risk-nexus/STATE.md

STATE — risk-nexus

Updated: 2026-10-03 Domain: infotech · Repo: risk-nexus · Owner: the-custodian

Current posture

The register contains 15 graded findings: nine fixed, four open and two accepted; three notes; one regulatory determination; four full policy records and a thirteen-entry policy catalogue. REGISTER.md is the generated finding index. Disclosure is public for all findings; two have recorded publication addresses and nine still carry pending handovers. The e-invoice finding and three Emergent findings have no completed publication handover recorded.

Workplan audit — 2026-10-03

All seven local workplans and their State Hub projections are finished. All 37 local task blocks are done. No blocked, active, ready or proposed workplan exists here, and no unfinished local task requires changing a parent to blocked. No task or workplan was added for this cleanup.

Workplan	Completed scope	Remaining external or recurring obligations
RISK-WP-0001	Grading instruments and register	Canon-kind default already applied; review instruments as due
RISK-WP-0002	Initial publication and standing handover route	Later finding publication returns belong to policy-nexus
RISK-WP-0003	Regulatory intake and retained policy records	Substantive policy and activation reviews remain due
RISK-WP-0004	Review procedure, inbox checks and activity definitions	Live activity deployment/session completion remains unverified
RISK-WP-0005	Intake, remediation tracking and gap reporting	Production-transition adoption and external contact delivery remain outside this repo
RISK-WP-0006	Resilient reports and obligation visibility	Reporting does not complete the underlying reviews or handovers
RISK-WP-0007	Reconcile owner evidence and closure obligations	Deployed captures and provider/owner acceptance remain owner work

Loose ends resolved — 2026-10-03

RISK-F-0011 now records the founder's 2026-09-22 source-only acceptance (message 61fd83cc-4d21-4a0c-bbef-d91b2e8f129e). The founder, exercising GOVERN @ estate, accepted the bounded source claim, not deployed completeness. The medium grade stays; the stall escalation is answered. Acceptance ends when a deployed qonto stream can be read by King's Guard, or at the next scheduled risk review after 2026-12-31, whichever occurs first. KG-WP-0005-T03 remains the closure path; its owner workplan is already blocked. This is a recorded decision, not renewed acceptance by this register.

The fix tracker now reads YAML task blocks regardless of field order. Emergent T04 correctly reports done and T07 wait, rather than unreadable. A regression test also prevents reading a status from outside the target block.

RISK-F-0013 (medium) and RISK-F-0014 (low) retain the historical 0.2.1 binding/lifecycle defects and local 0.2.3 non-reproduction evidence; owner T07 acceptance remains pending. RISK-F-0015 (low) records the two retained Claude owner-routing misses; current-release complete provider evidence remains pending.

Remaining register obligations

• RISK-F-0012: qonto-assistant must supply e-invoice owner tracking and the receiving/retention evidence. Existing default date: 2026-10-06.
• RISK-F-0008: accepted audit-retention risk; its substantive legal review and real-data activation facts remain due. Existing technical default: 2026-11-17.
• Four full policies and RISK-REG-0001 remain overdue for substantive review. This cleanup supplies no new legal research or activation assurance.
• Nine finding publication handovers remain pending. A disclosure grade is not publication. No new external message or publication was sent here.
• Scheduled-session execution, external contact delivery and production-transition adoption remain unverified; their definitions/routes are completed local work.

Completed implementation tasks stay finished while those recurring or external obligations remain on the register. Findings stay watched until concrete closure or valid acceptance; owner workplan completion alone does not close them.

Verification

make test: 14 tests pass. make fixes resolves the Emergent task states. make check checks index, register obligations and inbox; overdue work remains visible. statehub fix-consistency reconciles the seven workplans and pushes. Historical records retain the provenance of file evidence versus live reads.