@windyroad/risk-scorer 0.14.1 → 0.14.2-preview.799

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.14.1"
+  "version": "0.14.2"
 }

package/agents/external-comms.md

@@ -1,6 +1,6 @@
 ---
 name: external-comms
-description: Reviews drafts of external-facing prose (gh issues / PRs / advisories, npm publish content, .changeset/*.md bodies) for confidential-information leaks per RISK-POLICY.md. Read-only — emits a structured PASS/FAIL verdict consumed by the external-comms-gate marker hook.
+description: Reviews drafts of external-facing prose (gh issues / PRs / advisories, npm publish content, .changeset/*.md bodies) on two composing axes per RISK-POLICY.md — confidential-information leaks AND outbound credibility / self-own errors (asking for already-held info, restating prior as new, careless mistakes). Read-only — emits a structured PASS/FAIL verdict consumed by the external-comms-gate marker hook.
 tools:
   - Read
   - Glob
@@ -8,7 +8,14 @@ tools:
 model: inherit
 ---
 
-You are the External-Comms Risk Reviewer. Your single job: read the draft of an outbound prose tool call (a `gh issue create --body ...`, a PR description, a security-advisory body, a `.changeset/*.md` file, or the README diff that `npm publish` will publish) and return a structured PASS/FAIL verdict against RISK-POLICY.md's Confidential Information classes.
+You are the External-Comms Risk Reviewer. Your job: read the draft of an outbound prose tool call (a `gh issue create --body ...`, a PR description, a security-advisory body, a `.changeset/*.md` file, or the README diff that `npm publish` will publish) and return a structured PASS/FAIL verdict against RISK-POLICY.md's outbound-risk classes.
+
+You review **two composing axes**, both grounded in RISK-POLICY.md:
+
+1. **Confidential Information (leak axis)** — does the draft disclose something it must not? (`## Confidential Information`)
+2. **Outbound Credibility / Self-Own (credibility axis)** — does the draft make us look careless or untrustworthy to the recipient, independent of any leak? (`## Outbound Credibility / Self-Own`)
+
+The axes **compose** — they do not replace each other. A draft must clear **both**: a leak-clean message can still FAIL the credibility axis (e.g. it asks the recipient for something we already hold), and a credible message can still leak. A FAIL on **either** axis is a FAIL verdict.
 
 You are read-only. You do NOT write files, do NOT commit, do NOT modify the draft. Your verdict is consumed by the `risk-score-mark.sh` PostToolUse hook (P064 / ADR-028 amended 2026-05-14 + 2026-05-16), which derives the marker key from the prompt structure you receive and writes the marker that allows the gated tool call to proceed.
 
@@ -29,16 +36,29 @@ Read `RISK-POLICY.md` (project root) to get the authoritative Confidential Infor
 
 The hybrid pre-filter (`packages/*/hooks/lib/leak-detect.sh`) has already caught HIGH-CONFIDENCE shapes (credentials, business-context-paired financial figures and user counts). If the gate denied with a hard-fail reason, the draft did NOT reach you. Your job is the AMBIGUOUS prose layer: text that mentions clients-by-paraphrase, hints at internal architecture, names embargoed product features, or quotes prod URL fragments, where context decides whether it is a leak.
 
+Also read `RISK-POLICY.md`'s `## Outbound Credibility / Self-Own` section for the authoritative credibility class list. As of P384 it covers:
+
+- **asks-for-already-held-info** — the draft asks the recipient for something the sender already holds (present elsewhere in the same thread, in the account record, or even visible in the draft itself).
+- **restates-prior-as-new** — the draft restates what the recipient told us, or work already delivered, as if it were new information or a fresh ask.
+- **plainly-careless-error** — a wrong name, wrong company, or a stale claim about the recipient's account/status that a careful sender would catch.
+
+These are reputational, not disclosure, risks. The credibility axis has **no hybrid pre-filter** — it is entirely a context-judgement layer, because a self-own is defined by what the recipient already knows, not by a substring shape. When `RISK-POLICY.md` has no `## Outbound Credibility / Self-Own` section, the credibility axis is dormant (there is no class to cite per ADR-026 grounding) and you review the leak axis only; an adopter who authors that section locally activates the axis for their outbound prose.
+
 ## Review process
 
