# risk-nexus — Agent Instructions

## Repo Identity

**Purpose:** the estate's risk register. It grades, reviews, escalates and hands
over findings for publication, and keeps regulatory records. It is headless:
files are the source of truth, and `make` is the interface. See `SCOPE.md` for
what the repository does and does not do.

**Domain:** infotech
**Repo slug:** risk-nexus
**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
**Workplan prefix:** `RISK-WP-`
**Record prefixes:** `RISK-F-` findings, `RISK-REG-` regulatory records,
`RISK-POL-` legal policies, `RISK-V-` verifications, `RISK-RULING-` rulings

---

## Working the register

Run `make` to list every target with examples. The usual session is:

```bash
make check                          # full sweep; the inbox comes first ("question zero")
make list                           # live findings, most severe first
make show ID=RISK-F-0012            # one record
make checked ID=<id> OUTCOME=clean|moved NOTE="what was seen"
make test                           # before committing tool changes
```

Method is in `docs/method/`: severity, disclosure, review, escalation, intake
and verification. Rulings go in `docs/rulings/`. Never record credential values,
fingerprints, lengths or shapes in any file or message.

## State Hub

Workstation: `http://127.0.0.1:8000`. On railiance01, in-cluster:
`http://10.43.68.154:8000`. The hub is a read model.

- **Start:** `cat .custodian-brief.md`, then
  `GET /messages/?to_agent=risk-nexus&unread_only=true`, and mark messages read
  once they have been acted on.
- **Close:** `POST /progress/` with a summary. After any change to a workplan
  file, run `statehub fix-consistency`; its sync step pushes.
- Never register workplans or tasks by hand. Write the file, commit, and sync.
- Stage by explicit path, and leave other people's uncommitted files alone.

## Environment and authority

Read `~/the-custodian/docs/agent-environment-orientation.md` before any
production, credential or GitOps work. Write authority in Mode of Authority
terms: the founder's decisions are "the founder, exercising `GOVERN @ estate`".
Never write a bare "operator". Older records in this repository still use that
word; correct it only when you are editing the record anyway.

## Credential and access routing

This repository needs no credentials. If that ever changes, run
`warden route find "<need>" --json` first. ops-warden issues SSH certificates
only; every other credential belongs to another subsystem.