# STATE — risk-nexus

**Updated:** 2026-09-01
**Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian

## One-line posture

**The register decides.** Nine findings graded, three notes below the floor,
one regulatory determination and a thirteen-entry legal policy set; every open
question carries a default and a date, and the check cadence is scheduled on
`activity-core` rather than on anyone remembering.

## Workplans

| ID | Status | Notes |
| --- | --- | --- |
| `RISK-WP-0001` | **finished** | The four instruments, the index, the first grading |
| `RISK-WP-0002` | **finished** | Two findings and five public method instruments handed to `policy-nexus` |
| `RISK-WP-0003` | **finished** | Regulatory intake; the legal policy set |
| `RISK-WP-0004` | **finished** | Running the register: cadence, verification, inbox-before-grading |
| `RISK-WP-0005` | **finished** | The seven gaps from `history/2026-08-21-intent-gap-analysis.md` |

## The register

| ID | Sev | Status | Disclosure | Cadence | System |
| --- | --- | --- | --- | --- | --- |
| `RISK-F-0001` | high | fixed | public | instant | flex-auth |
| `RISK-F-0002` | medium | open | embargoed | instant | ops-warden |
| `RISK-F-0003` | medium | mitigated | embargoed | 1h | ops-warden |
| `RISK-F-0004` | medium | open | embargoed | instant | tenant-engine |
| `RISK-F-0005` | medium | mitigated | public | instant | audit-core |
| `RISK-F-0006` | high | **fixed** | public | instant | railiance-platform |
| `RISK-F-0007` | high | accepted | embargoed | instant | estate |
| `RISK-F-0008` | medium | accepted | public | instant | audit-core |
| `RISK-F-0009` | high | open | embargoed | instant | railiance-platform |

Notes below the floor: `RISK-N-0001` noisy neighbours · `RISK-N-0003` found by
reading not watching · `RISK-N-0004` zone lookup.

Not one field reads `unset`.

## How it works

```
findings/*.md            source of truth; reporter fields + this repo's grade
  ↓ tools/register_index.py
REGISTER.md              generated, one screen, never hand-edited

docs/method/             severity · disclosure · escalation · review
                         verification · dependencies · check-procedure
docs/rulings/            why each grade is what it is, dated
docs/regulatory/         RISK-REG-0001 + policies/ (13, keyed by activation)
docs/verifications/      RISK-V-000N — what this repo checked itself

make due                 the work list
make fixes               state of every tracked fix, from the owner's file
make coverage            what the register has never heard from
make checked ARGS=...    record an outcome; moves the cadence rung
make check               index + malformed + waits + inbox + escalations
```

**Cadence:** `instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q`.
Clean climbs one rung; anything moving resets to `instant`. The rung is the
stability signal. Operator ruling, 2026-08-20.

**Scheduled on `activity-core`:** `hourly-register-inbox-watch` (fires only on
an unread message) and `daily-register-check-sweep` (07:15, unconditional).
Both instruct a session that exercises judgement; neither may record an
outcome.

## Waiting on other people — 9 open, all defaulted

| Who | On | Defaults |
| --- | --- | --- |
| ops-warden | does the flex-auth pin admit ingress, before enabling `policy.enabled` | 2026-08-27 |
| railiance-platform | deny-set coverage report (`F-0009`) | 2026-09-03 |
| tenant-engine | confirm/correct `events()`; fix tracking | 2026-09-03 |
| user-engine | tenant-boundary verification (`RISK-V-0002`) | 2026-09-03 |
| the-custodian | canon kinds packet | 2026-09-17 |
| railiance-platform | backup target, cost, demonstrated restore | 2026-09-18 |
| audit-core | is `may_read` false on every production credential | 2026-09-19 |
| audit-core | keyed commitment; `platform-pg` co-residency horizon | 2026-11-17 |

## Verify

```
make check                       # everything, including the inbox
python3 tools/register_check.py  # just the register
statehub fix-consistency --repo risk-nexus
```

## What the gap analysis changed

`history/2026-08-21-intent-gap-analysis.md` graded this repo against its own
`INTENT.md` and `RISK-WP-0005` closed all seven gaps the same day.

- **Fix state is read, not remembered.** `make fixes` resolves every
  `fix_tracking` against the owning repo's workplan file. Its first run found
  `RISK-F-0005`'s fix already landed three days earlier, and both of
  `RISK-F-0002`'s tracked records closed *before that finding was filed*.
- **Incident intake exists**, with `first_observed` starting the 72-hour clock
  in `RISK-POL-0005` and escalation that is not batched.
- **Public records have permanent addresses** — two findings and five method
  instruments publish through `policy-nexus`; this repo remains their source.
- **Coverage has a number:** `make coverage` — 7 of 117 registered repos have
  ever appeared in a finding. The other 110 are unknown, not clean.

## Known conditions

- **Workplans are not indexed in the hub.** C-06 on all four: this instance is
  not the identifier registrar. Needs a run with `STATEHUB_REGISTRAR=1` on the
  production instance. The estate's read model cannot see any `risk-nexus`
  workplan.
- **C-31** fires on `RISK-F-` ids until canon registers the kinds. Packet sent.
- **OpenBao is unverifiable from here** (403). Every grade touching an OpenBao
  policy is a grade on a document, and says so.