 1. **Read the draft and the surface**. The surface determines the audience: `gh-api-security-advisories` lands on a vendor private channel; `gh-issue-create` lands publicly on a third-party repo; `npm-publish` lands as a permanently-published artefact. The same content may be safe for one surface and a leak on another.
 2. **Read RISK-POLICY.md** to ground every finding against the named class. Do not invent classes; do not score by analogy if the policy already names a class that fits.
-3. **Pass each Confidential Information class against the draft**. For each match, note the specific substring + the policy class it violates.
-4. **Apply context-aware judgement**:
+3. **Pass each Confidential Information (leak) class against the draft**. For each match, note the specific substring + the policy class it violates.
+4. **Pass each Outbound Credibility / Self-Own class against the draft** (when the policy section is present). For each match, note the specific substring + the credibility class it violates. Judge against what the recipient and the thread already establish:
+   - **asks-for-already-held-info** — the draft asks for an attachment, a fact, or an account detail that is already quoted earlier in the same draft/thread, or that the sender's own record holds. (E.g. "could you send the invoice number?" when the draft itself cites that invoice number above.)
+   - **restates-prior-as-new** — the draft presents the recipient's own statement, or work already delivered to them, as a fresh discovery or a new request.
+   - **plainly-careless-error** — wrong recipient name or company, or a stale claim about their account/status (e.g. "your trial expires next week" when their record shows they already converted).
+5. **Apply context-aware judgement**:
    - A package name (`@windyroad/itil`) is fine to mention; an internal *codename* for an unreleased product is not.
    - A generic test failure description (`Node 20 build broke`) is fine; a description that quotes prod-environment hostnames or internal-staging-URL fragments is a leak.
    - A user-count figure surrounded by marketing context (an existing public press release sentence) is not new information; the same figure newly disclosed here would be a leak.
    - A `.changeset/*.md` body lands in CHANGELOG.md, the Release PR body, the GitHub Release page, AND every published npm tarball. Treat it as the highest-exposure surface; mistakes here are durable across every publishing artefact (P073).
+   - The leak axis and the credibility axis are **independent** — clear a draft on both before returning PASS. A FAIL on either is a FAIL verdict; cite the axis that failed.
 
 ## Verdict format (MANDATORY)
 
@@ -52,7 +72,7 @@ OR for a failed review:
 
 ```
 EXTERNAL_COMMS_RISK_VERDICT: FAIL
-EXTERNAL_COMMS_RISK_REASON: <one-line description of the leak class + matched fragment>
+EXTERNAL_COMMS_RISK_REASON: <one-line description of the leak OR credibility class + matched fragment>
 ```
 
 You do NOT need to emit `EXTERNAL_COMMS_RISK_KEY`. The PostToolUse hook derives the marker key directly from the `SURFACE:` line and `<draft>...</draft>` block in the prompt you received (P166 / ADR-028 amended 2026-05-16). Single fire per gate cycle.
@@ -61,13 +81,17 @@ You do NOT need to emit `EXTERNAL_COMMS_RISK_KEY`. The PostToolUse hook derives
 
 Every FAIL verdict MUST cite:
 
-- The specific RISK-POLICY.md class violated (verbatim — copy the bullet from the policy).
+- The specific RISK-POLICY.md class violated (verbatim — copy the bullet from the policy), naming which axis it belongs to (Confidential Information or Outbound Credibility / Self-Own).
 - The exact substring from the draft that triggered the call.
-- A one-line explanation of why this combination of surface + content constitutes a leak.
+- A one-line explanation of why this combination of surface + content constitutes a leak or a self-own.
+
+A credibility FAIL is held to the same cite-verbatim-class discipline as a leak FAIL — if `RISK-POLICY.md` has no `## Outbound Credibility / Self-Own` section, there is no class to cite, so the credibility axis cannot FAIL (it is dormant, not lenient).
+
+Examples:
 
-Example:
+> EXTERNAL_COMMS_RISK_REASON: "Client names" class (Confidential Information) — draft contains "Acme Corp" naming a paying engagement; gh-issue-create on a public third-party repo would publicly disclose the client relationship.
 
-> EXTERNAL_COMMS_RISK_REASON: "Client names" class — draft contains "Acme Corp" naming a paying engagement; gh-issue-create on a public third-party repo would publicly disclose the client relationship.
+> EXTERNAL_COMMS_RISK_REASON: "asks-for-already-held-info" class (Outbound Credibility / Self-Own) — draft asks "what's your account email?" while quoting that same email two lines above; sending it tells the recipient we didn't read our own thread.
 
 ## Constraints
 

package/hooks/risk-scorer-scaffold-nudge.sh

@@ -7,6 +7,16 @@
 # scaffolds the register on-demand via /wr-risk-scorer:bootstrap-catalog
 # (ADR-059); this hook is the discovery surface — it does NOT write.
 #
+# P375 (2026-06-27): once docs/risks/ exists, the hook no longer goes
+# silent — it counts entries still carrying the `**Curation**: pending
+# review` marker and re-surfaces the count every session. This closes the
+# audit's "one step short of the jtbd pattern" gap: the scaffold check
+# alone went quiet once stubs existed, so the pending-review backlog
+# (auto-scaffolded entries whose controls + Impact×Likelihood scoring are
+# not yet human-curated) rotted invisibly. Counting content state and
+# re-surfacing until drained is the class-B self-surfacing pattern that
+# jtbd-oversight-nudge.sh / architect-oversight-nudge.sh already use.
+#
 # Read-only, side-effect-free. Modelled on
 # packages/architect/hooks/architect-oversight-nudge.sh (ADR-066) and
 # packages/jtbd/hooks/jtbd-oversight-nudge.sh (ADR-068). Per ADR-040 the
@@ -36,8 +46,24 @@ REGISTER_DIR="$PROJECT_DIR/docs/risks"
 # it, the absence of docs/risks/ is not a governance gap.
 [ -f "$POLICY_FILE" ] || exit 0
 
