tegwick
449307bea2
T02: docs/method/intake.md names all four sources INTENT claims and builds the two that had none. An incident files first and grades within the hour, carries first_observed because obligations run from it, sits at instant until it is over, and escalates immediately rather than batched — a 72-hour notification clock outranks the rule that protects the operator's attention. External report has no address anywhere in the estate, and where one lives is policy-nexus's and the custodian's, so it is routed with a proposal rather than invented here. T03: the production transition defined by what is held rather than what was announced — the first moment any system holds real external data, which can happen by accident and cannot be reversed. Declared by the custodian; noticed and asked about by this register. Lists what fires: five re-scores, two acceptances ending, six policies activating. T04: the README no longer claims a surface this repo does not have. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3.8 KiB
| id | type | title | status | owner | drafted_by | drafted | workplan | review_interval |
|---|---|---|---|---|---|---|---|---|
| RISK-METHOD-PRODUCTION | method | The production transition: what expires, and who says when | proposed | the-custodian | risk-nexus | 2026-08-21 | RISK-WP-0005-T03 | 6m |
The production transition
Five findings owe a re-score here. One acceptance expires here. Several dormant legal policies activate here. And until 2026-08-21 nobody had defined the event, named who declares it, or told the repos that carry the obligations.
An acceptance that expires on an undefined event expires on nobody's calendar.
Status: proposed. The definition is the custodian's; the plumbing is
this repo's.
Proposed definition
The production transition is the first moment any system in the estate holds, processes or decides about the data of a real external person or tenant.
Deliberately not: a launch announcement, a version number, a deployment to a cluster named production, or a declaration made in advance. All four can be true while nothing real is at stake, and all four can be false on the day something is.
Two consequences worth stating, because they are what make the definition usable:
- It can happen by accident. A single real signup, a migrated contact list, one counterparty's document sent through a pipeline for testing. Which is why it is defined by what is held rather than by what was announced.
- It is not reversible. Deleting the data afterwards does not un-transition the estate; it changes the exposure and not the fact that the estate is now the kind of thing that holds real data.
Who declares it
The operator, through the-custodian. Not this register: INTENT.md keeps
"deciding what canon says" and estate-level facts with the custodian, and a
risk register that unilaterally declares the estate to be in production has
appointed itself.
What this register does is notice and ask. Any finding, verification or policy check that turns up real external data in a system triggers one question to the custodian: has the transition happened? The answer is theirs; the record is ours.
What fires on the day
| Obligation | Carried by | Count today |
|---|---|---|
Re-score every finding with production_rescore: true |
this register | 5 |
RISK-F-0007's acceptance expires — the unverified tenant boundary stops being carried |
this register, escalating | 1 |
RISK-POL-0001, 0003, 0004, 0005, 0008 activate; 0002 fully |
owning repos | 6 policies |
RISK-F-0008's acceptance ends — the retention basis stops being an internal determination |
this register | 1 |
make check lists the first two under "owed at the production transition"
today, so the size of the obligation is visible before the day rather than
discovered on it.
How the register hears about it
Three routes, in order of reliability:
- The custodian says so, in a message. Preferred, and the only one that is also a decision.
- A finding or verification turns up real external data, and this register asks. This is the route that works when nobody remembered to declare.
- A legal policy activates on its own condition — the accessibility or
data-subject-rights entries in
docs/regulatory/policies/fire on facts about the world, not on a declaration, and a repo consulting one is evidence the transition may have happened.
Route 2 exists because route 1 is exactly the kind of announcement that gets
skipped in a busy week, and the estate has already demonstrated (RISK-POL-0012)
that an obligation can be live for nineteen months without anyone noticing.
What this document does not do
It does not schedule the transition, gate it, or require anything before it. In build mode a finding is information — that is unchanged. This says only what becomes true on a day that will arrive whether or not it is planned.