# Filing a finding

One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter,
then prose. Next id is one past the highest here.

## What the reporter fills in

```yaml
id: RISK-F-0004
type: finding
title: "one line, what is true — not what should be done"
status: open                  # open | fixed | accepted | withdrawn
reported_by: <repo>           # who found it
reported_via: <repo>          # who routed it here, if different
date_reported: "YYYY-MM-DD"
system: <repo>                # the system the defect is in
environment: production       # production | build | both
fix_owner: <repo>             # who owns the fix — never risk-nexus
fix_tracking: <WP-ID or unset>
related: [RISK-F-0001]        # optional
```

## What risk-nexus fills in — leave these out

`severity`, `severity_at_production`, `impact`, `likelihood`,
`fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`,
`escalation*`, `constraint*`, `last_reviewed`, `review_by`, `graded_by`,
`ruling`.

Setting them yourself is not an error to be corrected — it is a boundary this
repo would rather keep. The reporter says what is true; this repo says how bad
it is and who hears about it (`INTENT.md`). Leaving them out, or writing
`unset`, both work; the nag reports either way until they are graded.

## What makes a good finding here

- **State exposure only as far as you can support it.** "Not established" is a
  complete answer and grades better than a guess. `RISK-F-0001` declining to
  assume a NetworkPolicy is the model.
- **Say how it was found.** Provenance is a grading input.
- **Suggest a direction if you have one, marked as a suggestion.** The fix is
  yours; the grade is ours.
- **A note is fine.** If it would not change anyone's decision, it belongs in
  `notes/` — see the floor in `docs/method/severity.md`.

After filing: `make check`. Then this repo grades it.