tegwick
f0db7c83ca
Operator ruled both. Findings publish as the file a reader gets — including RISK-F-0001's record that this register graded it critical while its fix notice sat unread. A summary would be a second document per finding kept in sync by hand, and drift is the failure this repo most distrusts; and a published register containing only other repos' defects reads as an accusation, while one containing its own reads as a record. Method docs public except escalation, which is restricted because it names spend thresholds and describes when the operator personally is interrupted — a map of where attention is scarce, needed by nobody judging a finding. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
110 lines
4.3 KiB
Markdown
110 lines
4.3 KiB
Markdown
---
|
|
id: RISK-METHOD-DEPENDENCIES
|
|
type: method
|
|
title: "Waiting: how this register depends on other people without becoming a queue"
|
|
status: adopted
|
|
owner: risk-nexus
|
|
adopted: "2026-08-20"
|
|
workplan: RISK-WP-0001
|
|
review_interval: 6m
|
|
disclosure: public
|
|
revision: "adopted-1"
|
|
last_reviewed: "2026-08-20"
|
|
---
|
|
|
|
# Waiting
|
|
|
|
By 2026-08-20 the register had accumulated nine waits in four days, one of them
|
|
four hops deep: `RISK-F-0003`'s embargo waited on `RISK-F-0009`, which waited
|
|
on `railiance-platform` fixing a deny set, which waited on someone verifying it
|
|
against live OpenBao, which waited on a credential nobody has.
|
|
|
|
Nothing in that chain is anyone's fault, and every link was individually
|
|
reasonable. That is exactly why it needs a rule: deep dependencies are not
|
|
built deliberately, they accrete one sensible step at a time.
|
|
|
|
## The principle
|
|
|
|
**The register never waits to decide. It decides, and revises when told.**
|
|
|
|
A wait is a *refinement* pending, not a decision pending. If the register
|
|
cannot act until someone answers, the register has made that person's silence
|
|
into its own paralysis — and `INTENT.md` is explicit that a register nobody
|
|
acts on is worse than none.
|
|
|
|
## The four rules
|
|
|
|
### 1. Every wait is typed
|
|
|
|
No record may say "waiting on X". A wait carries six things:
|
|
|
|
```yaml
|
|
waiting_on:
|
|
- who: tenant-engine
|
|
what: "confirm or correct the unfiltered events() read; open fix tracking"
|
|
since: "2026-08-19"
|
|
would_change: "grade rises if the log carries payload rather than metadata"
|
|
default: "grade stands as recorded; absent fix tracking noted as a stall"
|
|
default_at: "2026-09-03"
|
|
```
|
|
|
|
`would_change` is the discipline. If nobody can say what the answer would
|
|
change, there is nothing being waited for, and the wait should be deleted
|
|
rather than carried.
|
|
|
|
### 2. Depth one
|
|
|
|
**A record may wait on at most one other record, and never on a record that is
|
|
itself waiting.**
|
|
|
|
When the chain would go deeper, the far end is cut: the record takes its own
|
|
default and says which unresolved thing it declined to wait for. Two hops is
|
|
the point at which nobody can see the whole line any more, and a wait nobody
|
|
can see is indistinguishable from a thing that was dropped.
|
|
|
|
Applied 2026-08-20: `RISK-F-0009`'s embargo condition was
|
|
"verified against live OpenBao", which no one in the estate can currently do.
|
|
It now lifts on **`railiance-platform` reporting the coverage**, with live
|
|
verification recorded as a refinement rather than a condition. That cut the
|
|
`RISK-F-0003` chain from four hops to two.
|
|
|
|
### 3. Defaults are dates, and defaults are pessimistic
|
|
|
|
Every wait resolves on a date whether or not anyone answers. The default is
|
|
**the reading the stated facts already support** — never a hold, never a
|
|
downgrade earned by silence.
|
|
|
|
This is what removes the incentive to wait. Silence does not buy an owner a
|
|
softer grade or a quieter register; it costs them the grade the evidence
|
|
supports, which is usually the one they would want corrected. Answering is how
|
|
a grade improves, and that is the right shape for the incentive.
|
|
|
|
The register says so in advance, to the owner, in writing. A default nobody was
|
|
warned about is an ambush, not a rule.
|
|
|
|
### 4. A condition naming somebody else's action carries a date beside it
|
|
|
|
"Embargo lifts when X ships" is a dependency with no end. "Lifts when X ships,
|
|
or is re-decided on 2026-09-20" terminates.
|
|
|
|
Re-decided is not the same as lifted — the re-decision may extend the hold with
|
|
a fresh reason. What it may not do is extend by default, which is how holds
|
|
quietly become permanent.
|
|
|
|
## What this does not solve
|
|
|
|
Some dependencies are real and cannot be defaulted away. Nobody can verify an
|
|
OpenBao policy without a token, and no rule here conjures one.
|
|
|
|
What the rules do is stop that from propagating: the register grades on what is
|
|
stated, records what it could not verify, and keeps its own position
|
|
independent of the blockage. `docs/method/verification.md` bounds what this repo
|
|
can establish itself, and every grade resting on a document rather than a probe
|
|
says so on its face.
|
|
|
|
## Where the waits are visible
|
|
|
|
`make check` reports every open wait with its age, its owner and its default
|
|
date, flags any default that has come due, and flags any wait that points at a
|
|
record which is itself waiting — a depth-two violation, caught by tooling
|
|
rather than by someone noticing.
|