tegwick
37906c3a22
T01, T02, T04-T08 done. T03 stays in progress: the escalation rule is written and proposed, and it is not adopted until the custodian rules on it — an unadopted rule is worse than an unwritten one because it looks like coverage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.5 KiB
1.5 KiB
risk-nexus
Risk register and regulatory intake for the estate. Serves
risk.coulomb.social. Owned by the-custodian.
Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.
It does not fix things: findings route to the repo that owns the defect. It
does not host: policy-nexus is the publication surface.
Where things are
REGISTER.md— the whole register, one screen. Generated; do not edit.findings/— one file per finding.findings/README.mdis the filing contract for reporting repos.notes/— seen, deliberately below the floor. Not graded, not reviewed.docs/method/— how this repo decides: severity, disclosure, escalation, review and expiry.docs/rulings/— the reasoning behind each grading, dated.workplans/— the work.
Using it
make register # rebuild REGISTER.md from findings/
make check # verify the index, then report what is going quiet
make check reports ungraded findings, overdue reviews, stalled remediation,
embargoes due for re-decision, escalations awaiting the operator, and what is
owed at the production transition. It changes nothing.
- Intent:
INTENT.md