tegwick 4daff5503f RISK-WP-0001-T07: rule on what was waiting outside the register

Four in as findings — tenant-engine unfiltered event read (high),
audit-core read path bounded by a flag not by code (medium), apps-pg with
no backup at all (high, escalated on spend), and the unverified tenant
boundary itself (high now, critical at production, escalated on
ownership, fix_owner deliberately unset). Two out as notes — noisy
neighbours and erasure-versus-audit, both real, neither changing a
decision this month, both carrying an event to be re-read at.

The round amended the scale twice: build mode lowers impact as well as
likelihood, and non-adversarial findings get their own likelihood
reading. The escalation rule gained a ratio test that distinguishes a
first sweep from steady-state intake, and a batching rule.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-19 23:33:08 +02:00

4.1 KiB

Raw Blame History

Register

Generated by tools/register_index.py from findings/. Do not edit by hand. Last built 2026-08-19.

7 open of 7 findings; 2 notes below the floor.

Findings

ID	Finding	System	Severity	Disclosure	Escalation	Fix owner	Status	Review by
RISK-F-0007	No consumer's tenant boundary is verified anywhere	estate	high	embargoed	required (t4, pending-operator)	unset	open	2026-09-18
RISK-F-0006	apps-pg has no backup configured at all: R0 means no recovery	railiance-platform	high	embargoed	required (t3, pending-operator)	railiance-platform	open	2026-09-18
RISK-F-0005	audit-core read path applies no tenant filter; the bound is deployment, not code	audit-core	medium	embargoed	none	audit-core	open	2026-11-17
RISK-F-0004	tenant-engine events() returns the entire event log unfiltered	tenant-engine	high	embargoed	none	tenant-engine	open	2026-09-18
RISK-F-0003	ops-warden agent read-boundary does not fire on ungraded catalog lanes	ops-warden	high	embargoed	none	ops-warden	open	2026-09-18
RISK-F-0002	ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe	ops-warden	medium	embargoed	required (t6, pending-operator)	ops-warden	open	2026-11-17
RISK-F-0001	flex-auth /v1/check authenticates no caller	flex-auth	critical	embargoed	required (t1, pending-operator)	flex-auth	open	2026-08-26

Constraints

Hazards created by acting in the wrong order. Each binds another finding's remediation.

From	Binds	Severity	Constraint
RISK-F-0002	RISK-F-0001	high	policy.enabled must not be turned on while flex-auth /v1/check answers unauthenticated callers — the gate would sign a false attestation

Embargoes

Held from publication with a stated condition. A hold with no moving condition is a stall.

Finding	Since	Lifts when	Re-decided
RISK-F-0007	2026-08-19	a verification exists for at least one consumer boundary	2026-09-18
RISK-F-0006	2026-08-19	a backup exists and a restore has been demonstrated once	2026-09-18
RISK-F-0005	2026-08-19	AUDIT-WP-0008-T04 lands a tenant filter in the read path	2026-11-17
RISK-F-0004	2026-08-19	the read path filters by tenant in code	2026-09-18
RISK-F-0003	2026-08-19	the five exec_capable lanes graded under WARDEN-WP-0032-T05	2026-09-18
RISK-F-0002	2026-08-19	FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production	2026-11-17
RISK-F-0001	2026-08-19	FLEX-WP-0015-T02 ships to production	2026-08-26

Notes (below the floor)

Seen, deliberately not findings. Not graded, not reviewed, not published.

ID	Note	Why below the floor
RISK-N-0002	Erasure duty and audit immutability have not been reconciled	no obligation exists yet — the estate holds no real person's data, so there is nothing to erase and no counterparty to owe it to
RISK-N-0001	Noisy-neighbour behaviour is uncharacterised	no decision changes today — no tenant shares a saturating workload, and what is missing is measurement work, not a defect to route

How to read this

Severity is docs/method/severity.md; disclosure docs/method/disclosure.md; escalation docs/method/escalation.md; review dates docs/method/review.md. A constraint may be graded higher than the finding that carries it — read both.

4.1 KiB Raw Blame History