risk-nexus/workplans/RISK-WP-0006-keep-review-obligations-visible.md

---
id: RISK-WP-0006
type: workplan
title: "Keep review obligations visible when the index or records are stale"
domain: infotech
repo: risk-nexus
status: finished
owner: the-custodian
topic_slug: risk-nexus
created: "2026-09-05"
updated: "2026-09-05"
depends_on_workplans:
  - RISK-WP-0005
state_hub_workstream_id: "900ba790-c5b8-523c-947f-5cd743fa1d58"
---

# RISK-WP-0006 — keep review obligations visible

## Problem and priority

The [scope assessment](../history/2026-09-05-014333-scope-intent-assessment.md)
found that `make check` stops before showing overdue work, all four full legal
policies are outside review discovery, and disclosure obligations disappear
from the work list. These are the first priorities: they hide known obligations
and can be corrected within this repository without a new service or mandate.
Malformed dates must not defeat the repaired reporting path.

## Tasks and acceptance

### T01 — Run every check stage even if another fails

```task
id: RISK-WP-0006-T01
status: done
priority: high
state_hub_task_id: "44f58905-fc81-571f-b112-e37001b02ed9"
```

Run index, register and inbox checks independently, preserving a nonzero result
if any stage fails. A stale index and a broken register stage must still allow
the inbox stage to run. No regeneration or grading as a side effect.

### T02 — Include full policies in the review workflow

```task
id: RISK-WP-0006-T02
status: done
priority: high
state_hub_task_id: "4a9cd603-7722-5e3b-833e-b65109f33d8a"
```

Discover nested regulatory records, excluding README catalogues. Full policies
must appear when due and accept recorded outcomes. `make due` must expose these
obligations to existing scheduled sessions, not filter them out. Invalid dates
must be reported without aborting the report; invalid deferrals must not write.

### T03 — Keep disclosure obligations visible after closure

```task
id: RISK-WP-0006-T03
status: done
priority: high
state_hub_task_id: "3d250ebe-1d06-55f2-a4cc-8a716b12414f"
```

Report due or missing embargo review dates and pending publication handovers
across all findings, including fixed findings. Surface them through `make due`.
Do not publish, lift embargoes or change finding statuses automatically.

### T04 — Correct the archived fix completion signal

```task
id: RISK-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "79b0c627-9fff-59e2-a400-8d3e9585504b"
```

An archived completed workplan must not be reported as an unchanged unfinished
fix just because its display status carries an archive suffix. Preserve the
archive label and the documented whole-file timestamp limitation.

### T05 — Verify, document and reconcile registration

```task
id: RISK-WP-0006-T05
status: done
priority: high
state_hub_task_id: "96d06e61-84e7-5c3a-9d79-b700408afaf7"
```

Add focused regression tests for the failures above using isolated files and
mocked external reads. Run them and the live read-only reporting path. Update
SCOPE, usage and the operational instructions, and reconcile the workplan and
task records with State Hub. Record actual registration results and residuals.

## Scope boundary and next priorities

This plan repairs visibility, not the overdue substantive reviews themselves.
External intake delivery, urgent incident handling, scheduler-to-session delivery
proof and the production declaration require separate operational decisions or
cross-repository work. They remain open in the assessment. Missing fix records
and the F-0011 notice require evidence reconciliation, not automatic closure.
No legal conclusions, grades, acknowledgements or messages are generated here.

## Verification and completion evidence

Implementation complete for T01–T04. Eight isolated regression tests pass via
`make test`, covering stage failures, nested policy discovery and recorded
reviews, invalid dates and deferrals, disclosure after closure, and archived
completed fixes. `git diff --check` passes.

Live validation first ran with a stale index: every report still executed and
Make returned nonzero. After `make register`, `make check` and `make due` both
returned zero while exposing all four overdue policies, eight pending handovers,
three overdue findings and the newer F-0011 inbox notice. No finding or policy
was stamped reviewed, re-graded or closed.

Registration: the normal CLI and an outside-sandbox retry timed out on State Hub
reads. A longer-timeout full reconciliation was stopped after prolonged API
reads without a completion result. Targeted registration succeeded
through the same workplan/task API and deterministic IDs used by the reconciler.
The workplan UUID is `900ba790-c5b8-523c-947f-5cd743fa1d58`; all five task
UUIDs are recorded beside their source blocks. Completion and the file binding
are synchronized through the API; the local index uses the reconciler renderer.

Residuals: external contact delivery, incident clocks, independent execution
assurance, substantive overdue reviews, method review scheduling and production
transition decisions remain open. The updated activity definition is local
source; deployment/synchronization to activity-core was not performed.