risk-nexus/AGENTS.md

risk-nexus — Agent Instructions

Repo Identity

Purpose: the estate's risk register. It grades, reviews, escalates and hands over findings for publication, and keeps regulatory records. It is headless: files are the source of truth, and make is the interface. See SCOPE.md for what the repository does and does not do.

Domain: infotech Repo slug: risk-nexus Topic ID: cee7bedf-2b48-46ef-8601-006474f2ad7a Workplan prefix: RISK-WP- Record prefixes: RISK-F- findings, RISK-REG- regulatory records, RISK-POL- legal policies, RISK-V- verifications, RISK-RULING- rulings

---

Working the register

Run make to list every target with examples. The usual session is:

make check                          # full sweep; the inbox comes first ("question zero")
make list                           # live findings, most severe first
make show ID=RISK-F-0012            # one record
make checked ID=<id> OUTCOME=clean|moved NOTE="what was seen"
make test                           # before committing tool changes

Method is in docs/method/: severity, disclosure, review, escalation, intake and verification. Rulings go in docs/rulings/. Never record credential values, fingerprints, lengths or shapes in any file or message.

State Hub

Workstation: http://127.0.0.1:8000. On railiance01, in-cluster: http://10.43.68.154:8000. The hub is a read model.

• Start: cat .custodian-brief.md, then GET /messages/?to_agent=risk-nexus&unread_only=true, and mark messages read once they have been acted on.
• Close: POST /progress/ with a summary. After any change to a workplan file, run statehub fix-consistency; its sync step pushes.
• Never register workplans or tasks by hand. Write the file, commit, and sync.
• Stage by explicit path, and leave other people's uncommitted files alone.

Environment and authority

Read ~/the-custodian/docs/agent-environment-orientation.md before any production, credential or GitOps work. Write authority in Mode of Authority terms: the founder's decisions are "the founder, exercising GOVERN @ estate". Never write a bare "operator". Older records in this repository still use that word; correct it only when you are editing the record anyway.

Credential and access routing

This repository needs no credentials. If that ever changes, run warden route find "<need>" --json first. ops-warden issues SSH certificates only; every other credential belongs to another subsystem.