risk-nexus/docs/method/production-transition.md

id	type	title	status	owner	drafted_by	drafted	adopted	decision	workplan	review_interval
RISK-METHOD-PRODUCTION	method	The production transition: what expires, and who says when	adopted	the-custodian	risk-nexus	2026-08-21	2026-08-22	937bf962-9297-40d5-a3e4-356532f179c7	RISK-WP-0005-T03	6m

The production transition

Five findings owe a re-score here. One acceptance expires here. Several dormant legal policies activate here. And until 2026-08-21 nobody had defined the event, named who declares it, or told the repos that carry the obligations.

An acceptance that expires on an undefined event expires on nobody's calendar.

Status: adopted. The custodian records adoption on 2026-08-22 in the-custodian/workplans/CUST-WP-0063-inbox-governance-packets.md, T04, decision 937bf962-9297-40d5-a3e4-356532f179c7. Risk-nexus reconciled that owner record on 2026-10-04, at commit 01e7c7b4e46c360c60ed1cd9677cc4a455cbb332. The State Hub decision lookup returned 404; adoption is attributed to the committed owner record, not a successful decision-API read. This does not declare that the transition occurred.

Adopted definition

The production transition is the first moment any system in the estate holds, processes or decides about the data of a real external person or tenant.

Deliberately not: a launch announcement, a version number, a deployment to a cluster named production, or a declaration made in advance. All four can be true while nothing real is at stake, and all four can be false on the day something is.

Two consequences worth stating, because they are what make the definition usable:

• It can happen by accident. A single real signup, a migrated contact list, one counterparty's document sent through a pipeline for testing. Which is why it is defined by what is held rather than by what was announced.
• It is not reversible. Deleting the data afterwards does not un-transition the estate; it changes the exposure and not the fact that the estate is now the kind of thing that holds real data.

Who declares it

The founder, exercising GOVERN @ estate, through the-custodian. Not this register: INTENT.md keeps "deciding what canon says" and estate-level facts with the custodian, and a risk register that unilaterally declares the estate to be in production has appointed itself.

What this register does is notice and ask. Any finding, verification or policy check that turns up real external data in a system triggers one question to the custodian: has the transition happened? The answer is theirs; the record is ours.

What fires on the day

Obligation	Carried by	Count today
Re-score every finding with production_rescore: true	this register	5
RISK-F-0007's acceptance expires — the unverified tenant boundary stops being carried	this register, escalating	1
RISK-POL-0001, 0003, 0004, 0005, 0008 activate; 0002 fully	owning repos	6 policies
RISK-F-0008's acceptance ends — the retention basis stops being an internal determination	this register	1

make check lists the first two under "owed at the production transition" today, so the size of the obligation is visible before the day rather than discovered on it.

How the register hears about it

Three routes, in order of reliability:

1. The custodian says so, in a message. Preferred, and the only one that is also a decision.
2. A finding or verification turns up real external data, and this register asks. This is the route that works when nobody remembered to declare.
3. A legal policy activates on its own condition — the accessibility or data-subject-rights entries in docs/regulatory/policies/ fire on facts about the world, not on a declaration, and a repo consulting one is evidence the transition may have happened.

Route 2 exists because route 1 is exactly the kind of announcement that gets skipped in a busy week, and the estate has already demonstrated (RISK-POL-0012) that an obligation can be live for nineteen months without anyone noticing.

What this document does not do

It does not schedule the transition, gate it, or require anything before it. In build mode a finding is information — that is unchanged. This says only what becomes true on a day that will arrive whether or not it is planned.