AWatch-rus/docs/RESIDUAL_RISKS_RU.md

# AWatch-rus: остаточные риски после public validation и российского Git-контура

Дата: 2026-06-23

Статус: governance / registry-readiness residual risk register.

Документ фиксирует оставшиеся риски после настройки российского Gitea-контура,
backup, public GitHub Actions validation, coverage workflow, security scanning
и status freeze.

Это не заявление о завершенной регистрации в реестре российского ПО и не
release evidence. GitHub Actions остается public mirror validation only.
Primary registry-readiness contour остается: Russian Gitea, planned Russian
build-runner и будущий release evidence build на российском контуре.

## Архитектурный вывод

Текущий pilot/readiness stage не блокируется перечисленными рисками, потому что
ядро инженерной прозрачности уже зафиксировано:

- source contour documented: self-hosted Russian Gitea;
- public mirror validation passed: CI, Coverage, Security;
- secret scan hardened and passed;
- backup process documented with SHA256 verification and daily timer;
- registry-readiness docs and release evidence scripts exist;
- forbidden positioning claims are explicitly excluded.

Оставшиеся риски относятся к governance, disaster recovery proof, public process
visibility, release evidence contour and legal package. Они требуют дальнейших
действий до registry release evidence / GA, но не отменяют pilot/readiness
статус.

## 1. Один основной разработчик

- Текущий статус: риск открыт; основная инженерная экспертиза сосредоточена у
  одного maintainer.
- Влияние: задержка развития, поддержки и incident response при недоступности
  maintainer; повышенная зависимость от личной экспертизы.
- Почему не блокирует pilot/readiness stage: архитектура, deployment docs,
  runbooks, registry docs and public checks already create a transferable
  baseline for pilot validation.
- Как риск будет снижаться: second maintainer onboarding, documented code
  ownership, mandatory PR review for release branches, knowledge transfer
  sessions.
- Уже снижающие evidence/documents/CI: README, `docs/PROJECT_STATUS_RU.md`,
  `docs/QUALITY_STATUS_RU.md`, `docs/registry/`, GitHub Actions CI/Coverage/
  Security, issue templates and PR template.
- Следующий action: завести публичную задачу
  `[security] Prepare external security/code review checklist`.

## 2. Нет внешнего visible peer review / публично видимого peer review

- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public
  governance issues, PR workflow docs and verified active GitHub ruleset for
  `main` exist. PR #50 has run through protected checks, but first reviewed PR
  evidence is still pending because review/merge is not complete.
- Влияние: внешним аудиторам сложнее оценить review discipline and change
  control maturity.
- Почему не блокирует pilot/readiness stage: current changes are protected by
  reproducible checks, public workflows and documented conservative positioning.
- Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and
  explicit release branch review policy.
- Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
  `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
  `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
  `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
  `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
- Branch protection pending risk: mitigated by verified active GitHub ruleset
  for `main` with empty bypass list, required PR review, Code Owners review,
  required status checks and force-push blocking.
- PR workflow risk: remains open until PR #50 or a later PR is reviewed and
  merged without bypass.
- Residual risk: remains open until first reviewed PR evidence exists.
- Следующий action: record first reviewed PR evidence without overstating
  external peer review.

## 3. Низкая публичная активность issue tracker

- Текущий статус: mitigation added; public roadmap/governance issues are
  created and linked in `docs/public-issues/public-issues-manifest.json`.
- Влияние: низкая внешняя visibility development process; сложнее показать
  плановое управление backlog and governance.
- Почему не блокирует pilot/readiness stage: templates, roadmap and status docs
  already define expected process; created public issues improve visibility,
  but do not prove task completion or community adoption.
- Как риск будет снижаться: keep public issues current, link future evidence
  only after checks are actually performed, and use PR-based public review when
  practical.
- Уже снижающие evidence/documents/CI: `ROADMAP.md`, issue templates,
  `docs/PROJECT_STATUS_RU.md`, `docs/PUBLIC_ISSUES_PLAN_RU.md`,
  `docs/public-issues/public-issues-manifest.json`,
  `scripts/prepare_public_issues.sh`.
- Residual risk: community adoption is still low until external contributors,
  public reviewed PRs and sustained third-party activity appear.
- Следующий action: keep issue URLs current in
  `docs/public-issues/public-issues-manifest.json` and record real task
  evidence only after completion.

