risk-nexus

Risk register and regulatory intake for the estate. Serves risk.coulomb.social. Owned by the-custodian.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

• REGISTER.md — the whole register, one screen. Generated; do not edit.
• findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
• notes/ — seen, deliberately below the floor. Not graded, not reviewed.
• docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
• docs/rulings/ — the reasoning behind each grading, dated.
• workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

• Intent: INTENT.md