coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
60 commits 1 branch 0 tags 849 KiB
Find a file
tegwick 623f7ccb2e Match the record to what the owners were told, and stop the tracker hiding ids 
RISK-F-0002's fix_tracking now names ZONE-WP-0001 / WARDEN-WP-0032, with
the superseded pair kept beside it — the register had told ops-warden the
path had changed and then left the old ids in the file.

An unresolvable fix_tracking (TEN-IN-0002 is an intake, not a workplan)
printed nothing at all, which reads identically to a finding with no
tracking. It now says so by name. Both ZONE-WP-0001 and WARDEN-WP-0032
read proposed, which is the true state of the successor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 09:34:57 +02:00
activity-definitions Drop dedupe_key_strategy from the inbox watch and say what actually happens 2026-08-20 12:02:14 +02:00
docs Five owner replies worked through: one fix closed, two grades corrected, one control retired 2026-08-21 09:32:32 +02:00
findings Match the record to what the owners were told, and stop the tracker hiding ids 2026-08-21 09:34:57 +02:00
history Persist the gap analysis to history/, open RISK-WP-0005 2026-08-21 08:19:57 +02:00
notes RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
tools Match the record to what the owners were told, and stop the tracker hiding ids 2026-08-21 09:34:57 +02:00
workplans RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-19 23:41:18 +02:00
.repo-classification.yaml Classify with the canon governance_and_control tags 2026-08-20 08:08:07 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
Makefile RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
README.md RISK-WP-0005 T02, T03, T04: intake, the transition, and an honest README 2026-08-21 08:31:44 +02:00
REGISTER.md Five owner replies worked through: one fix closed, two grades corrected, one control retired 2026-08-21 09:32:32 +02:00
STATE.md STATE.md after the reply round 2026-08-21 09:34:07 +02:00
WORK-RECORDS.md STATE.md: what the gap analysis changed 2026-08-21 08:35:13 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Owned by the-custodian.

It does not serve anything yet. INTENT.md names risk.coulomb.social as the eventual surface; today publication runs through policy-nexus and three documents are waiting for an address. Recorded here rather than left as a claim, because a stated surface that does not exist is the class of thing this register grades other repos down for.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

  • REGISTER.md — the whole register, one screen. Generated; do not edit.
  • findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
  • notes/ — seen, deliberately below the floor. Not graded, not reviewed.
  • docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
  • docs/rulings/ — the reasoning behind each grading, dated.
  • workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

  • Intent: INTENT.md