A risk management service.
tegwick
45db859942
Owned by the-custodian alongside policy-nexus, with the duty of deciding what must reach the operator personally. Three things had nowhere to live. Findings landed in whichever document discovered them - the estate's largest known gap is currently open question 3 in an unratified draft, with no owner, severity or date. Disclosure had no mechanism, only publish-now or forget, which is fine in build mode and wrong at production. And regulation was researched at the moment it was needed and never retained. Regulatory intake moves here from policy-nexus T06: deciding what a rule demands of us is a judgement about risk, not an act of publishing. That also leaves policy-nexus doing one thing, which was the point. Two constraints written in deliberately. This repo does not fix - findings route to the repo owning the defect, because a risk service that fixes becomes a second engineering team with no boundary. And it does not block delivery in build mode; if that changes it will be a decision recorded here, not a habit that accretes. The escalation rule is named as unwritten rather than invented. Getting it wrong in either direction fails: escalate everything and the operator becomes the queue, escalate nothing and the register is where serious things go quiet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| INTENT.md | ||
| README.md | ||
risk-nexus
Risk register and regulatory intake for the estate. Serves
risk.coulomb.social. Owned by the-custodian.
Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.
It does not fix things: findings route to the repo that owns the defect. It
does not host: policy-nexus is the publication surface.
- Intent:
INTENT.md