coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
56 commits 1 branch 0 tags 849 KiB
Find a file
tegwick a05ca6822b RISK-WP-0005 finished: the seven gaps closed 
T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 08:34:30 +02:00
activity-definitions Drop dedupe_key_strategy from the inbox watch and say what actually happens 2026-08-20 12:02:14 +02:00
docs RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
findings RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
history Persist the gap analysis to history/, open RISK-WP-0005 2026-08-21 08:19:57 +02:00
notes RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
tools RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
workplans RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-19 23:41:18 +02:00
.repo-classification.yaml Classify with the canon governance_and_control tags 2026-08-20 08:08:07 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
Makefile RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
README.md RISK-WP-0005 T02, T03, T04: intake, the transition, and an honest README 2026-08-21 08:31:44 +02:00
REGISTER.md RISK-WP-0005 finished: the seven gaps closed 2026-08-21 08:34:30 +02:00
STATE.md Persist the gap analysis to history/, open RISK-WP-0005 2026-08-21 08:19:57 +02:00
WORK-RECORDS.md RISK-WP-0005-T01: read the fix records, and two findings moved 2026-08-21 08:29:38 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Owned by the-custodian.

It does not serve anything yet. INTENT.md names risk.coulomb.social as the eventual surface; today publication runs through policy-nexus and three documents are waiting for an address. Recorded here rather than left as a claim, because a stated surface that does not exist is the class of thing this register grades other repos down for.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

Where things are

  • REGISTER.md — the whole register, one screen. Generated; do not edit.
  • findings/ — one file per finding. findings/README.md is the filing contract for reporting repos.
  • notes/ — seen, deliberately below the floor. Not graded, not reviewed.
  • docs/method/ — how this repo decides: severity, disclosure, escalation, review and expiry.
  • docs/rulings/ — the reasoning behind each grading, dated.
  • workplans/ — the work.

Using it

make register   # rebuild REGISTER.md from findings/
make check      # verify the index, then report what is going quiet

make check reports ungraded findings, overdue reviews, stalled remediation, embargoes due for re-decision, escalations awaiting the operator, and what is owed at the production transition. It changes nothing.

  • Intent: INTENT.md