risks.sgit.ai / admin / comms
Comms: asks and tasks
The site's own working board, in public. Asks (N) are things this site needs from someone else — the corpus, another site in the estate, or a person. Tasks (T) are things this site owes itself. Both are numbered and carry a state, because a research property that publishes its build order unresolved should publish its backlog the same way.
Why this board exists at all. The house style across the estate is that each site publishes its numbered asks and tasks rather than keeping them in a private tracker. It costs nothing and it does two useful things: it lets a reader see what the site knows is missing, and it makes the difference between “not written yet” and “decided against” visible. There is a third reason specific to this site — the corpus argues that not knowing is a fact and that open questions are worth publishing unresolved. A site making that argument and hiding its own gaps would be arguing against itself.
Asks — what this site needs from elsewhere
| # | Ask | Of whom | State |
|---|---|---|---|
| N1 | Reconcile the “no plug” correction at source. The corpus records that the plug always exists and what looked like “no plug” was zero recoverability. The published product page this material moved from does not reflect that correction. One of the two is wrong, and until it is settled, two properties in the estate carry contradictory versions of the same finding. This site publishes the corrected version and says so on the page. | riskmandate.ai · the corpus | open |
| N2 | Specify RAMM levels 1, 2, 4 and 5. Only Level 3 has a stated predicate, and the Agentic + variants are better defined than the base model they extend. The standard already exists — Level 3 sets it — so this is a matter of writing four predicates to a known shape. This site publishes the underspecification rather than inventing the missing four, which is the correct behaviour and not a satisfying one. |
the corpus | needed |
| N3 | Legal read and a right-of-reply process before any comparative vendor assessment is published anywhere public. The document in question is rigorous and scrupulous about its own limits, and it names real companies critically. It is not on this site and the gate fails the build if it appears. Nothing changes until both the legal read and the reply process exist. | the project · legal | needed |
| N4 | Coordinate the mandate split with pki.sgit.ai. Their own 19 August site review says “mandate is the gap, registry is the missing half” — meaning they currently carry mandate material that arguably belongs with risk. A unilateral move by either site produces two half-treatments. Stated on the boundary map. | pki.sgit.ai | open |
| N5 | Decide the EU AI Act thread's home before it accretes further. Roughly 40,000 words across four clusters, and it is neither risk nor graphs. This site takes only three narrow declared bridges — Article 9(5), Article 14 and Article 26(5)/(6) — and leaves the rest un-annexed. That is a holding position, not an answer. | the estate | open |
| N6 | Offer a right of reply to the three named researchers whose published vulnerability formula the bridge document paraphrases. The treatment is favourable and explicitly marked as a paraphrase, and the corpus's own stance is “offered to be built on and challenged” — which is an argument for notifying them rather than waiting to be corrected. | the project | open |
| N7 | Write the canonical “risk acceptance redefined” statement, or confirm it is lost. Eight documents cite a 7 July 2026 brief of that title. It is not in the repository, and neither are three others referenced alongside it. Either it exists somewhere and should be restored, or the citations should be repointed — at present eight documents reference something nobody can read. | the corpus | needed |
Tasks — what this site owes itself
| # | Task | State |
|---|---|---|
| T1 | Stand up the pipeline before the content: validate → tag → deploy, with the gate carrying this site's three specific tripwires | done · v0.1.0 |
| T2 | Build /acceptance/, /acceptable/, /ladder/ and /plug/ — the four near-publishable sections the brief sequences first | done · v0.1.0 |
| T3 | Ship the definitions endpoint: 42 concepts as structured data, generated from the same definition as the human page, with the gate enforcing that they cannot drift | done · v0.1.0 |
| T4 | Publish /shipped/ with the honesty constraint stated first rather than last, and enforce it in CI rather than remembering it | done · v0.1.0 |
| T5 | Mirror the 2FA instance graph as a downloadable file at a stable path. It is the only directly downloadable graph in the corpus, it declares its own principles inline and carries a CC BY 4.0 line — and this site currently describes it from the brief pack's counts rather than reproducing a file it does not have | open |
| T6 | Publish the ontology as machine-readable data, not just as a vocabulary listing. Node types and edge types with their path formulas, so an agent can consume the schema rather than parse a code block. Currently a listing | open |
| T7 | Run this site's own risk register in the open. The corpus argues a register is a graph, that unaccepted equals critical, and that the register maintains itself. A research site that publishes its own register — its open questions as unaccepted risks, with intervals — demonstrates all three at zero cost. The house style names this as one of two demonstrations worth building in | open |
| T8 | Write the leave-behind stubs for the four pages that moved off the commercial site, so each has a short summary and a link here rather than a drifting second copy | in progress · this site's half is done |
| T9 | Add a rendered in-page reader for each source document under /documents/, rather than linking to raw markdown only | open |
| T10 | Render the three worked graphs as diagrams. Every one is currently prose plus a counted table; two of them exist as parseable JSON upstream and would render directly | open |
Decided against
| What | Why not |
|---|---|
| Publishing vault read keys on this site | They are published and kept current in sgit.ai's own catalogue. A second copy would go stale, and the gate refuses anything key-shaped anywhere in the tree — which is a rule worth keeping absolute rather than nearly absolute |
| Inventing the four missing RAMM predicates | Four plausible-sounding definitions presented as the model would be precisely the failure this site exists to avoid. N2 instead |
| Reconstructing the 2FA data file from the brief pack's counts | A reconstructed graph presented as the original is worse than a missing one. T5 instead |
| Any pricing, partner positioning or competitor comparison | Not this site's job, and corrosive on a research property. It stays on riskmandate.ai |