risk-nexus/workplans/RISK-WP-0002-publication-handover.md

---
id: RISK-WP-0002
type: workplan
title: "Hand the publishable findings to policy-nexus, and decide what else is a public document"
domain: infotech
repo: risk-nexus
status: active
owner: the-custodian
topic_slug: risk-nexus
created: "2026-08-20"
updated: "2026-08-20"
depends_on_workplans:
  - RISK-WP-0001
state_hub_workstream_id: "b79af69c-5b08-55df-8caa-258eed3e397e"
---

# RISK-WP-0002 — publication handover

**Draft.** Sized deliberately small: two documents are ready and the rest is a
decision, not a project.

## Goal

`RISK-F-0001` and `RISK-F-0008` carry `disclosure: public` and
`publication: pending-handover`. Get them onto `policy.coulomb.social` under
`policy-nexus`'s existing contract, and settle whether this repo's method
documents are public too.

Done means: both findings have a permanent address, `publication: published`,
and a recorded answer on the method documents.

## Why now

Six findings are embargoed with lift conditions, and `RISK-F-0009` has already
demonstrated that a condition can be met and the embargo still hold. When those
conditions start clearing, publication will happen in a trickle rather than a
batch — so the route wants to exist before it is needed, not during.

`policy-nexus` has been told this is coming (2026-08-20) and asked for nothing.

## Tasks

### T01 — Publish the two ready findings

```task
id: RISK-WP-0002-T01
status: progress
priority: high
state_hub_task_id: "9ac32008-76b6-591c-82a1-ad6e2f8368b7"
```

Follow `policy-nexus`'s publication contract as it stands. Do not invent an
address scheme: `POLICY-NEXUS-WP-0001` settled addressing and permanence, and
this repo is a consumer of that decision.

Open question for T01 rather than an assumption: **is a finding published whole,
or as a summary?** `RISK-F-0001` contains a full ruling, a re-grade, a review
log and this register's own process defect. Some of that is register-internal
work product. Decide once, here, and apply it to every later publication.

In progress 2026-08-20. Operator ruled: findings publish **whole**. Publication front-matter applied to `RISK-F-0001` and `RISK-F-0008` (`revision`, `last_reviewed`, `review_interval: 6m`) with proposed ids, paths and subtitles; both now read `publication: requested`. Handover request sent to `policy-nexus`. The open question the task named is answered and recorded in `docs/rulings/2026-08-20-publication.md` — including that `RISK-F-0001` publishes with the paragraph about this register grading it wrong.

### T02 — Rule on the method documents

```task
id: RISK-WP-0002-T02
status: done
priority: medium
state_hub_task_id: "ce61806e-02c8-594f-a7b6-88f21d0ee371"
```

`docs/method/severity.md`, `disclosure.md`, `escalation.md`, `review.md`.

The case for publishing: they say how the estate grades and holds risk, which
is exactly what an outside reader needs to judge whether a published finding
means anything.

The case against: the escalation rule names the operator's own thresholds, and
the severity scale is a judgement instrument this repo revises freely. A
published instrument invites argument about the instrument.

Suggested split, to be ruled on rather than assumed: severity and disclosure
public, escalation and review internal. Escalation in particular describes when
the operator is interrupted, which is not the estate's business to advertise.

Completed 2026-08-20. Public: `severity`, `disclosure`, `review`, `verification`, `dependencies` — the instruments a reader needs to judge whether a published finding means anything. Restricted: `escalation`, because it names the operator's spend thresholds and describes when the operator personally is interrupted, which is a map of where attention is scarce and is needed by nobody judging a finding. `check-procedure` stays internal by omission: an operating manual, not an instrument.

### T03 — The standing route

```task
id: RISK-WP-0002-T03
status: done
priority: medium
state_hub_task_id: "595737b7-19f3-5c39-b208-958c57775bc2"
```

Write down what happens when an embargo lifts: who hands over, in what shape,
and how `publication: published` gets recorded back on the finding.

Small. It is a paragraph in `docs/method/disclosure.md` plus whatever
`policy-nexus` needs on their side, not a mechanism.

Completed 2026-08-20. The route is in `docs/method/disclosure.md`: the check that lifts the embargo records it, the finding gets publication front-matter in the shape `policy-nexus` already requires (`owner`, `revision`, `last_reviewed`, `review_interval`), this repo asks for an entry with `source_repo`/`source_path`/proposed `canonical_path`, and `publication: published` plus the URL comes back onto the finding — because a finding that says `public` with no address is a claim, not a publication.

One thing the contract settled for T01: `publication.json` publishes **a file from the source repo**, so a reader gets exactly what is handed over. Whole-versus-summary is therefore a decision about what a finding file contains, not about rendering.

## Non-goals

- No publication surface here. `policy-nexus` hosts; this repo hands over.
- No timed release, no coordinated disclosure, no notification tiers. Those stay
  deferred (`docs/method/disclosure.md`) until there are real users.
- No re-grading of anything to make it publishable.

## Risks

**A finding is published with an internal ruling attached.** Mitigation: T01
decides whole-versus-summary before anything ships.

**The handover becomes a project.** Mitigation: three tasks, one of which is a
paragraph. If it grows, that is a signal the publication contract does not fit
findings, and that is a conversation with `policy-nexus` rather than more tasks
here.