## 4. Низкая community adoption

- Текущий статус: риск открыт; stars/forks remain low and the project still
  looks like early-stage / pilot-stage OSS.
- Влияние: нет широкого external validation and "many eyes" effect; меньше
  внешних сигналов доверия.
- Почему не блокирует pilot/readiness stage: это не технический blocker.
  Specialized enterprise/security OSS normally grows through pilots,
  documentation, demos, case studies and references.
- Как риск будет снижаться: public demo pack, updated screenshots, pilot
  materials, external links, publications and first customer pilots.
- Уже снижающие evidence/documents/CI: README, demo docs, pilot docs,
  screenshots, public workflows, registry docs.
- Следующий action: завести публичную задачу
  `[docs] Refresh public demo pack and screenshots`.

## 5. Gitea restore test еще не выполнен

- Текущий статус: риск открыт; backup works, SHA256 verification works and daily
  timer is documented, but `restore_tested` remains false.
- Влияние: disaster recovery capability is documented but not yet proven by a
  restore drill on a separate host.
- Почему не блокирует pilot/readiness stage: backup contour already exists and
  can support readiness documentation; release/registry evidence still requires
  restore proof later.
- Как риск будет снижаться: perform restore test on a separate server, record
  logs, checksum verification, post-restore checks and rollback notes.
- Уже снижающие evidence/documents/CI:
  `docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md`,
  `docs/registry/registry-evidence-manifest.json`,
  `scripts/registry_readiness_check.sh`.
- Следующий action: завести публичную задачу
  `[registry] Perform Gitea backup restore test`.

## 6. Российский build-runner пока planned

- Текущий статус: риск открыт; `awatch-build-01` is planned, not ready.
- Влияние: release evidence cannot yet be produced on the target Russian
  build-runner contour.
- Почему не блокирует pilot/readiness stage: public GitHub Actions provides
  mirror validation, while registry release evidence is explicitly deferred to
  the Russian build-runner.
- Как риск будет снижаться: provision temporary or permanent `awatch-build-01`,
  install toolchain, connect to Russian Gitea and run required checks.
- Уже снижающие evidence/documents/CI:
  `docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`,
  `docs/registry/BUILD_RUNNER_SETUP_RUNBOOK_RU.md`, public CI/Coverage/
  Security as non-release validation.
- Следующий action: завести публичную задачу
  `[registry] Prepare temporary Russian build-runner awatch-build-01`.

## 7. Первый настоящий release evidence build pending

- Текущий статус: риск открыт; release evidence scripts exist, but the first
  real release evidence build on `awatch-build-01` has not been performed.
- Влияние: registry release evidence package is not yet available from the
  target build contour.
- Почему не блокирует pilot/readiness stage: pilot readiness can use current
  docs and public validation; registry release evidence is a later gate.
- Как риск будет снижаться: run release evidence scripts on the Russian
  build-runner, collect artifacts, checksums, cargo metadata/tree, logs and
  release manifest.
- Уже снижающие evidence/documents/CI:
  `scripts/build_release_evidence.sh`,
  `scripts/check_release_evidence.sh`,
  `docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md`,
  `docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md`.
- Следующий action: завести публичную задачу
  `[release] Produce first release evidence package`.

## 8. Юридический пакет правообладателя pending

- Текущий статус: риск открыт; technical readiness is strong, but rightsholder
  evidence package is not yet finalized.
- Влияние: registry submission cannot be treated as legally ready without
  ownership, rights and submission documentation.
- Почему не блокирует pilot/readiness stage: pilot/readiness is technical and
  operational; legal package is a separate submission track.
- Как риск будет снижаться: prepare rightsholder documents, ownership evidence,
  dependency review summary and legal review checklist.
- Уже снижающие evidence/documents/CI: registry docs, dependency statement,
  third-party license docs, conservative README positioning, public security
  and coverage validation.
- Следующий action: завести публичную задачу
  `[legal] Prepare rightsholder evidence package`.

## Review/governance evidence added

- CODEOWNERS exists for review routing and engineering ownership.
- PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
- Advisory branch protection policy exists in
  `docs/BRANCH_PROTECTION_POLICY_RU.md`.
- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
  with `verified_active_ruleset` status.
- PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
- PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
  PR #50 required checks passed, but first reviewed PR evidence remains pending.
- Public PR template includes security, registry-claim, runtime/API/UI,
  smoke-test, rollback and evidence checklist items.
- Visible external code review remains pending until public reviewed PRs exist.

## Следующие публичные задачи

Полный список задач для ручного заведения в GitHub issue tracker:

- `docs/PUBLIC_ISSUES_PLAN_RU.md`.
- `docs/public-issues/`.
- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.