coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
23 commits 1 branch 0 tags 849 KiB
Find a file
tegwick 868f286c0a RISK-F-0008: operator ruling on identity in audit records 
Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).

Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-20 07:19:53 +02:00
docs The inbox round: two grades corrected, one note promoted 2026-08-19 23:38:07 +02:00
findings RISK-F-0008: operator ruling on identity in audit records 2026-08-20 07:19:53 +02:00
notes The inbox round: two grades corrected, one note promoted 2026-08-19 23:38:07 +02:00
tools make check must keep watching accepted findings 2026-08-19 23:48:24 +02:00
workplans Publication handover and inbox-first as residuals of RISK-WP-0001 2026-08-19 23:41:07 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-19 23:41:18 +02:00
.repo-classification.yaml Close out RISK-WP-0001: task notes, README, repo classification 2026-08-19 23:34:34 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
Makefile RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading 2026-08-19 23:29:39 +02:00
README.md Close out RISK-WP-0001: task notes, README, repo classification 2026-08-19 23:34:34 +02:00
REGISTER.md RISK-F-0008: operator ruling on identity in audit records 2026-08-20 07:19:53 +02:00
WORK-RECORDS.md The inbox round: two grades corrected, one note promoted 2026-08-19 23:38:07 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Serves risk.coulomb.social. Owned by the-custodian.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

  • REGISTER.md — the whole register, one screen. Generated; do not edit.
  • findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
  • notes/ — seen, deliberately below the floor. Not graded, not reviewed.
  • docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
  • docs/rulings/ — the reasoning behind each grading, dated.
  • workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

  • Intent: INTENT.md