Risk register

Status: active
Review: when a trigger occurs, after each completed work package, at milestone boundaries, and before dependency upgrades

Likelihood and impact use low, medium, or high. Status is monitoring, active, mitigated, or closed. An owner is a workstream until individual maintainers are assigned.

mitigated means a tested control reduces exposure; it does not mean the risk can never recur. closed requires the underlying exposure to be removed.

Register

ID	Risk	L	I	Status	Owner	Preventive response	Trigger / early signal	Contingency
R-001	Oxigraph semantics differ from Redland in edge cases	H	H	active	Compatibility	native oracle and normalized differential fixtures; 0.10 candidate inventory feeds the 0.11 harness	first unexplained mismatch	add a private adapter; any remaining in-scope deviation blocks 0.11
R-002	“100% parity” becomes an unqualified claim	H	H	mitigated	Documentation	chartered claim levels, scoped reports, check-0.10-parity.py / release gate	release text omits inventory/platform/evidence scope	block or correct release communication
R-003	Direct Oxigraph term re-exports prevent a compatibility fix	M	H	monitoring	Safe API	ADR-004 trigger, API snapshot, fixture-first review	required behavior cannot be represented	wrapper migration with 0.x migration guide
R-004	Redland C ownership is reproduced unsafely	M	H	mitigated	C ABI	separate crate, handle invariants, ASan/LSan, full C surface lifecycle tests	first pointer or callback API	stop ABI expansion and redesign handle contract
R-005	Baseline storage behavior cannot be reproduced	H	H	mitigated	Storage	pin canonical baseline profiles; factory facade; crash/conformance matrix	backend inventory review finds hard dependency	implement an equivalent adapter or hold 0.10; capability errors and migration-only paths do not satisfy parity
R-006	Native Redland oracle depends on platform or build versions	M	H	mitigated	Compatibility	pin and checksum sources/build metadata; frozen 0.10 matrix profiles	fixture differs across oracle builds	separate platform profiles and investigate before accepting
R-007	Facades materialize unbounded input or output	M	H	active	Safe API	streaming core, early-stop and memory gates	large fixture exceeds budget or API returns full collection	redesign before stabilizing affected facade
R-008	Oxigraph upgrade changes behavior, features, or MSRV	M	H	active	Safe API	exact release pin and full-suite upgrade gate	dependency update or security advisory	hold upgrade, adapt privately, or revise supported matrix
R-009	C ABI freezes before Rust semantics stabilize	M	H	mitigated	C ABI	0.6 accounting gate before 0.8; full C surface verified in 0.10 inventory	ABI work starts with open mappings	keep symbols experimental or defer ABI milestone
R-010	Upstream conformance claims hide facade defects	M	H	active	RDF/SPARQL	run manifests through public Oxiland APIs	Oxigraph-only evidence is proposed	reject verification state until facade suite runs
R-011	Required CI becomes too slow or costly	M	M	monitoring	Tooling	tier fast PR, release, and scheduled suites	median PR signal exceeds agreed budget	shard/cache suites without weakening release gates
R-012	Accepted deviations accumulate before the parity freeze	M	H	active	Compatibility	owner, impact, workaround, review milestone; 0.11 hard gate rejects deviations	review milestone passes	reopen the affected claim; every in-scope deviation blocks 0.11
R-013	unsafe, callback re-entry, or panic creates FFI defects	M	H	mitigated	C ABI	local safety proofs, panic boundaries, re-entry tests, ASan/LSan, fuzz targets	C callback support lands	quarantine affected symbol and run focused audit
R-014	Downstream consumers depend on undocumented quirks	H	M	monitoring	Compatibility	select consumers early and capture fixtures	first downstream build/test failure	classify quirk and add adapter or limitation
R-015	Packaged artifacts differ from workspace builds	M	H	mitigated	Tooling	package dry-run and clean-install tests; wheel/C smoke CI	packaged smoke test diverges	block publish and repair package manifest/workflow
R-016	0.x persistent data becomes unreadable or partially updated	M	H	active	Storage	label format unstable, export guidance, reopen/failure tests	format change, failed Fjall write, or upgrade request	preserve old reader/export tool; block destructive migration
R-017	Parser failure leaves a model partially loaded unexpectedly	H	H	monitoring	RDF/SPARQL	ADR-007 progressive vs collecting APIs	callers assume silent atomicity	document path; add 0.4 transactions
R-018	Format aliases or auto-detection select the wrong syntax	M	M	monitoring	RDF/SPARQL	closed Syntax table, ADR-008	alias collision or misleading extension/MIME	require explicit format and publish corrected mapping
R-019	Planning outruns implementation and evidence	M	H	mitigated	Documentation	separate charter/roadmap/milestone/parity authority; qualification validators	planned feature described as available	correct claim and add consistency check/review gate
R-020	Oxigraph 0.5.9 pins vulnerable quick-xml 0.37 in RDF/XML and SPARQL XML paths	M	H	active	Safe API	Tip/release CI share a narrow, self-expiring ignore for RUSTSEC-2026-0194/0195 verified by scripts/check-security-exceptions.py	Oxigraph releases a line that accepts quick-xml 0.41+ (main already uses 0.41)	upgrade Oxigraph under the full compatibility suite; remove the tip ignores
R-021	Optional storage engines weaken durability or strand backend-specific data	M	H	mitigated	Storage	ADR-022/024, sealed adapter, shared conformance/crash matrix (backend_conformance), versioned layout markers, RDF export path	first non-Fjall adapter, dependency removal, wrong-backend open, or divergent transaction result	do not promote/freeze the adapter; preserve its reader/export feature and migrate through standards RDF
R-022	“Faster than Redland” is produced by noise, cherry-picked workloads, unequal builds, or debug/dev Rust compiles	H	H	closed	Performance	ADR-028 competitive-parity gate; ADR-029 suite-wide nine-cell gate; frozen workloads; require_production_compile; check-0.12-release.py / check-0.13-release.py; native evidence under compatibility/qualification/performance/0.12/ and …/0.13/	any synthetic, wrong-host, fabricated ratio, debug artifact, missing --release, deleted case, or environment mismatch	reopen the affected claim; publish only suite-/host-scoped ratios with provenance
R-023	Optional LMDB dependency heed retains unmaintained bincode 1.3.3	M	M	mitigated	Storage	ADR-027: keep heed/bincode for 0.10 with LMDB optional; RustSec audit on lockfiles; track upstream	a vulnerability, format defect, or unsupported-toolchain issue lands in the inherited crate	update heed under the storage conformance suite or preserve the LMDB reader/export window while replacing the adapter dependency
R-024	Qualification metadata asserts target/profile passes that were not executed there	H	H	active	Compatibility	0.11 raw two-sided execution bundles, host attestation, exact-revision/artifact hashes, and a checker that rejects profile fan-out	a profile lacks native Redland output or shares an execution identity with another target	invalidate inherited verification, run the profile on its declared host, and hold the full-parity claim
R-025	Function-name coverage is mistaken for C source or binary ABI compatibility	H	H	active	C ABI	complete header/declaration/layout inventory, unchanged-source builds, ABI tooling, and Redland-built no-rebuild loader tests	a downstream source fails to compile or a Redland-built binary fails to load/run	implement the missing contract or keep the C surface labeled preview; hold 0.11

