coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
71 commits 1 branch 0 tags 1 MiB
Find a file
custodian-sync 93e142f2b5 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-22:
  - update .custodian-brief.md for risk-nexus

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
2026-09-22 07:58:43 +02:00
activity-definitions Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
docs Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
findings Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
history Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
notes Intake RISK-F-0011 and climb the due checks 2026-09-02 10:14:43 +02:00
tests Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
tools Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
workplans Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-09-22 07:58:43 +02:00
.gitignore Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
.repo-classification.yaml Classify with the canon governance_and_control tags 2026-08-20 08:08:07 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
Makefile Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
README.md Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
REGISTER.md Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
SCOPE.md Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
STATE.md Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00
WORK-RECORDS.md Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007) 2026-09-22 07:56:58 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Owned by the-custodian.

It does not serve its own site. INTENT.md names risk.coulomb.social as the eventual surface; today public findings and method instruments have permanent addresses through policy-nexus. The source stays here and the published page records its exact source revision.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

  • REGISTER.md — the whole register, one screen. Generated; do not edit.
  • findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
  • notes/ — seen, deliberately below the floor. Not graded, not reviewed.
  • docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
  • docs/rulings/ — the reasoning behind each grading, dated.
  • workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

All check stages run even when the index is stale; the command still exits nonzero for a failed stage. make due shows the full obligation report and inbox freshness, including full regulatory policies, embargo review deadlines and publication handovers that remain pending after a finding closes. make checked accepts finding, regulatory determination and full policy IDs; it records an actual review, not a repair for an overdue warning.

make fixes distinguishes owner workplans from recorded acceptance obligations. make check and make due also show explicit closure_condition evidence still owed by live findings, even when a source workplan has finished. Acceptance terms and a finished workplan are not proof of runtime closure.

Run make test for isolated regression checks. Python 3 and PyYAML are required.

  • Intent: INTENT.md
  • Current capability: SCOPE.md