risk-nexus/STATE.md

STATE — risk-nexus

Updated: 2026-09-02 Domain: infotech · Repo: risk-nexus · Owner: the-custodian

One-line posture

The register decides. Eleven findings graded, three notes below the floor, one regulatory determination and a thirteen-entry legal policy set; every open question carries a default and a date. Today's live set is three: an open medium on qonto-assistant deny-stream completeness, an open low embargoed backup credential, and an accepted medium on audit retention.

Workplans

ID	Status	Notes
RISK-WP-0001	finished	The four instruments, the index, the first grading. Still waiting on canon kinds until 2026-09-17.
RISK-WP-0002	finished	Two findings and five public method instruments handed to policy-nexus
RISK-WP-0003	finished	Regulatory intake; the legal policy set
RISK-WP-0004	finished	Running the register: cadence, verification, inbox-before-grading
RISK-WP-0005	finished	The seven gaps from history/2026-08-21-intent-gap-analysis.md

The register

ID	Sev	Status	Disclosure	Cadence	System
RISK-F-0011	medium	open	public	instant	qonto-assistant
RISK-F-0010	low	open	embargoed	1h	railiance-platform
RISK-F-0009	high	fixed	public	instant	railiance-platform
RISK-F-0008	medium	accepted	public	1h	audit-core
RISK-F-0007	high	fixed	public	instant	estate
RISK-F-0006	high	fixed	public	instant	railiance-platform
RISK-F-0005	medium	fixed	public	instant	audit-core
RISK-F-0004	medium	fixed	public	instant	tenant-engine
RISK-F-0003	medium	fixed	public	instant	ops-warden
RISK-F-0002	medium	fixed	public	instant	ops-warden
RISK-F-0001	high	fixed	public	instant	flex-auth

Notes below the floor: RISK-N-0001 noisy neighbours · RISK-N-0003 found by reading not watching (first observation-sourced finding arrived 2026-09-02, still a note) · RISK-N-0004 zone lookup.

Not one field reads unset.

How it works

findings/*.md            source of truth; reporter fields + this repo's grade
  ↓ tools/register_index.py
REGISTER.md              generated, one screen, never hand-edited

docs/method/             severity · disclosure · escalation · review
                         verification · dependencies · check-procedure
docs/rulings/            why each grade is what it is, dated
docs/regulatory/         RISK-REG-0001 + policies/ (13, keyed by activation)
docs/verifications/      RISK-V-000N — what this repo checked itself

make due                 the work list
make fixes               state of every tracked fix, from the owner's file
make coverage            what the register has never heard from
make checked ARGS=...    record an outcome; moves the cadence rung
make check               index + malformed + waits + inbox + escalations

Cadence: instant → 1h → 8h → 24h → 48h → 96h → 7d → 14d → 1mo → 1q. Clean climbs one rung; anything moving resets to instant. The rung is the stability signal. Operator ruling, 2026-08-20.

Scheduled on activity-core: hourly-register-inbox-watch (fires only on an unread message) and daily-register-check-sweep (07:15, unconditional). Both instruct a session that exercises judgement; neither may record an outcome.

Waiting on other people

Who	On	Defaults
qonto-assistant	heartbeat / emission-cadence and a reconciliation view for audit.deny (F-0011)	2026-09-16
railiance-platform	revoke or invalidate the provider credential, remove the source default, name fix tracking (F-0010)	2026-09-15
the-custodian	canon kinds packet	2026-09-17
audit-core	keyed commitment; platform-pg co-residency horizon	2026-11-17

Verify

make check                       # everything, including the inbox
python3 tools/register_check.py  # just the register
statehub fix-consistency --repo risk-nexus

What the gap analysis changed

history/2026-08-21-intent-gap-analysis.md graded this repo against its own INTENT.md and RISK-WP-0005 closed all seven gaps the same day.

• Fix state is read, not remembered. make fixes resolves every fix_tracking against the owning repo's workplan file. Its first run found RISK-F-0005's fix already landed three days earlier, and both of RISK-F-0002's tracked records closed before that finding was filed.
• Incident intake exists, with first_observed starting the 72-hour clock in RISK-POL-0005 and escalation that is not batched.
• Public records have permanent addresses — two findings and five method instruments publish through policy-nexus; this repo remains their source.
• Coverage has a number: make coverage — 7 of 117 registered repos have ever appeared in a finding. The other 110 are unknown, not clean.

Known conditions

• Workplans are not indexed in the hub. C-06 on all four: this instance is not the identifier registrar. Needs a run with STATEHUB_REGISTRAR=1 on the production instance. The estate's read model cannot see any risk-nexus workplan.
• C-31 fires on RISK-F- ids until canon registers the kinds. Packet sent. Defaults 2026-09-17.
• OpenBao is unverifiable from here (403). Every grade touching an OpenBao policy is a grade on a document, and says so.
• RISK-F-0011 is due at instant. Graded this sitting; not clean-checked in the same sitting. The next pass climbs it if nothing moved.