---
id: RISK-METHOD-CHECK
type: method
title: "How a check is actually performed"
status: adopted
owner: risk-nexus
adopted: "2026-08-20"
workplan: RISK-WP-0004-T01
review_interval: 180d
---

# Performing a check

The ladder in `docs/method/review.md` says *when*. This says *what*, in order,
so that a check is repeatable by whoever or whatever is doing it.

A check takes minutes. It is not an investigation, and it is not a re-grading
unless something moved.

## The order

```
make check          # what is due, what is malformed, what the inbox has said
```

Then, per due finding:

0. **Read the inbox first.** `make check` ends with the inbox report; anything
   it lists is read before that finding is touched. This is step zero because
   skipping it on 2026-08-19 produced a wrong grade and a nearly-sent
   escalation.
1. **Is the grade still right?** Re-read impact and likelihood against what has
   changed. New facts move grades in both directions.
2. **Is every stated blocker still true?** A blocker is a claim about the world
   at a date. Re-check it; do not carry it forward.
3. **Has the fix moved?** Read the owner's tracking record, not our memory of
   it. Confirm the record still exists and still refers to this defect.
4. **Is the disclosure state still right?** A met embargo condition publishes;
   a condition that has not moved in two checks is a stall — and a condition can
   be met while the embargo still holds, if a sibling finding would be exposed
   by publishing (`RISK-F-0003`).

Then record it, in the same sitting:

```
make checked ARGS="RISK-F-0002 clean"
make checked ARGS="RISK-F-0002 moved  'ops-warden enabled the gate'"
make checked ARGS="RISK-F-0002 defer 2026-09-01 'operator: after the migration'"
make register
```

`record_check.py` writes the front-matter and the dated line together. **A
check that is not written down did not happen** — the same rule this register
applies to every repo it grades.

## What must not happen

**Stamping `clean` without doing the four questions.** It costs nothing, takes
no time, and produces a `1q` rung that is a lie about stability. That is
precisely the `RISK-F-0002` failure — a control that produces a false record is
worse than no control — applied to this register's own instruments.

`clean_streak` exists partly to make that visible: a register where everything
climbs smoothly and nothing ever resets is either extraordinarily stable or not
being checked, and those two look identical from the outside.

## Who performs it

Unresolved, and the honest state of `RISK-WP-0004-T01`.

The procedure is executable and the tooling is built. What does not yet exist
is the thing that runs it on schedule. The options, worst to best:

- **A human habit.** Fails exactly when the operator is busy, which is the
  condition the ladder was designed for.
- **A cron that only reports.** Better: the due list arrives whether or not
  anyone remembers. Still needs someone to act on it.
- **A scheduled agent session** that runs `make check`, works the due list,
  performs the four questions, and records outcomes — escalating to the
  operator only what the escalation rule says to escalate.

The third is the only one that survives the operator being busy. It is also a
standing commitment of compute, and this register does not get to arm one on
the operator's behalf. **Awaiting that decision.**

Until it is made, checks happen when someone runs `make check`, and every
finding sitting at `instant` is telling the truth about how often that is.