tegwick
a798a4c771
Publication handover (two findings ready, three tasks, one of which is a paragraph); regulatory intake as a working remit rather than one record, carrying RISK-REG-0001's open items; and running the register, where every task traces to something that actually went wrong in week one — grading before reading the inbox, a status the tooling did not know, an id collision, two gradings resting on file comparison because a token expired, and an on-request path nobody has walked. All three are status: proposed. The custodian decides which become active and in what order. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
110 lines
3.6 KiB
Markdown
110 lines
3.6 KiB
Markdown
---
|
|
id: RISK-WP-0002
|
|
type: workplan
|
|
title: "Hand the publishable findings to policy-nexus, and decide what else is a public document"
|
|
domain: infotech
|
|
repo: risk-nexus
|
|
status: proposed
|
|
owner: the-custodian
|
|
topic_slug: risk-nexus
|
|
created: "2026-08-20"
|
|
updated: "2026-08-20"
|
|
depends_on_workplans:
|
|
- RISK-WP-0001
|
|
---
|
|
|
|
# RISK-WP-0002 — publication handover
|
|
|
|
**Draft.** Sized deliberately small: two documents are ready and the rest is a
|
|
decision, not a project.
|
|
|
|
## Goal
|
|
|
|
`RISK-F-0001` and `RISK-F-0008` carry `disclosure: public` and
|
|
`publication: pending-handover`. Get them onto `policy.coulomb.social` under
|
|
`policy-nexus`'s existing contract, and settle whether this repo's method
|
|
documents are public too.
|
|
|
|
Done means: both findings have a permanent address, `publication: published`,
|
|
and a recorded answer on the method documents.
|
|
|
|
## Why now
|
|
|
|
Six findings are embargoed with lift conditions, and `RISK-F-0009` has already
|
|
demonstrated that a condition can be met and the embargo still hold. When those
|
|
conditions start clearing, publication will happen in a trickle rather than a
|
|
batch — so the route wants to exist before it is needed, not during.
|
|
|
|
`policy-nexus` has been told this is coming (2026-08-20) and asked for nothing.
|
|
|
|
## Tasks
|
|
|
|
### T01 — Publish the two ready findings
|
|
|
|
```task
|
|
id: RISK-WP-0002-T01
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Follow `policy-nexus`'s publication contract as it stands. Do not invent an
|
|
address scheme: `POLICY-NEXUS-WP-0001` settled addressing and permanence, and
|
|
this repo is a consumer of that decision.
|
|
|
|
Open question for T01 rather than an assumption: **is a finding published whole,
|
|
or as a summary?** `RISK-F-0001` contains a full ruling, a re-grade, a review
|
|
log and this register's own process defect. Some of that is register-internal
|
|
work product. Decide once, here, and apply it to every later publication.
|
|
|
|
### T02 — Rule on the method documents
|
|
|
|
```task
|
|
id: RISK-WP-0002-T02
|
|
status: todo
|
|
priority: medium
|
|
```
|
|
|
|
`docs/method/severity.md`, `disclosure.md`, `escalation.md`, `review.md`.
|
|
|
|
The case for publishing: they say how the estate grades and holds risk, which
|
|
is exactly what an outside reader needs to judge whether a published finding
|
|
means anything.
|
|
|
|
The case against: the escalation rule names the operator's own thresholds, and
|
|
the severity scale is a judgement instrument this repo revises freely. A
|
|
published instrument invites argument about the instrument.
|
|
|
|
Suggested split, to be ruled on rather than assumed: severity and disclosure
|
|
public, escalation and review internal. Escalation in particular describes when
|
|
the operator is interrupted, which is not the estate's business to advertise.
|
|
|
|
### T03 — The standing route
|
|
|
|
```task
|
|
id: RISK-WP-0002-T03
|
|
status: todo
|
|
priority: medium
|
|
```
|
|
|
|
Write down what happens when an embargo lifts: who hands over, in what shape,
|
|
and how `publication: published` gets recorded back on the finding.
|
|
|
|
Small. It is a paragraph in `docs/method/disclosure.md` plus whatever
|
|
`policy-nexus` needs on their side, not a mechanism.
|
|
|
|
## Non-goals
|
|
|
|
- No publication surface here. `policy-nexus` hosts; this repo hands over.
|
|
- No timed release, no coordinated disclosure, no notification tiers. Those stay
|
|
deferred (`docs/method/disclosure.md`) until there are real users.
|
|
- No re-grading of anything to make it publishable.
|
|
|
|
## Risks
|
|
|
|
**A finding is published with an internal ruling attached.** Mitigation: T01
|
|
decides whole-versus-summary before anything ships.
|
|
|
|
**The handover becomes a project.** Mitigation: three tasks, one of which is a
|
|
paragraph. If it grows, that is a signal the publication contract does not fit
|
|
findings, and that is a conversation with `policy-nexus` rather than more tasks
|
|
here.
|