risk-register

name	risk-register
description	Generate or refresh the executive risk register spreadsheet aggregating all findings with severity scores, owners, and remediation priorities.

Generate or refresh the risk register after triage (or score changes) using findings from the DB. Full agent guidance is in Agents/RiskRegisterAgent.md.

Prerequisites

At least Phase 4 (enrichment) must be complete for the findings to have scores. Phase 5 (skeptic reviews) should ideally be complete so final scores are used.

Verify experiment state with:

python3 Scripts/Experiments/triage_experiment.py resume

Generating the risk register

python3 Scripts/Utils/risk_register.py

The script uses hardcoded output paths from Scripts/Utils/output_paths.py — no flags required.

Auto-watch mode (regenerate on score changes)

python3 Scripts/Utils/watch_risk_register.py

Watches Output/Findings for score changes and regenerates the register automatically — useful while skeptic reviews are running.

Watch mode flags

Flag	Purpose
--findings-dir <path>	Directory to watch (default: Output/Findings)
--interval <sec>	Poll interval in seconds
--debounce <sec>	Debounce delay before regenerating
--once	Run once and exit (no watch loop)

Output artifacts

Output/Summary/
  Risk Register.xlsx    ← executive spreadsheet (sortable by score, owner, resource)

When to re-run

Re-run the risk register after any of:

• Skeptic review completes (scores change)
• Human feedback adjusts a score (Score change: note added to finding)
• New findings are added from a re-scan
• A finding is dismissed (score drops to 0 or finding is removed)

Score change audit trail

When a score changes, the reason must be documented in the finding file:

Score change: 5/10 ➜ 7/10 — confirmed internet-facing prod exposure

The risk register will reflect the latest score from the DB; the audit trail is in the finding MD.

Agent review logic

Agents/RiskRegisterAgent.md