tegwick
7d6ded5743
Read the repo inbox after grading, which is the wrong order and is now recorded as such. flex-auth had answered the NetworkPolicy question on 2026-08-18 (narrow ingress, not default-deny — L3 becomes L2, critical becomes high) and reported RISK-F-0001 fixed at 12:35 today with live 401 probes. F-0001 closes fixed and public; its escalation is withdrawn before it was ever sent. RISK-F-0002's ordering constraint lifts with it and its trigger-6 escalation is withdrawn. audit-core had routed the erasure-versus-audit legal question here on 2026-08-18 asking for an owner. RISK-N-0002 was wrong to call it a note: the remedy is not retrofittable, so the decision can only be taken early. Promoted to RISK-F-0008, owned by this repo as regulatory intake, escalated on trigger 2. Accepted rapp-postgres's record format and ops-warden's typed-act escalation vocabulary. Reading the inbox is now question zero of every review. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| README.md | ||
| RISK-F-0001-flex-auth-unauthenticated-check.md | ||
| RISK-F-0002-ops-warden-sign-ungated.md | ||
| RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md | ||
| RISK-F-0004-tenant-engine-unfiltered-event-read.md | ||
| RISK-F-0005-audit-core-unfiltered-read-path.md | ||
| RISK-F-0006-apps-pg-no-backup-configured.md | ||
| RISK-F-0007-unverified-tenant-boundary.md | ||
| RISK-F-0008-audit-retention-legal-basis-assumed.md | ||
Filing a finding
One file per finding: findings/RISK-F-NNNN-<slug>.md, YAML front-matter,
then prose. Next id is one past the highest here.
What the reporter fills in
id: RISK-F-0004
type: finding
title: "one line, what is true — not what should be done"
status: open # open | fixed | accepted | withdrawn
reported_by: <repo> # who found it
reported_via: <repo> # who routed it here, if different
date_reported: "YYYY-MM-DD"
system: <repo> # the system the defect is in
environment: production # production | build | both
fix_owner: <repo> # who owns the fix — never risk-nexus
fix_tracking: <WP-ID or unset>
related: [RISK-F-0001] # optional
What risk-nexus fills in — leave these out
severity, severity_at_production, impact, likelihood,
fidelity_modifier, production_rescore, disclosure, embargo_*,
escalation*, constraint*, last_reviewed, review_by, graded_by,
ruling.
Setting them yourself is not an error to be corrected — it is a boundary this
repo would rather keep. The reporter says what is true; this repo says how bad
it is and who hears about it (INTENT.md). Leaving them out, or writing
unset, both work; the nag reports either way until they are graded.
What makes a good finding here
- State exposure only as far as you can support it. "Not established" is a
complete answer and grades better than a guess.
RISK-F-0001declining to assume a NetworkPolicy is the model. - Say how it was found. Provenance is a grading input.
- Suggest a direction if you have one, marked as a suggestion. The fix is yours; the grade is ours.
- A note is fine. If it would not change anyone's decision, it belongs in
notes/— see the floor indocs/method/severity.md.
After filing: make check. Then this repo grades it.