risk-nexus/STATE.md

STATE — risk-nexus

Updated: 2026-08-21 Domain: infotech · Repo: risk-nexus · Owner: the-custodian

One-line posture

The register decides. Nine findings graded, three notes below the floor, one regulatory determination and a thirteen-entry legal policy set; every open question carries a default and a date, and the check cadence is scheduled on activity-core rather than on anyone remembering.

Workplans

ID	Status	Notes
RISK-WP-0001	finished	The four instruments, the index, the first grading
RISK-WP-0002	active	Publication handover — T01 with policy-nexus
RISK-WP-0003	finished	Regulatory intake; the legal policy set
RISK-WP-0004	finished	Running the register: cadence, verification, inbox-before-grading
RISK-WP-0005	active	Closing the seven gaps in history/2026-08-21-intent-gap-analysis.md

The register

ID	Sev	Status	Disclosure	Cadence	System
RISK-F-0001	high	fixed	public	instant	flex-auth
RISK-F-0002	medium	open	embargoed	instant	ops-warden
RISK-F-0003	medium	mitigated	embargoed	1h	ops-warden
RISK-F-0004	high	open	embargoed	1h	tenant-engine
RISK-F-0005	medium	open	embargoed	1h	audit-core
RISK-F-0006	high	open	embargoed	1h	railiance-platform
RISK-F-0007	high	accepted	embargoed	instant	estate
RISK-F-0008	medium	accepted	public	instant	audit-core
RISK-F-0009	high	open	embargoed	1h	railiance-platform

Notes below the floor: RISK-N-0001 noisy neighbours · RISK-N-0003 found by reading not watching · RISK-N-0004 zone lookup.

Not one field reads unset.

How it works

findings/*.md            source of truth; reporter fields + this repo's grade
  ↓ tools/register_index.py
REGISTER.md              generated, one screen, never hand-edited

docs/method/             severity · disclosure · escalation · review
                         verification · dependencies · check-procedure
docs/rulings/            why each grade is what it is, dated
docs/regulatory/         RISK-REG-0001 + policies/ (13, keyed by activation)
docs/verifications/      RISK-V-000N — what this repo checked itself

make due                 the work list
make checked ARGS=...    record an outcome; moves the cadence rung
make check               index + malformed + waits + inbox + escalations

Cadence: instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q. Clean climbs one rung; anything moving resets to instant. The rung is the stability signal. Operator ruling, 2026-08-20.

Scheduled on activity-core: hourly-register-inbox-watch (fires only on an unread message) and daily-register-check-sweep (07:15, unconditional). Both instruct a session that exercises judgement; neither may record an outcome.

Waiting on other people — 9 open, all defaulted

Who	On	Defaults
ops-warden	does the flex-auth pin admit ingress, before enabling policy.enabled	2026-08-27
railiance-platform	deny-set coverage report (F-0009)	2026-09-03
tenant-engine	confirm/correct events(); fix tracking	2026-09-03
user-engine	tenant-boundary verification (RISK-V-0002)	2026-09-03
policy-nexus	publication entries for two findings + five method docs	2026-09-17
the-custodian	canon kinds packet	2026-09-17
railiance-platform	backup target, cost, demonstrated restore	2026-09-18
audit-core	is may_read false on every production credential	2026-09-19
audit-core	keyed commitment; platform-pg co-residency horizon	2026-11-17

Verify

make check                       # everything, including the inbox
python3 tools/register_check.py  # just the register
statehub fix-consistency --repo risk-nexus

Known, and being worked

history/2026-08-21-intent-gap-analysis.md graded this repo against its own INTENT.md. Five of six ownership claims hold; seven gaps do not, and RISK-WP-0005 carries them. The two worth knowing without reading it:

• fix_tracking is a string nobody reads. The register claims to track remediation and does not — an owner who goes quiet and a fix that goes quiet look identical.
• Incident and external-report intake do not exist, though INTENT.md claims both. Every finding so far came from a repo reading its own code.

Known conditions

• Workplans are not indexed in the hub. C-06 on all four: this instance is not the identifier registrar. Needs a run with STATEHUB_REGISTRAR=1 on the production instance. The estate's read model cannot see any risk-nexus workplan.
• C-31 fires on RISK-F- ids until canon registers the kinds. Packet sent.
• OpenBao is unverifiable from here (403). Every grade touching an OpenBao policy is a grade on a document, and says so.