coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
28 commits 1 branch 0 tags 880 KiB
Find a file
tegwick 42bbf5d2dc Adaptive check cadence: the interval is earned, not assigned 
Operator ruling 2026-08-20. Severity no longer sets the review interval.
A check that comes back clean climbs one rung — instant, 1h, 8h, 24h,
48h, 96h, 7d, 14d, 1mo, 1q — and anything wrong drops straight back to
instant. A quarter is the ceiling. The operator may defer an instant
finding to a stated date; that is the only other way off the bottom rung.

The rung is the point: it says how stable the estate has been on that
matter, which is information severity does not carry. Volatile things get
attention automatically; quiet things stop consuming it; neither
judgement has to be made by a person who might be busy.

Escalation trigger 5 rebased onto the ladder — fourteen days at the
bottom rung, whether that is failing checks or no checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-20 07:43:51 +02:00
docs Adaptive check cadence: the interval is earned, not assigned 2026-08-20 07:43:51 +02:00
findings Adaptive check cadence: the interval is earned, not assigned 2026-08-20 07:43:51 +02:00
notes RISK-N-0004: route the zone-lookup requirement to zone-engine as a note 2026-08-20 07:24:33 +02:00
tools Adaptive check cadence: the interval is earned, not assigned 2026-08-20 07:43:51 +02:00
workplans Publication handover and inbox-first as residuals of RISK-WP-0001 2026-08-19 23:41:07 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-19 23:41:18 +02:00
.repo-classification.yaml Close out RISK-WP-0001: task notes, README, repo classification 2026-08-19 23:34:34 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
Makefile RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading 2026-08-19 23:29:39 +02:00
README.md Close out RISK-WP-0001: task notes, README, repo classification 2026-08-19 23:34:34 +02:00
REGISTER.md Adaptive check cadence: the interval is earned, not assigned 2026-08-20 07:43:51 +02:00
WORK-RECORDS.md The inbox round: two grades corrected, one note promoted 2026-08-19 23:38:07 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Serves risk.coulomb.social. Owned by the-custodian.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

  • REGISTER.md — the whole register, one screen. Generated; do not edit.
  • findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
  • notes/ — seen, deliberately below the floor. Not graded, not reviewed.
  • docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
  • docs/rulings/ — the reasoning behind each grading, dated.
  • workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

  • Intent: INTENT.md