix_tracking: FLEX-WP-0015-T02` is a string this repo writes down and never
 reads. The hub knows whether that task moved; the register asks a human
 instead, and "has the fix moved?" is question three of every check.
 That decays the moment nobody is looking, which is precisely the condition the
 whole cadence design assumes. **The fix state should be read from the hub, and
 a fix that has not moved should reset nothing and escalate on its own timer** —
 independent of whether the register happened to check.
 Today, an owner who goes quiet and a fix that goes quiet look identical.
 ### 3. There is no coverage model
 The register knows what was reported. It has no view of what was never looked
 at.
 A system with zero findings is indistinguishable from a system nobody has
 assessed, and `RISK-N-0003` records the uncomfortable evidence: every repo that
 has examined its own boundary this month found a defect — two for two.
 `INTENT.md`'s "nobody is surprised" cannot hold while the denominator is
 unknown.
 ### 4. The production transition has no owner and no definition
 Five findings owe a re-score at "the production transition", and
 `RISK-F-0007`'s acceptance **expires** there. Nothing outside this repo knows
 that, no one has defined what the event is, and no one has been named to
 declare it.
 An acceptance that expires on an undefined event expires on nobody's calendar.
 ### 5. The repo claims a surface it does not have
 `README.md` and `INTENT.md` both say `risk-nexus` serves `risk.coulomb.social`.
 It serves nothing. Two documents wait on `policy-nexus` for an address, and the
 site does not exist.
 Small, but it is exactly the class of claim this register grades other repos
 down for: a stated control that is not there.
 ### 6. Escalation has no delivery guarantee
 Escalations go to an inbox and are said aloud in whatever session is running.
 If the operator does not read the inbox, the escalation is indistinguishable
 from one never sent — which is the failure this register committed on
 2026-08-19 and fixed *for itself* with `hourly-register-inbox-watch`.
 The same fix has not been applied to the escalation path. Nothing acknowledges,
 and nothing re-raises.
 ### 7. Everything runs from one checkout
 The activity definitions instruct a session that may not exist. If no agent
 picks up the daily sweep, `make due` still reports and nobody reads it. The
 ladder degrades to decoration silently — and a `1q` rung would then mean "no
 one checked for a quarter", which reads identically to "stable for a quarter".
 `clean_streak` makes a suspiciously smooth climb visible, but only to someone
 looking.
 ## What is deliberately not a gap
 - **No monitoring.** `RISK-N-0003` is a note, ruled so on purpose: no repo owns
  estate-wide detection and a register that grows probes becomes a second
  engineering team.
 - **No OpenBao access.** Bounded in `verification.md`. Acquiring production
  secret-store credentials for a risk register would trade a verification
  problem for a worse one.
 - **No blocking.** Build mode: a finding is information. Unchanged.
 ## Ranking
 If one thing is done next it is **gap 2**, because it is the only one where the
 register currently reports something it cannot actually see, and INTENT names
 it explicitly. Gaps 1 and 4 are the next two, and both are cheap.
 Gap 3 is the largest and the most expensive, and it is the one that decides
 whether "nobody is surprised" is a claim this repo can ever make.