Post-direction-lock risk register (consolidates live remainders of #93–#108)

[ArkashJ]

One consolidated tracker for what stayed LIVE or PARTIAL after the 2026-06-10 backlog triage (all 15 strategy/security issues closed with dispositions; this issue carries the remainders).

Live risks

• CI is billing-blocked (PROCESS (gating): billing-blocked CI removes the net under every integrity invariant — add an off-laptop blocking gate before PR1 ships to real data #104) — every ci run on main is red; the backend job dies at startup, so RLS/integrity suites enforce nothing. The single highest-leverage process fix (self-hosted runner or paid minutes).
• Registry substrate rot (ARCH: substrate rot — in-memory registry + dual YAML↔Postgres path won't survive multi-tenant/multi-writer #97) — registry is a boot snapshot (api/deps.py); YAML↔Postgres dual path; user_primitives is a third population with no reload/invalidation.
• user_primitives invisible to the evaluator (ARCH (PR1 gap): user_primitives is Postgres-only and INVISIBLE to the evaluator — 'My Bank' can't feed a TAM #98) — private primitives are readable via MCP but can never feed a framework binding.
• Clerk inert-default (SECURITY: Clerk inert-default silently means NO AUTH in prod; no iss/aud pinning; org claim is the unpinned tenant key #101) — clerk_auth.py is inert when JWKS unset; iss/aud verified only if set; no fail-closed boot invariant. Blast radius reduced post-trim (MCP has its own OAuth AS) but the surviving auth surface keeps the design.

Partial remainders

• SECURITY (company-ender): dual-purpose tam_outputs RLS fails OPEN to public on unset session var #99 RLS — 016 admin GUC + OrgScopeMismatchError shipped; missing the full cross-tenant property-test matrix and (per PROCESS (gating): billing-blocked CI removes the net under every integrity invariant — add an off-laptop blocking gate before PR1 ships to real data #104) any CI enforcement.
• SECURITY (company-ender): snapshot_sha256 pin is decorative — fake d3d3 on REAL regulator rows too #100 snapshot pins — serve-time integrity classification shipped (mcp/integrity.py); the content-addressed blob store and FK invariant remain unbuilt; demo rows still carry d3d3.
• SECURITY: modeled→sourced laundering via hand-edited tier; citation allowlist drifts permissive #103 tier laundering — write-door fence parity shipped; tier is still a hand-asserted YAML label; .gov/.edu TLD rule survives in citations.py.
• STRATEGY: value prop is inverted — sourced numbers are the cheap ones; the decision-driving numbers are MODELED #94/STRATEGY: replace the BINARY soft-data fence with a GRADED confidence model (do BEFORE PR4 hardens it) #95 assumption layer — graded corroboration exists at the sizing surface only; the bank/report fence is still binary refuse-MODELED; no coefficient track-record library.
• PRODUCT: contributor flywheel is asserted, not built — ship private-first contribution or drop 'community' from the pitch #107 contributor flywheel — private-first contribution + admin promotion shipped; attribution/reputation layer unbuilt.
• PRODUCT: demo-vs-reality cliff — triangulation/'watch it build' only works on ~8 curated concepts #108 demo cliff — honest-degrade path shipped (gaps + verify_market_claim); multi-method coverage breadth is the remaining data problem.

Full triage evidence lives in the closing comments of the individual issues.

🤖 Generated with Claude Code