tegwick
449307bea2
T02: docs/method/intake.md names all four sources INTENT claims and builds the two that had none. An incident files first and grades within the hour, carries first_observed because obligations run from it, sits at instant until it is over, and escalates immediately rather than batched — a 72-hour notification clock outranks the rule that protects the operator's attention. External report has no address anywhere in the estate, and where one lives is policy-nexus's and the custodian's, so it is routed with a proposal rather than invented here. T03: the production transition defined by what is held rather than what was announced — the first moment any system holds real external data, which can happen by accident and cannot be reversed. Declared by the custodian; noticed and asked about by this register. Lists what fires: five re-scores, two acceptances ending, six policies activating. T04: the README no longer claims a surface this repo does not have. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.8 KiB
risk-nexus
Risk register and regulatory intake for the estate. Owned by the-custodian.
It does not serve anything yet. INTENT.md names risk.coulomb.social as
the eventual surface; today publication runs through policy-nexus and three
documents are waiting for an address. Recorded here rather than left as a
claim, because a stated surface that does not exist is the class of thing this
register grades other repos down for.
Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.
It does not fix things: findings route to the repo that owns the defect. It
does not host: policy-nexus is the publication surface.
Where things are
REGISTER.md— the whole register, one screen. Generated; do not edit.findings/— one file per finding.findings/README.mdis the filing contract for reporting repos.notes/— seen, deliberately below the floor. Not graded, not reviewed.docs/method/— how this repo decides: severity, disclosure, escalation, review and expiry.docs/rulings/— the reasoning behind each grading, dated.workplans/— the work.
Using it
make register # rebuild REGISTER.md from findings/
make check # verify the index, then report what is going quiet
make check reports ungraded findings, overdue reviews, stalled remediation,
embargoes due for re-decision, escalations awaiting the operator, and what is
owed at the production transition. It changes nothing.
- Intent:
INTENT.md