# 34 — Product and implementation risk register

## Rating

Likelihood and impact use Low, Medium or High. Release-blocking risks remain open until mitigated or explicitly accepted by the instance owner/product owner.

| ID | Risk | Likelihood | Impact | Mitigation and evidence | Release gate |
|---|---|---|---|---|---|
| R-001 | Platform becomes a static prompt gallery | Medium | High | Composer, profiles, provenance and deterministic export are mandatory before release | Core composer acceptance |
| R-002 | Codex invents architecture due to underspecified build pack | Medium | High | Implementation defaults, reference SQL, OpenAPI, screen states and traceability | Milestone 0 architecture review |
| R-003 | Catalog size is overstated by unfinished content | Medium | High | Only 28 P0 packages are publishable; P1/P2 remain labeled backlog | Catalog cross-validation |
| R-004 | Free-text conditions lead to unsafe dynamic evaluation | Medium | High | Declarative condition AST; no eval or template helpers | Condition parser/security tests |
| R-005 | Prompt output changes across platforms | Medium | High | RFC 8785 canonicalization, normalized text and property tests | Cross-platform digest fixtures |
| R-006 | Imported package escapes filesystem or exhausts resources | Medium | High | path/symlink rejection, archive limits and streaming inspection | Archive security suite |
| R-007 | Gitea integration enables SSRF into private infrastructure | Medium | High | deny-by-default network policy, exact allowlist, DNS/redirect revalidation | SSRF contract tests |
| R-008 | Integration token leaks into logs or prompts | Low | High | encrypted envelope, redaction and no secret access in composer | Secret redaction tests |
| R-009 | Cross-workspace ID substitution exposes private content | Medium | High | use-case authorization and negative integration matrix | Authorization suite |
| R-010 | First user takeover during exposed setup | Medium | High | setup token, local-only fallback, database setup lock | First-run concurrency/security test |
| R-011 | Authentication library choice is weak or abandoned | Low | High | maintained library decision ADR and security review in Milestone 0 | Dependency/security review |
| R-012 | PostgreSQL job queue loses or duplicates work | Medium | Medium | leases, idempotency, retry classification and restart tests | Worker recovery test |
| R-013 | Built-in package update mutates historical runs | Low | High | immutable version snapshots and digest references | Historical reproduction test |
| R-014 | Quality badges imply evidence that does not exist | Medium | High | lifecycle/evidence policy and stale evaluation handling | Quality-state tests |
| R-015 | Premium UI work delays core correctness | Medium | Medium | milestone ordering; domain/composer before polish | Earlier gates cannot be skipped |
| R-016 | UI feels generic despite specification | Medium | Medium | screen-state contract, signature interactions and visual verification | Design review and screenshots |
| R-017 | Self-hosted backup omits encryption key | Medium | High | separate-key warning and restore drill with key dependency | Backup/restore acceptance |
| R-018 | Database migration makes rollback impossible | Medium | High | expand/migrate/contract and explicit rollback limits | Migration rehearsal |
| R-019 | Prompt injection enters policy sections through repository evidence | Medium | High | normalized facts, fenced evidence, provenance and placement rules | Adversarial composition fixtures |
| R-020 | Search quality is poor without semantic search | Medium | Low | full-text/trigram baseline and measured query set before adding vectors | Search relevance evaluation |
| R-021 | Playbook prompts become verbose and repetitive | Medium | Medium | block budgets, lint rules and author review | Representative output review |
| R-022 | Raw repository command is suggested although unsafe | Medium | High | command confirmation and `safeForAgentSuggestion` policy | Profile/composer tests |
| R-023 | Gitea API differences break discovery | Medium | Medium | capability detection, adapter contract and per-capability degradation | Versioned contract fixtures |
| R-024 | Artifact retention deletes data required by history | Low | High | reference-aware cleanup and immutable prompt storage | Retention integration test |
| R-025 | Product terminology confuses generated output with actual execution | Medium | Medium | UI term “Generated task”; database/API `run` explained | UX content review |

## Review cadence

- review at the end of every milestone;
- add risks discovered during implementation instead of hiding them in `CURRENT_STATE.md`;
- close only with evidence;
- accepted risks include owner, reason, review date and compensating controls.