tegwick
d5a3953f2e
Severity (impact x likelihood, fidelity modifier for controls that lie, headline-vs-constraint, build-mode double grade, the floor), disclosure (publish/embargoed/restricted, and the build-mode deferral re-taken and narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers settled plus an ordering-hazard trigger the RISK-F-0002 case forced; proposed, awaiting the custodian), review (intervals, what a review is, what missing one produces, the production re-score). Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002 medium with a high constraint on RISK-F-0001's remediation, filed as a peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no escalation. No unset field remains. REGISTER.md is generated; make check reports overdue, stalled, ungraded and unanswered escalations without changing anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# Filing a finding
|
|
|
|
One file per finding: `findings/RISK-F-NNNN-<slug>.md`, YAML front-matter,
|
|
then prose. Next id is one past the highest here.
|
|
|
|
## What the reporter fills in
|
|
|
|
```yaml
|
|
id: RISK-F-0004
|
|
type: finding
|
|
title: "one line, what is true — not what should be done"
|
|
status: open # open | fixed | accepted | withdrawn
|
|
reported_by: <repo> # who found it
|
|
reported_via: <repo> # who routed it here, if different
|
|
date_reported: "YYYY-MM-DD"
|
|
system: <repo> # the system the defect is in
|
|
environment: production # production | build | both
|
|
fix_owner: <repo> # who owns the fix — never risk-nexus
|
|
fix_tracking: <WP-ID or unset>
|
|
related: [RISK-F-0001] # optional
|
|
```
|
|
|
|
## What risk-nexus fills in — leave these out
|
|
|
|
`severity`, `severity_at_production`, `impact`, `likelihood`,
|
|
`fidelity_modifier`, `production_rescore`, `disclosure`, `embargo_*`,
|
|
`escalation*`, `constraint*`, `last_reviewed`, `review_by`, `graded_by`,
|
|
`ruling`.
|
|
|
|
Setting them yourself is not an error to be corrected — it is a boundary this
|
|
repo would rather keep. The reporter says what is true; this repo says how bad
|
|
it is and who hears about it (`INTENT.md`). Leaving them out, or writing
|
|
`unset`, both work; the nag reports either way until they are graded.
|
|
|
|
## What makes a good finding here
|
|
|
|
- **State exposure only as far as you can support it.** "Not established" is a
|
|
complete answer and grades better than a guess. `RISK-F-0001` declining to
|
|
assume a NetworkPolicy is the model.
|
|
- **Say how it was found.** Provenance is a grading input.
|
|
- **Suggest a direction if you have one, marked as a suggestion.** The fix is
|
|
yours; the grade is ours.
|
|
- **A note is fine.** If it would not change anyone's decision, it belongs in
|
|
`notes/` — see the floor in `docs/method/severity.md`.
|
|
|
|
After filing: `make check`. Then this repo grades it.
|