History

tegwick 00106ffcdd Operator decisions on RISK-F-0006 and RISK-F-0007 F-0006: backup spend approved, no ceiling stated. Permission is no longer the blocker; the embargo still needs a demonstrated restore. F-0007: pragmatic default before production — accepted (not closed, keeps its severity, review interval and production re-score, stays visible in the register), with a written on-request path so a named consumer boundary can be verified when someone asks. The acceptance expires at the production transition, which is an event and not a date. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-08-19 23:48:09 +02:00
..
README.md	RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading	2026-08-19 23:29:39 +02:00
RISK-F-0001-flex-auth-unauthenticated-check.md	The inbox round: two grades corrected, one note promoted	2026-08-19 23:38:07 +02:00
RISK-F-0002-ops-warden-sign-ungated.md	The inbox round: two grades corrected, one note promoted	2026-08-19 23:38:07 +02:00
RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md	RISK-F-0003: exposure closed, structural fix outstanding	2026-08-19 23:45:56 +02:00
RISK-F-0004-tenant-engine-unfiltered-event-read.md	RISK-WP-0001-T07: rule on what was waiting outside the register	2026-08-19 23:33:08 +02:00
RISK-F-0005-audit-core-unfiltered-read-path.md	RISK-WP-0001-T07: rule on what was waiting outside the register	2026-08-19 23:33:08 +02:00
RISK-F-0006-apps-pg-no-backup-configured.md	Operator decisions on RISK-F-0006 and RISK-F-0007	2026-08-19 23:48:09 +02:00
RISK-F-0007-unverified-tenant-boundary.md	Operator decisions on RISK-F-0006 and RISK-F-0007	2026-08-19 23:48:09 +02:00
RISK-F-0008-audit-retention-legal-basis-assumed.md	The inbox round: two grades corrected, one note promoted	2026-08-19 23:38:07 +02:00

README.md

Filing a finding

One file per finding: findings/RISK-F-NNNN-<slug>.md, YAML front-matter, then prose. Next id is one past the highest here.

What the reporter fills in

id: RISK-F-0004
type: finding
title: "one line, what is true — not what should be done"
status: open                  # open | fixed | accepted | withdrawn
reported_by: <repo>           # who found it
reported_via: <repo>          # who routed it here, if different
date_reported: "YYYY-MM-DD"
system: <repo>                # the system the defect is in
environment: production       # production | build | both
fix_owner: <repo>             # who owns the fix — never risk-nexus
fix_tracking: <WP-ID or unset>
related: [RISK-F-0001]        # optional

What risk-nexus fills in — leave these out

severity, severity_at_production, impact, likelihood, fidelity_modifier, production_rescore, disclosure, embargo_*, escalation*, constraint*, last_reviewed, review_by, graded_by, ruling.

Setting them yourself is not an error to be corrected — it is a boundary this repo would rather keep. The reporter says what is true; this repo says how bad it is and who hears about it (INTENT.md). Leaving them out, or writing unset, both work; the nag reports either way until they are graded.

What makes a good finding here

State exposure only as far as you can support it. "Not established" is a complete answer and grades better than a guess. RISK-F-0001 declining to assume a NetworkPolicy is the model.
Say how it was found. Provenance is a grading input.
Suggest a direction if you have one, marked as a suggestion. The fix is yours; the grade is ours.
A note is fine. If it would not change anyone's decision, it belongs in notes/ — see the floor in docs/method/severity.md.

After filing: make check. Then this repo grades it.