@windyroad/risk-scorer 0.18.11 → 0.18.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,8 @@
|
|
|
1
1
|
#!/usr/bin/env bash
|
|
2
|
-
# wr-risk-scorer — SessionStart hook
|
|
2
|
+
# wr-risk-scorer — SessionStart hook. Three arms, first match wins:
|
|
3
|
+
# policy absent → ADR-108
|
|
4
|
+
# register absent → ADR-047
|
|
5
|
+
# entries pending → ADR-113
|
|
3
6
|
#
|
|
4
7
|
# Surfaces a one-line nudge when this project has a RISK-POLICY.md (the
|
|
5
8
|
# trigger condition for an ISO 31000 / ISO 27001 standing-risk register)
|
|
@@ -7,9 +10,9 @@
|
|
|
7
10
|
# scaffolds the register on-demand via /wr-risk-scorer:bootstrap-catalog
|
|
8
11
|
# (ADR-059); this hook is the discovery surface — it does NOT write.
|
|
9
12
|
#
|
|
10
|
-
#
|
|
11
|
-
#
|
|
12
|
-
#
|
|
13
|
+
# Once docs/risks/ exists, the hook no longer goes silent — it counts
|
|
14
|
+
# entries still carrying the `**Curation**: pending review` marker and
|
|
15
|
+
# re-surfaces the count every session. This closes the
|
|
13
16
|
# audit's "one step short of the jtbd pattern" gap: the scaffold check
|
|
14
17
|
# alone went quiet once stubs existed, so the pending-review backlog
|
|
15
18
|
# (auto-scaffolded entries whose controls + Impact×Likelihood scoring are
|
|
@@ -56,13 +59,14 @@ REGISTER_DIR="$PROJECT_DIR/docs/risks"
|
|
|
56
59
|
# to nudge (e.g. a stale CLAUDE_PROJECT_DIR).
|
|
57
60
|
[ -d "$PROJECT_DIR" ] || exit 0
|
|
58
61
|
|
|
59
|
-
# Policy file absent entirely (
|
|
62
|
+
# Policy file absent entirely (ADR-108, inverse predicate of the
|
|
60
63
|
# register-missing arm below). Without a RISK-POLICY.md the risk-scorer
|
|
61
64
|
# gates run at their default appetite (5 per ADR-086) silently, and the
|
|
62
65
|
# capability sits dormant with no surfacing that a policy can be authored.
|
|
63
66
|
# Nudge the adopter to author one via /wr-risk-scorer:update-policy. The
|
|
64
|
-
# original guard treated bare policy-absence as a non-gap;
|
|
65
|
-
#
|
|
67
|
+
# original guard treated bare policy-absence as a non-gap; ADR-108 weighs
|
|
68
|
+
# that reversal against the narrower alternative — nudging only where a
|
|
69
|
+
# reports directory shows the scorer in use — and takes this one. Read-only
|
|
66
70
|
# — the hook never writes; the policy authoring is gated behind the user
|
|
67
71
|
# invoking the on-demand skill.
|
|
68
72
|
if [ ! -f "$POLICY_FILE" ]; then
|
|
@@ -81,7 +85,20 @@ fi
|
|
|
81
85
|
# instead of going silent once stubs exist. Token-cheap grep over the
|
|
82
86
|
# register dir — no body reads, no per-file LLM call (matches the
|
|
83
87
|
# jtbd-oversight-nudge.sh cost profile).
|
|
84
|
-
|
|
88
|
+
# Retired entries are excluded. A risk that has been closed no longer needs its
|
|
89
|
+
# impact and likelihood weighed, and counting them puts a floor under the number
|
|
90
|
+
# that curation cannot move — 22 of 69 on 2026-08-09 — which would make the
|
|
91
|
+
# count undrainable and the nudge permanent.
|
|
92
|
+
#
|
|
93
|
+
# EXCLUSION-shaped, not an `*.active.md` inclusion. The register's status
|
|
94
|
+
# vocabulary is three-valued: `.active.md`, `.accepted.md` for a risk that is
|
|
95
|
+
# consciously tolerated, and `.retired.md`. An accepted risk is live, and the
|
|
96
|
+
# Impact x Likelihood the curation marker says is missing is exactly what a
|
|
97
|
+
# decision to tolerate it should have rested on — so it counts. Matching on
|
|
98
|
+
# active alone would write those off silently, and would also miss an
|
|
99
|
+
# unsuffixed entry, which the register README documents as the pre-retire form.
|
|
100
|
+
PENDING="$(grep -rlE '^\*\*Curation\*\*: pending review' "$REGISTER_DIR" 2>/dev/null \
|
|
101
|
+
| grep -v '\.retired\.md$' | grep -c . || true)"
|
|
85
102
|
PENDING="${PENDING:-0}"
|
|
86
103
|
|
|
87
104
|
[ "$PENDING" -gt 0 ] 2>/dev/null || exit 0
|
package/package.json
CHANGED