tegwick
d5a3953f2e
Severity (impact x likelihood, fidelity modifier for controls that lie, headline-vs-constraint, build-mode double grade, the floor), disclosure (publish/embargoed/restricted, and the build-mode deferral re-taken and narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers settled plus an ordering-hazard trigger the RISK-F-0002 case forced; proposed, awaiting the custodian), review (intervals, what a review is, what missing one produces, the production re-score). Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002 medium with a high constraint on RISK-F-0001's remediation, filed as a peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no escalation. No unset field remains. REGISTER.md is generated; make check reports overdue, stalled, ungraded and unanswered escalations without changing anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.9 KiB
1.9 KiB
Filing a finding
One file per finding: findings/RISK-F-NNNN-<slug>.md, YAML front-matter,
then prose. Next id is one past the highest here.
What the reporter fills in
id: RISK-F-0004
type: finding
title: "one line, what is true — not what should be done"
status: open # open | fixed | accepted | withdrawn
reported_by: <repo> # who found it
reported_via: <repo> # who routed it here, if different
date_reported: "YYYY-MM-DD"
system: <repo> # the system the defect is in
environment: production # production | build | both
fix_owner: <repo> # who owns the fix — never risk-nexus
fix_tracking: <WP-ID or unset>
related: [RISK-F-0001] # optional
What risk-nexus fills in — leave these out
severity, severity_at_production, impact, likelihood,
fidelity_modifier, production_rescore, disclosure, embargo_*,
escalation*, constraint*, last_reviewed, review_by, graded_by,
ruling.
Setting them yourself is not an error to be corrected — it is a boundary this
repo would rather keep. The reporter says what is true; this repo says how bad
it is and who hears about it (INTENT.md). Leaving them out, or writing
unset, both work; the nag reports either way until they are graded.
What makes a good finding here
- State exposure only as far as you can support it. "Not established" is a
complete answer and grades better than a guess.
RISK-F-0001declining to assume a NetworkPolicy is the model. - Say how it was found. Provenance is a grading input.
- Suggest a direction if you have one, marked as a suggestion. The fix is yours; the grade is ours.
- A note is fine. If it would not change anyone's decision, it belongs in
notes/— see the floor indocs/method/severity.md.
After filing: make check. Then this repo grades it.