risk-nexus/STATE.md

STATE — risk-nexus

Updated: 2026-09-01 Domain: infotech · Repo: risk-nexus · Owner: the-custodian

One-line posture

The register decides. Nine findings graded, three notes below the floor, one regulatory determination and a thirteen-entry legal policy set; every open question carries a default and a date, and the check cadence is scheduled on activity-core rather than on anyone remembering.

Workplans

ID	Status	Notes
RISK-WP-0001	finished	The four instruments, the index, the first grading
RISK-WP-0002	finished	Two findings and five public method instruments handed to policy-nexus
RISK-WP-0003	finished	Regulatory intake; the legal policy set
RISK-WP-0004	finished	Running the register: cadence, verification, inbox-before-grading
RISK-WP-0005	finished	The seven gaps from history/2026-08-21-intent-gap-analysis.md

The register

ID	Sev	Status	Disclosure	Cadence	System
RISK-F-0001	high	fixed	public	instant	flex-auth
RISK-F-0002	medium	open	embargoed	instant	ops-warden
RISK-F-0003	medium	mitigated	embargoed	1h	ops-warden
RISK-F-0004	medium	open	embargoed	instant	tenant-engine
RISK-F-0005	medium	mitigated	public	instant	audit-core
RISK-F-0006	high	fixed	public	instant	railiance-platform
RISK-F-0007	high	accepted	embargoed	instant	estate
RISK-F-0008	medium	accepted	public	instant	audit-core
RISK-F-0009	high	open	embargoed	instant	railiance-platform

Notes below the floor: RISK-N-0001 noisy neighbours · RISK-N-0003 found by reading not watching · RISK-N-0004 zone lookup.

Not one field reads unset.

How it works

findings/*.md            source of truth; reporter fields + this repo's grade
  ↓ tools/register_index.py
REGISTER.md              generated, one screen, never hand-edited

docs/method/             severity · disclosure · escalation · review
                         verification · dependencies · check-procedure
docs/rulings/            why each grade is what it is, dated
docs/regulatory/         RISK-REG-0001 + policies/ (13, keyed by activation)
docs/verifications/      RISK-V-000N — what this repo checked itself

make due                 the work list
make fixes               state of every tracked fix, from the owner's file
make coverage            what the register has never heard from
make checked ARGS=...    record an outcome; moves the cadence rung
make check               index + malformed + waits + inbox + escalations

Cadence: instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q. Clean climbs one rung; anything moving resets to instant. The rung is the stability signal. Operator ruling, 2026-08-20.

Scheduled on activity-core: hourly-register-inbox-watch (fires only on an unread message) and daily-register-check-sweep (07:15, unconditional). Both instruct a session that exercises judgement; neither may record an outcome.

Waiting on other people — 9 open, all defaulted

Who	On	Defaults
ops-warden	does the flex-auth pin admit ingress, before enabling policy.enabled	2026-08-27
railiance-platform	deny-set coverage report (F-0009)	2026-09-03
tenant-engine	confirm/correct events(); fix tracking	2026-09-03
user-engine	tenant-boundary verification (RISK-V-0002)	2026-09-03
the-custodian	canon kinds packet	2026-09-17
railiance-platform	backup target, cost, demonstrated restore	2026-09-18
audit-core	is may_read false on every production credential	2026-09-19
audit-core	keyed commitment; platform-pg co-residency horizon	2026-11-17

Verify

make check                       # everything, including the inbox
python3 tools/register_check.py  # just the register
statehub fix-consistency --repo risk-nexus

What the gap analysis changed

history/2026-08-21-intent-gap-analysis.md graded this repo against its own INTENT.md and RISK-WP-0005 closed all seven gaps the same day.

• Fix state is read, not remembered. make fixes resolves every fix_tracking against the owning repo's workplan file. Its first run found RISK-F-0005's fix already landed three days earlier, and both of RISK-F-0002's tracked records closed before that finding was filed.
• Incident intake exists, with first_observed starting the 72-hour clock in RISK-POL-0005 and escalation that is not batched.
• Public records have permanent addresses — two findings and five method instruments publish through policy-nexus; this repo remains their source.
• Coverage has a number: make coverage — 7 of 117 registered repos have ever appeared in a finding. The other 110 are unknown, not clean.

Known conditions

• Workplans are not indexed in the hub. C-06 on all four: this instance is not the identifier registrar. Needs a run with STATEHUB_REGISTRAR=1 on the production instance. The estate's read model cannot see any risk-nexus workplan.
• C-31 fires on RISK-F- ids until canon registers the kinds. Packet sent.
• OpenBao is unverifiable from here (403). Every grade touching an OpenBao policy is a grade on a document, and says so.