risk-nexus/docs/method/intake.md

id	type	title	status	owner	adopted	workplan	review_interval
RISK-METHOD-INTAKE	method	Intake: the four sources, including the two that had no path	adopted	risk-nexus	2026-08-21	RISK-WP-0005-T02	6m

Intake

INTENT.md claims intake "from any source: research, review, incident, external report". Until 2026-08-21 two of those four had no path at all, and every finding in the register had arrived from a repo reading its own code.

A register that only receives self-assessments is a self-assessment aggregator. That is a respectable thing to be and it is not what the intent says.

The four sources

Source	Path	State
Research	a repo or agent files against findings/README.md	working, nine findings
Review	same, usually against a ladder or standard	working, most of the nine
Incident	below	new
External report	below — and the address is not this repo's to create	routed

Incident

An incident is a finding about something happening now rather than a latent defect. The difference is not severity; it is that someone is exercising it, or the loss is occurring, while the record is being written.

What is different

• File first, grade later. The normal order is reversed: get the record into findings/ with what is known, and grade it in the same hour rather than in the same sitting. An ungraded incident is still a record; an unwritten one is nothing.
• incident: true and a first_observed timestamp, both in front-matter. The timestamp matters more than the grade, because obligations run from it.
• Cadence starts at instant and stays there until the incident is over. That is the ladder's existing behaviour and needs no special case: something that keeps moving keeps resetting.
• The 72-hour clock. If personal data is or may be involved, RISK-POL-0005 (GDPR Arts 33–34) requires notification within 72 hours of becoming aware. first_observed is what starts that clock, and this is the one place the register puts a hard deadline on itself. Escalation is immediate under trigger 1 or 2 — not batched, notwithstanding the batching rule, because batching exists to protect the operator's attention and a 72-hour clock outranks that.
• Severity is scored on what is happening, not what could. The L4 likelihood band — "already happening" — exists for exactly this and is otherwise almost unused.

What is not different

Ownership, routing, and the boundary. The repo that owns the system owns the response; this register records, grades, escalates and keeps the clock. A risk register that runs incident response is a second engineering team with a stopwatch.

External report

Someone outside the estate finding something and having somewhere to send it.

No such place exists. There is no security.txt anywhere in the estate, no published address, and no route from an outsider to this register. If someone found a flaw in a coulomb.social surface tomorrow, their options would be to guess an email address or say nothing.

Where that address lives is not this repo's decision. It is a published surface, which makes it policy-nexus's to serve and the custodian's to approve. Routed on 2026-08-21 with a proposal:

• a security.txt (RFC 9116) at policy.coulomb.social/.well-known/, naming a contact and a preferred language, with an expiry date as the RFC requires;
• reports arriving there routed to risk-nexus and filed like any other finding, with reported_by: external;
• no promise of a bounty, a timeline, or safe harbour. The ask is a route in, not a commitment out. A published disclosure policy is a later decision and a heavier one.

Until that exists, this register's claim to accept external reports is aspirational and STATE.md says so.

What all four share

The reporter says what is true and how they know. This register says how bad it is and who hears about it. Nothing in this document changes that boundary — including for incidents, where the temptation to take over is strongest.