Release-blocking rule

A risk blocks a release when any of these is true:

• impact is high and its trigger has occurred without a tested response;
• it invalidates the milestone outcome or a published compatibility claim;
• it can cause data loss, memory unsafety, silent semantic corruption, or ABI corruption;
• its response depends on an unresolved decision required by the milestone;
• the release would make the risky behavior harder to change or recover from.

The release report lists all active high-impact risks and explains why each is controlled or blocking.

Review and status changes

At review:

1. confirm likelihood and impact against current implementation;
2. inspect triggers and linked evidence;
3. verify the preventive response is actually running;
4. create or update the contingency owner and next action;
5. change status only with a reason and evidence link.

Closing a risk requires evidence that the exposure is gone. Renaming it as a known limitation is not closure. A regression may move a mitigated or closed risk back to active.

Current focus (post-0.13)

R-022 is closed for the 0.12 competitive-parity gate (ADR-028) and for the 0.13 suite-wide faster-than-Redland gate (ADR-029; nine corrected-runner cells green under .github/workflows/qualify-0.13.yml / scripts/check-0.13-release.py). Retain production-compile discipline on any future performance re-qualification; a red nine-cell re-run would reopen the blanket claim.

Historical 0.12 focus

Immediate blockers and controls:

• R-022: close the faster-than-Redland gate under milestone 0.12 — freeze resource budgets, require Cargo --release / production-compile provenance, attribute Unix scan/C-call cliffs and Windows near-ties, and require native revision-bound wins with no required-case waiver.
• R-024 / R-025: 0.11 parity evidence remains a retention gate on every performance candidate; do not trade behavioral proof for speed.
• R-001 / R-002 / R-006 / R-012 / R-019: keep inventory, docs, and claims aligned with verified matrices while 0.12 lands optimizations.
• R-004 / R-009 / R-013: C ABI surface and sanitizers stay green on optimized oxiland-capi artifacts.
• R-005 / R-021: storage conformance/crash matrix remains green when durable bulk/reopen cases are in the performance suite.
• R-015: package/wheel/C smoke and clean-install CI paths on release candidates.
• R-023: ADR-027 accepts optional heed/bincode while tracking upstream.

Still active and release-relevant: R-007, R-008, R-010, R-016, and R-020 (narrow quick-xml CI exception). No active high-impact risk is waived merely because its preventive validator exists. Native 0.11 samples diagnose the historical performance backlog; green 0.12 and 0.13 gates authorize the competitive-parity and suite-wide faster-than-Redland claims respectively.