# STATE — risk-nexus

**Updated:** 2026-10-03
**Domain:** infotech · **Repo:** risk-nexus · **Owner:** the-custodian

## Current posture

The register contains 15 graded findings: nine fixed, four open and two
accepted; three notes; one regulatory determination; four full policy records
and a thirteen-entry policy catalogue. REGISTER.md is the generated finding
index. Disclosure is public for all findings; two have recorded publication
addresses and nine still carry pending handovers. The e-invoice finding and
three Emergent findings have no completed publication handover recorded.

## Workplan audit — 2026-10-03

All seven local workplans and their State Hub projections are `finished`.
All 37 local task blocks are `done`. No blocked, active, ready or proposed
workplan exists here, and no unfinished local task requires changing a parent
to `blocked`. No task or workplan was added for this cleanup.

| Workplan | Completed scope | Remaining external or recurring obligations |
| --- | --- | --- |
| RISK-WP-0001 | Grading instruments and register | Canon-kind default already applied; review instruments as due |
| RISK-WP-0002 | Initial publication and standing handover route | Later finding publication returns belong to policy-nexus |
| RISK-WP-0003 | Regulatory intake and retained policy records | Substantive policy and activation reviews remain due |
| RISK-WP-0004 | Review procedure, inbox checks and activity definitions | Live activity deployment/session completion remains unverified |
| RISK-WP-0005 | Intake, remediation tracking and gap reporting | Production-transition adoption and external contact delivery remain outside this repo |
| RISK-WP-0006 | Resilient reports and obligation visibility | Reporting does not complete the underlying reviews or handovers |
| RISK-WP-0007 | Reconcile owner evidence and closure obligations | Deployed captures and provider/owner acceptance remain owner work |

## Loose ends resolved — 2026-10-03

RISK-F-0011 now records the founder's 2026-09-22 source-only acceptance
(message `61fd83cc-4d21-4a0c-bbef-d91b2e8f129e`). The founder, exercising
`GOVERN @ estate`, accepted the bounded source claim, not deployed completeness.
The medium grade stays; the stall escalation is answered. Acceptance ends
when a deployed qonto stream can be read by King's Guard, or at the next
scheduled risk review after 2026-12-31, whichever occurs first.
KG-WP-0005-T03 remains the closure path; its owner workplan is already blocked.
This is a recorded decision, not renewed acceptance by this register.

The fix tracker now reads YAML task blocks regardless of field order.
Emergent T04 correctly reports `done` and T07 `wait`, rather than `unreadable`.
A regression test also prevents reading a status from outside the target block.

RISK-F-0013 (medium) and RISK-F-0014 (low) retain the historical 0.2.1
binding/lifecycle defects and local 0.2.3 non-reproduction evidence; owner T07
acceptance remains pending. RISK-F-0015 (low) records the two retained Claude
owner-routing misses; current-release complete provider evidence remains pending.

## Remaining register obligations

- RISK-F-0012: qonto-assistant must supply e-invoice owner tracking and the
  receiving/retention evidence. Existing default date: 2026-10-06.
- RISK-F-0008: accepted audit-retention risk; its substantive legal review and
  real-data activation facts remain due. Existing technical default: 2026-11-17.
- Four full policies and RISK-REG-0001 remain overdue for substantive review.
  This cleanup supplies no new legal research or activation assurance.
- Nine finding publication handovers remain pending. A disclosure grade is
  not publication. No new external message or publication was sent here.
- Scheduled-session execution, external contact delivery and production-transition
  adoption remain unverified; their definitions/routes are completed local work.

Completed implementation tasks stay finished while those recurring or external
obligations remain on the register. Findings stay watched until concrete closure
or valid acceptance; owner workplan completion alone does not close them.

## Verification

`make test`: 14 tests pass. `make fixes` resolves the Emergent task states.
`make check` checks index, register obligations and inbox; overdue work remains
visible. `statehub fix-consistency` reconciles the seven workplans and pushes.
Historical records retain the provenance of file evidence versus live reads.