tegwick
868f286c0a
Opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, and policy decisions tracked to the responsible party so minimising the record does not cost accountability. Zone-level privacy guarantees may raise the floor later (zone-engine). Shrinks the population the legal basis has to cover, and inverts the accrual: each day's records now carry less that would need erasing. The written determination and the trigger list stay outstanding, so the escalation is partially-answered rather than closed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
55 lines
4.6 KiB
Markdown
55 lines
4.6 KiB
Markdown
# Register
|
|
|
|
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-20.
|
|
|
|
6 open of 9 findings; 2 notes below the floor.
|
|
|
|
## Findings
|
|
|
|
| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by |
|
|
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|
|
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, partially-answered) | risk-nexus | open | 2026-11-17 |
|
|
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 2026-09-18 |
|
|
| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | 2026-09-18 |
|
|
| [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | 2026-11-17 |
|
|
| [RISK-F-0004](findings/RISK-F-0004-agent-boundary-policy-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | unset | unset | unset | railiance-platform | open | — |
|
|
| [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | 2026-09-18 |
|
|
| [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | mitigated | 2026-09-18 |
|
|
| [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | 2026-11-17 |
|
|
| [RISK-F-0001](findings/RISK-F-0001-flex-auth-unauthenticated-check.md) | flex-auth /v1/check authenticates no caller | flex-auth | **high** | public | **withdrawn** (t1, withdrawn-before-sending) | flex-auth | fixed | 2026-08-26 |
|
|
|
|
## Constraints
|
|
|
|
Hazards created by acting in the wrong order. Each binds another finding's remediation.
|
|
|
|
| From | Binds | Severity | Constraint |
|
|
| --- | --- | --- | --- |
|
|
| RISK-F-0002 | RISK-F-0001 | **lifted** | LIFTED 2026-08-19 — flex-auth /v1/check now authenticates callers (RISK-F-0001 fixed). Enabling policy.enabled is now an availability question for ops-warden, no longer an attestation hazard. |
|
|
|
|
## Embargoes
|
|
|
|
Held from publication with a stated condition. A hold with no moving condition is a stall.
|
|
|
|
| Finding | Since | Lifts when | Re-decided |
|
|
| --- | --- | --- | --- |
|
|
| RISK-F-0007 | 2026-08-19 | a verification exists for at least one consumer boundary | 2026-09-18 |
|
|
| RISK-F-0006 | 2026-08-19 | a backup exists and a restore has been demonstrated once | 2026-09-18 |
|
|
| RISK-F-0005 | 2026-08-19 | AUDIT-WP-0008-T04 lands a tenant filter in the read path | 2026-11-17 |
|
|
| RISK-F-0004 | 2026-08-19 | the read path filters by tenant in code | 2026-09-18 |
|
|
| RISK-F-0003 | 2026-08-19 | the five exec_capable lanes graded under WARDEN-WP-0032-T05 | 2026-09-18 |
|
|
| RISK-F-0002 | 2026-08-19 | FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production | 2026-11-17 |
|
|
|
|
## Notes (below the floor)
|
|
|
|
Seen, deliberately not findings. Not graded, not reviewed, not published.
|
|
|
|
| ID | Note | Why below the floor |
|
|
| --- | --- | --- |
|
|
| [RISK-N-0003](notes/RISK-N-0003-defects-found-by-reading-not-monitoring.md) | Every defect in this register was found by reading, none by monitoring | no owner and no defect — it is an argument about where to invest detection, and the register cannot route an argument |
|
|
| [RISK-N-0001](notes/RISK-N-0001-noisy-neighbour-uncharacterised.md) | Noisy-neighbour behaviour is uncharacterised | no decision changes today — no tenant shares a saturating workload, and what is missing is measurement work, not a defect to route |
|
|
|
|
## How to read this
|
|
|
|
Severity is `docs/method/severity.md`; disclosure `docs/method/disclosure.md`;
|
|
escalation `docs/method/escalation.md`; review dates `docs/method/review.md`.
|
|
A constraint may be graded higher than the finding that carries it — read both.
|