risk-nexus/history/2026-08-21-intent-gap-analysis.md

type	title	date	author	repo	related_workplan
history	risk-nexus INTENT gap analysis	2026-08-21	claude	risk-nexus	RISK-WP-0005

What this repo promised, and what it has

INTENT.md was written before the register existed. Four days in, this is what it claimed, what is true, and what is not.

What it owns — six claims

Claim	State	Honest reading
Finding intake, from any source: research, review, incident, external report	Partial	Nine findings, all from research or self-review. No incident path and no external-report channel exist at all.
Severity and triage	Yes	Scale adopted, amended twice under use, applied to nine findings with no unset left.
Remediation tracking — owner, state, whether it stalled	Nominal	fix_tracking holds strings nobody reads. See gap 2.
Disclosure timing	Yes	Three states, exercised, and it has bitten across two findings.
Regulatory intake	Yes, and beyond	One determination, thirteen-entry policy set, a written route.
The escalation rule	Yes	Adopted 2026-08-20 with the operator's thresholds.

What it does not own — held

Fixing, publication, blocking delivery, legal advice, amending canon. Nothing in four days crossed those. The nearest approach was running kubectl against another repo's cluster, and that is bounded in docs/method/verification.md: read-only, recorded, routed as a question, never a conclusion on the owner's behalf.

What good looks like — four tests from INTENT

"A gap that was known is recorded with a severity and an owner." Met. Nine, including the estate-wide one that had lived as open question 3 of an unratified draft.

"A regulation that applies was found before it was needed." Not met, and this is the sharpest failure in the assessment. The policy set found two obligations that are already live: commercial and tax retention, and the e-invoicing receiving duty in force since January 2025. Neither was found before it was needed. They were found roughly nineteen months late, by writing a catalogue that should have existed first. The catalogue now makes the test passable going forward; it does not make this instance a pass.

"A fix that stalled was visible while it stalled." Untested, and weaker than it looks. No fix has stalled yet. The mechanism — fourteen days at the bottom rung — measures whether the register is checking, not whether the fix is moving. See gap 2.

"The things that genuinely needed the operator's judgement reached them." Met, four times, three answered. One was withdrawn before sending because the fix landed first, which the register recorded as luck rather than a success.

The gaps, in the order they would hurt

1. Nothing can report to this register from outside

Every finding arrived from a repo reading its own code, or from this register reading a cluster. INTENT.md claims intake from incident and external report; neither has a path.

There is no address an outsider could use, no security.txt anywhere in the estate, and no defined route from "something is happening right now" to a record. The severity scale assumes a latent defect; an active incident has a different tempo, and RISK-POL-0005 (breach notification, 72 hours) is dormant with nothing wired to it.

The register is currently a self-assessment aggregator. That is a respectable thing to be and it is not what the intent says it is.

2. Remediation tracking does not track

fix_tracking: FLEX-WP-0015-T02 is a string this repo writes down and never reads. The hub knows whether that task moved; the register asks a human instead, and "has the fix moved?" is question three of every check.

That decays the moment nobody is looking, which is precisely the condition the whole cadence design assumes. The fix state should be read from the hub, and a fix that has not moved should reset nothing and escalate on its own timer — independent of whether the register happened to check.

Today, an owner who goes quiet and a fix that goes quiet look identical.

3. There is no coverage model

The register knows what was reported. It has no view of what was never looked at.

A system with zero findings is indistinguishable from a system nobody has assessed, and RISK-N-0003 records the uncomfortable evidence: every repo that has examined its own boundary this month found a defect — two for two. INTENT.md's "nobody is surprised" cannot hold while the denominator is unknown.

4. The production transition has no owner and no definition

Five findings owe a re-score at "the production transition", and RISK-F-0007's acceptance expires there. Nothing outside this repo knows that, no one has defined what the event is, and no one has been named to declare it.

An acceptance that expires on an undefined event expires on nobody's calendar.

5. The repo claims a surface it does not have

README.md and INTENT.md both say risk-nexus serves risk.coulomb.social. It serves nothing. Two documents wait on policy-nexus for an address, and the site does not exist.

Small, but it is exactly the class of claim this register grades other repos down for: a stated control that is not there.

6. Escalation has no delivery guarantee

Escalations go to an inbox and are said aloud in whatever session is running. If the operator does not read the inbox, the escalation is indistinguishable from one never sent — which is the failure this register committed on 2026-08-19 and fixed for itself with hourly-register-inbox-watch.

The same fix has not been applied to the escalation path. Nothing acknowledges, and nothing re-raises.

7. Everything runs from one checkout

The activity definitions instruct a session that may not exist. If no agent picks up the daily sweep, make due still reports and nobody reads it. The ladder degrades to decoration silently — and a 1q rung would then mean "no one checked for a quarter", which reads identically to "stable for a quarter".

clean_streak makes a suspiciously smooth climb visible, but only to someone looking.

What is deliberately not a gap

• No monitoring. RISK-N-0003 is a note, ruled so on purpose: no repo owns estate-wide detection and a register that grows probes becomes a second engineering team.
• No OpenBao access. Bounded in verification.md. Acquiring production secret-store credentials for a risk register would trade a verification problem for a worse one.
• No blocking. Build mode: a finding is information. Unchanged.

Ranking

If one thing is done next it is gap 2, because it is the only one where the register currently reports something it cannot actually see, and INTENT names it explicitly. Gaps 1 and 4 are the next two, and both are cheap.

Gap 3 is the largest and the most expensive, and it is the one that decides whether "nobody is surprised" is a claim this repo can ever make.