risk-nexus/INTENT.md

INTENT — risk-nexus

Why this repo exists

risk-nexus is where the estate holds what it knows is wrong, what might be wrong, and what the outside world requires of it — with a severity, an owner, and a date. It serves risk.coulomb.social.

Owned by the-custodian, alongside policy-nexus. One of its duties is deciding what must reach the operator personally rather than sitting in a register.

Before this repo existed, three things had nowhere to live.

Findings landed in whichever document was open. The estate's largest known gap — that no consumer's tenant boundary is verified anywhere, which is Broken Object Level Authorization, top of the OWASP API Security Top 10 since that list launched — is currently open question 3 in an unratified draft standard. It was found by research, it has no owner, no severity, and no date. A finding recorded in the document that happened to discover it is a finding that disappears when that document is superseded.

Disclosure had no mechanism. In build mode the estate publishes everything, which is right: there are no users to expose. That stops being right at production, when the same architecture disclosure a consumer must read becomes a map for an attacker. There is currently no way to hold a finding while it is fixed and publish it once it is — only publish-now or forget.

Regulation was consulted and discarded. Whether key destruction satisfies an erasure obligation, whether the estate is an in-scope entity under a given regime, what a procurement rule requires — each was researched at the moment someone needed it and never retained. The same question gets asked twice and the answer silently expires.

What it owns

• Finding intake. Security, architecture, operational and compliance findings, from any source: research, review, incident, external report.
• Severity and triage. What this actually risks, how likely, how bad.
• Remediation tracking — not remediation. Who owns the fix, what state it is in, and whether it has stalled.
• Disclosure timing. Whether a finding is publishable now, embargoed until fixed, or permanently restricted; and the record that a delay was deliberate rather than a document quietly going missing.
• Regulatory intake, scoped to regulation bearing on the estate — rules constraining data it holds, markets it sells into, or obligations it has taken on. Moved here from policy-nexus, because deciding what a rule demands of us is a judgement about risk, not an act of publishing.
• The escalation rule. What must be discussed with the operator personally rather than recorded and routed. This is the duty the-custodian carries as owner, and the rule itself must be written down rather than exercised by instinct.

What it does not own

• Fixing anything. A finding is routed to the repo that owns the defect, which fixes it under its own workplan. A risk service that fixes things becomes a second engineering team with no boundary.
• Publication. policy-nexus is the publication surface. This repo decides whether and when something is published; it does not host it.
• Blocking delivery. In build mode a finding is information, not a gate. If that changes it will be a deliberate decision recorded here, not a habit that accretes.
• Legal advice. A regulatory record states what a source said and when. What the estate must therefore do is the owning repo's decision.
• Deciding what canon says. Canon is the-custodian's and NetKingdom's. A finding may say a standard is wrong; it cannot amend one.

The failure this repo must avoid

A risk register nobody reads is worse than no register, because it converts "we did not know" into "we knew and did nothing" while changing no behaviour. Two consequences for design:

• Findings must expire or escalate. A finding that has sat untouched past its review date is itself a finding. Silence is not resolution.
• The register must be small enough to read. Recording everything makes nothing legible. If a finding would not change anyone's decision, it is a note, not a risk.

The escalation duty

Most findings should be routed and tracked without the operator's attention. Some must not be. Deciding which is the substance of the oversight the- custodian holds here, and getting it wrong in either direction is a failure: escalating everything makes the operator the queue, escalating nothing makes the register a place where serious things go quiet.

The rule is not yet written. Candidate triggers, to be settled rather than assumed: anything exposing real tenant data; anything creating a legal or regulatory obligation; anything requiring spend; anything where two repos disagree about who owns the fix; and any finding whose remediation has stalled past a stated interval.

Relationship to the rest of the estate

risk-nexus reads from everywhere, decides severity and timing, and routes work to the repo that owns it. It publishes through policy-nexus and never directly. Like that repo, it is downstream by construction and must not become a second source of truth — a finding is a claim about a system, and the system remains authoritative about itself.

The register is no longer empty. RISK-F-0001 arrived on 2026-08-17: a live authorization bypass in flex-auth, self-reported during a framework review. Three more defects surfaced in the same round and are recorded inside it as visible-but-unfiled, pending this repo setting the precedent for what warrants a record of its own.

The first finding already tested the deferral. Controlled disclosure is recorded above as deferred to production, on the reasoning that build mode has no users to expose. RISK-F-0001 is a live authorization bypass in the service every other service trusts, and today the choice is publish or hold with nothing in between. That may still be the right deferral — but it is now a decision taken with a real case in hand rather than a hypothetical one.

Also waiting: the unverified tenant boundary, the absent noisy-neighbour characterisation, and the erasure-versus-audit tension — open questions in NetKingdom's Tenancy Posture, which is a draft and not a register.

What good looks like

Nobody is surprised. A gap that was known is recorded with a severity and an owner, a regulation that applies was found before it was needed, a fix that stalled was visible while it stalled, and the things that genuinely needed the operator's judgement reached them without the things that did not.