---
id: hourly-register-inbox-watch
name: Hourly Register Inbox Watch
type: activity-definition
version: "1.0"
enabled: true
owner: risk-nexus
governance: custodian
status: active
created: "2026-08-20"
updated: "2026-08-20"
trigger:
  type: cron
  cron_expression: "5 * * * *"
  timezone: Europe/Berlin
  misfire_policy: skip
dedupe_key_strategy: skip
context_sources:
  - type: state-hub
    query: hub_inbox
    required: true
    params:
      to_agent: risk-nexus
      unread_only: true
    bind_to: context.inbox
report_sinks:
  - type: state-hub-progress
    event_type: risk_register_inbox
    author: activity-core
---

# Hourly Register Inbox Watch

Runs hourly at :05 Berlin time. Fires only when something is actually waiting.

## Why hourly, and why the inbox specifically

`docs/method/review.md` sets an adaptive cadence whose shortest rung is one
hour, so hourly is the finest granularity the register can act on. Anything
faster would report work that cannot yet be due.

The inbox is the trigger rather than the clock because of what happened on
2026-08-19: this register graded `RISK-F-0001` `critical` and prepared an
escalation while two messages sat unread — one narrowing the exposure, one
reporting the fix. Both changed the grade. Reading the inbox is now question
zero of every check (`docs/method/check-procedure.md`), and this activity is
the mechanism that stops it depending on somebody remembering.

An unread message addressed to `risk-nexus` is, by construction, a claim that
something in the register may have moved.

## What it does not do

It does not grade, close, publish or escalate anything. Severity, disclosure
and escalation are judgements this repo makes with a human or an agent session
doing the reading — never a cron. This activity's entire job is to make sure
somebody looks.

```rule
id: inbox-has-spoken
for_each: context.inbox
bind_as: message
condition: 'context.message.read_at == None'
action:
  task_template: 'risk-nexus: read {context.message.from_agent} before checking'
  description: >-
    Unread message to risk-nexus from {context.message.from_agent}:
    "{context.message.subject}". Read it before any check or grading — this is
    question zero in docs/method/check-procedure.md. Then run `make due` in
    risk-nexus and work the list, recording each outcome with
    `make checked ARGS="<finding-id> clean|moved"`.
  target_repo: risk-nexus
  priority: high
  labels: ["risk-register", "inbox", "question-zero"]
```