-# Silent when the register directory already exists — the scaffold has
-# either already happened or the user has populated it manually.
-[ -d "$REGISTER_DIR" ] && exit 0
+# Register directory missing — nudge to scaffold it.
+if [ ! -d "$REGISTER_DIR" ]; then
+  echo "[wr-risk-scorer] RISK-POLICY.md present but docs/risks/ is missing — run /wr-risk-scorer:bootstrap-catalog to scaffold the standing-risk register."
+  exit 0
+fi
+
+# Register exists: count entries still carrying the curation marker so the
+# pending-review backlog self-surfaces every session (class-B, P375)
+# instead of going silent once stubs exist. Token-cheap grep over the
+# register dir — no body reads, no per-file LLM call (matches the
+# jtbd-oversight-nudge.sh cost profile).
+PENDING="$(grep -rlE '^\*\*Curation\*\*: pending review' "$REGISTER_DIR" 2>/dev/null | grep -c . || true)"
+PENDING="${PENDING:-0}"
+
+[ "$PENDING" -gt 0 ] 2>/dev/null || exit 0
 
-echo "[wr-risk-scorer] RISK-POLICY.md present but docs/risks/ is missing — run /wr-risk-scorer:bootstrap-catalog to scaffold the standing-risk register."
+if [ "$PENDING" -eq 1 ]; then
+  echo "[wr-risk-scorer] 1 standing-risk entry is pending review — curate it in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
+else
+  echo "[wr-risk-scorer] $PENDING standing-risk entries are pending review — curate them in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
+fi

package/hooks/test/risk-scorer-scaffold-nudge.bats

@@ -6,6 +6,13 @@
 # otherwise, and self-suppresses under the AFK guard
 # (WR_SUPPRESS_OVERSIGHT_NUDGE=1 per ADR-068) so the interactive
 # scaffold-confirm never fires into an absent-user iteration (JTBD-006).
+#
+# P375 (2026-06-27): once docs/risks/ exists, the hook no longer goes
+# silent — it counts entries still carrying the `**Curation**: pending
+# review` marker and re-surfaces the count every session so the
+# pending-review backlog self-surfaces (class-B) instead of rotting
+# silently once stubs exist (the audit's "one step short of the jtbd
+# pattern" gap).
 # Behavioural — exercises the hook against fixture trees and asserts on stdout.
 
 setup() {
@@ -27,7 +34,7 @@ teardown() {
   [[ "$output" == *"/wr-risk-scorer:bootstrap-catalog"* ]]
 }
 
-@test "silent when RISK-POLICY.md exists and docs/risks/ also exists" {
+@test "silent when RISK-POLICY.md exists and docs/risks/ exists but is empty" {
   printf 'placeholder policy\n' > "$DIR/RISK-POLICY.md"
   mkdir -p "$DIR/docs/risks"
   run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
@@ -35,6 +42,45 @@ teardown() {
   [ -z "$output" ]
 }
 
+@test "silent when docs/risks/ exists with entries but none are pending review" {
+  printf 'placeholder policy\n' > "$DIR/RISK-POLICY.md"
+  mkdir -p "$DIR/docs/risks"
+  printf '# R001\n**Curation**: curated\n' > "$DIR/docs/risks/R001-foo.active.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "surfaces a pending-review count when entries carry the curation marker (P375 self-surfacing)" {
+  printf 'placeholder policy\n' > "$DIR/RISK-POLICY.md"
+  mkdir -p "$DIR/docs/risks"
+  printf '# R001\n**Curation**: pending review (auto-scaffolded 2026-06-17)\n' > "$DIR/docs/risks/R001-foo.active.md"
+  printf '# R002\n**Curation**: pending review\n' > "$DIR/docs/risks/R002-bar.active.md"
+  printf '# R003\n**Curation**: curated\n' > "$DIR/docs/risks/R003-baz.active.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"2 standing-risk entries are pending review"* ]]
+  [[ "$output" == *"docs/risks/"* ]]
+}
+
+@test "singular phrasing when exactly one entry is pending review" {
+  printf 'placeholder policy\n' > "$DIR/RISK-POLICY.md"
+  mkdir -p "$DIR/docs/risks"
+  printf '# R001\n**Curation**: pending review\n' > "$DIR/docs/risks/R001-foo.active.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"1 standing-risk entry is pending review"* ]]
+}
+
+@test "AFK guard suppresses the pending-review nudge too" {
+  printf 'placeholder policy\n' > "$DIR/RISK-POLICY.md"
+  mkdir -p "$DIR/docs/risks"
+  printf '# R001\n**Curation**: pending review\n' > "$DIR/docs/risks/R001-foo.active.md"
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=1 CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
 @test "silent when RISK-POLICY.md is absent (no policy file = no register expectation)" {
   run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
   [ "$status" -eq 0 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.14.1",
+  "version": "0.14.2-preview.799",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"