tegwick
449307bea2
T02: docs/method/intake.md names all four sources INTENT claims and builds the two that had none. An incident files first and grades within the hour, carries first_observed because obligations run from it, sits at instant until it is over, and escalates immediately rather than batched — a 72-hour notification clock outranks the rule that protects the operator's attention. External report has no address anywhere in the estate, and where one lives is policy-nexus's and the custodian's, so it is routed with a proposal rather than invented here. T03: the production transition defined by what is held rather than what was announced — the first moment any system holds real external data, which can happen by accident and cannot be reversed. Declared by the custodian; noticed and asked about by this register. Lists what fires: five re-scores, two acceptances ending, six policies activating. T04: the README no longer claims a surface this repo does not have. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
93 lines
4 KiB
Markdown
93 lines
4 KiB
Markdown
---
|
||
id: RISK-METHOD-INTAKE
|
||
type: method
|
||
title: "Intake: the four sources, including the two that had no path"
|
||
status: adopted
|
||
owner: risk-nexus
|
||
adopted: "2026-08-21"
|
||
workplan: RISK-WP-0005-T02
|
||
review_interval: 6m
|
||
---
|
||
|
||
# Intake
|
||
|
||
`INTENT.md` claims intake "from any source: research, review, incident,
|
||
external report". Until 2026-08-21 two of those four had no path at all, and
|
||
every finding in the register had arrived from a repo reading its own code.
|
||
|
||
A register that only receives self-assessments is a self-assessment aggregator.
|
||
That is a respectable thing to be and it is not what the intent says.
|
||
|
||
## The four sources
|
||
|
||
| Source | Path | State |
|
||
| --- | --- | --- |
|
||
| Research | a repo or agent files against `findings/README.md` | working, nine findings |
|
||
| Review | same, usually against a ladder or standard | working, most of the nine |
|
||
| **Incident** | below | new |
|
||
| **External report** | below — and the address is not this repo's to create | routed |
|
||
|
||
## Incident
|
||
|
||
An incident is a finding about something happening **now** rather than a latent
|
||
defect. The difference is not severity; it is that someone is exercising it, or
|
||
the loss is occurring, while the record is being written.
|
||
|
||
### What is different
|
||
|
||
- **File first, grade later.** The normal order is reversed: get the record
|
||
into `findings/` with what is known, and grade it in the same hour rather
|
||
than in the same sitting. An ungraded incident is still a record; an unwritten
|
||
one is nothing.
|
||
- **`incident: true` and a `first_observed` timestamp**, both in front-matter.
|
||
The timestamp matters more than the grade, because obligations run from it.
|
||
- **Cadence starts at `instant` and stays there** until the incident is over.
|
||
That is the ladder's existing behaviour and needs no special case: something
|
||
that keeps moving keeps resetting.
|
||
- **The 72-hour clock.** If personal data is or may be involved,
|
||
`RISK-POL-0005` (GDPR Arts 33–34) requires notification within 72 hours of
|
||
becoming aware. **`first_observed` is what starts that clock**, and this is
|
||
the one place the register puts a hard deadline on itself. Escalation is
|
||
immediate under trigger 1 or 2 — not batched, notwithstanding the batching
|
||
rule, because batching exists to protect the operator's attention and a
|
||
72-hour clock outranks that.
|
||
- **Severity is scored on what is happening, not what could.** The `L4`
|
||
likelihood band — "already happening" — exists for exactly this and is
|
||
otherwise almost unused.
|
||
|
||
### What is not different
|
||
|
||
Ownership, routing, and the boundary. The repo that owns the system owns the
|
||
response; this register records, grades, escalates and keeps the clock. A risk
|
||
register that runs incident response is a second engineering team with a
|
||
stopwatch.
|
||
|
||
## External report
|
||
|
||
Someone outside the estate finding something and having somewhere to send it.
|
||
|
||
**No such place exists.** There is no `security.txt` anywhere in the estate, no
|
||
published address, and no route from an outsider to this register. If someone
|
||
found a flaw in a coulomb.social surface tomorrow, their options would be to
|
||
guess an email address or say nothing.
|
||
|
||
**Where that address lives is not this repo's decision.** It is a published
|
||
surface, which makes it `policy-nexus`'s to serve and the custodian's to
|
||
approve. Routed on 2026-08-21 with a proposal:
|
||
|
||
- a `security.txt` (RFC 9116) at `policy.coulomb.social/.well-known/`, naming
|
||
a contact and a preferred language, with an expiry date as the RFC requires;
|
||
- reports arriving there routed to `risk-nexus` and filed like any other
|
||
finding, with `reported_by: external`;
|
||
- **no promise of a bounty, a timeline, or safe harbour.** The ask is a route
|
||
in, not a commitment out. A published disclosure policy is a later decision
|
||
and a heavier one.
|
||
|
||
Until that exists, this register's claim to accept external reports is
|
||
aspirational and `STATE.md` says so.
|
||
|
||
## What all four share
|
||
|
||
The reporter says what is true and how they know. This register says how bad it
|
||
is and who hears about it. Nothing in this document changes that boundary —
|
||
including for incidents, where the temptation to take over is strongest.
|