A risk management service.
tegwick
15b003471e
Routed by ops-warden, which owns the defect and is the affected PEP. ops-warden ships a flex-auth pre-sign authorization gate and runs with policy.enabled: false in production (warden.production.example.yaml:22, policy.py:33). Every production warden sign proceeds with no authorization decision; possession of the scoped VAULT_TOKEN is the whole model. That was a known, boring availability blocker (FLEX-WP-0007) until yesterday. RISK-F-0001 changes its shape: the production config points the gate at flex-auth.flex-auth.svc.cluster.local:8080 — the exact ClusterIP surface that authenticates no caller. Enabling the gate before RISK-F-0001 is fixed would convert an absent control into a false attestation, writing a policy_decision_id into the signature log for issuances an attacker authorized by forging the oracle. An authorization check that can be forged is worse than none, because only one of the two lies in the record afterwards. severity, disclosure and escalation left unset — risk-nexus's to set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| findings | ||
| INTENT.md | ||
| README.md | ||
risk-nexus
Risk register and regulatory intake for the estate. Serves
risk.coulomb.social. Owned by the-custodian.
Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.
It does not fix things: findings route to the repo that owns the defect. It
does not host: policy-nexus is the publication surface.
- Intent:
INTENT.md