# risk-nexus

Risk register and regulatory intake for the estate. Owned by `the-custodian`.

**It does not serve its own site.** `INTENT.md` names `risk.coulomb.social` as
the eventual surface; today public findings and method instruments have
permanent addresses through `policy-nexus`. The source stays here and the
published page records its exact source revision.

Holds findings — security, architecture, operational, compliance — with a
severity, an owner and a date; decides whether and when each is published; and
decides which must reach the operator personally rather than sitting in a
register.

It does not fix things: findings route to the repo that owns the defect. It
does not host: `policy-nexus` is the publication surface.

## Where things are

- **`REGISTER.md`** — the whole register, one screen. Generated; do not edit.
- **`findings/`** — one file per finding. `findings/README.md` is the filing
  contract for reporting repos.
- **`notes/`** — seen, deliberately below the floor. Not graded, not reviewed.
- **`docs/method/`** — how this repo decides:
  [severity](docs/method/severity.md),
  [disclosure](docs/method/disclosure.md),
  [escalation](docs/method/escalation.md),
  [review and expiry](docs/method/review.md).
- **`docs/rulings/`** — the reasoning behind each grading, dated.
- **`workplans/`** — the work.

## Using it

```
make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet
```

`make check` reports ungraded findings, overdue reviews, stalled remediation,
embargoes due for re-decision, escalations awaiting the operator, and what is
owed at the production transition. It changes nothing.

- Intent: `INTENT.md`