tegwick
449307bea2
T02: docs/method/intake.md names all four sources INTENT claims and builds the two that had none. An incident files first and grades within the hour, carries first_observed because obligations run from it, sits at instant until it is over, and escalates immediately rather than batched — a 72-hour notification clock outranks the rule that protects the operator's attention. External report has no address anywhere in the estate, and where one lives is policy-nexus's and the custodian's, so it is routed with a proposal rather than invented here. T03: the production transition defined by what is held rather than what was announced — the first moment any system holds real external data, which can happen by accident and cannot be reversed. Declared by the custodian; noticed and asked about by this register. Lists what fires: five re-scores, two acceptances ending, six policies activating. T04: the README no longer claims a surface this repo does not have. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
1.8 KiB
Markdown
44 lines
1.8 KiB
Markdown
# risk-nexus
|
|
|
|
Risk register and regulatory intake for the estate. Owned by `the-custodian`.
|
|
|
|
**It does not serve anything yet.** `INTENT.md` names `risk.coulomb.social` as
|
|
the eventual surface; today publication runs through `policy-nexus` and three
|
|
documents are waiting for an address. Recorded here rather than left as a
|
|
claim, because a stated surface that does not exist is the class of thing this
|
|
register grades other repos down for.
|
|
|
|
Holds findings — security, architecture, operational, compliance — with a
|
|
severity, an owner and a date; decides whether and when each is published; and
|
|
decides which must reach the operator personally rather than sitting in a
|
|
register.
|
|
|
|
It does not fix things: findings route to the repo that owns the defect. It
|
|
does not host: `policy-nexus` is the publication surface.
|
|
|
|
## Where things are
|
|
|
|
- **`REGISTER.md`** — the whole register, one screen. Generated; do not edit.
|
|
- **`findings/`** — one file per finding. `findings/README.md` is the filing
|
|
contract for reporting repos.
|
|
- **`notes/`** — seen, deliberately below the floor. Not graded, not reviewed.
|
|
- **`docs/method/`** — how this repo decides:
|
|
[severity](docs/method/severity.md),
|
|
[disclosure](docs/method/disclosure.md),
|
|
[escalation](docs/method/escalation.md),
|
|
[review and expiry](docs/method/review.md).
|
|
- **`docs/rulings/`** — the reasoning behind each grading, dated.
|
|
- **`workplans/`** — the work.
|
|
|
|
## Using it
|
|
|
|
```
|
|
make register # rebuild REGISTER.md from findings/
|
|
make check # verify the index, then report what is going quiet
|
|
```
|
|
|
|
`make check` reports ungraded findings, overdue reviews, stalled remediation,
|
|
embargoes due for re-decision, escalations awaiting the operator, and what is
|
|
owed at the production transition. It changes nothing.
|
|
|
|
- Intent: `INTENT.md`
|