feat(risk): Key Risk Indicators with thresholds tied to risk appetite — a breach drafts a risk signal

[alex-dembele]

Problem

A risk manager, especially in banking (COBAC, BCEAO) or under DORA, watches indicators: the share of critical patches older than 30 days, the number of privileged accounts without MFA, the availability of critical services. When an indicator crosses the appetite set by the board, they escalate. On 2026-09-25 OpenRisk has no KRI entity (search: grep -rn 'KRI\|KeyRiskIndicator' backend returns nothing). Risk appetite (#319) is not modelled either. The risk register therefore reacts only to manual entries and scanner findings, never to a drifting metric.

Proposed scope (to refine)

• A KRI entity (tenant-scoped): name, owner, unit, collection source (manual, API, connector), frequency, thresholds (green, amber, red), and a link to a risk category or to specific risks.
• Values are recorded over time. Nothing is overwritten; the history is kept.
• Thresholds derive from the appetite of W7-06 — Risk appetite and tolerance configuration per business unit #319 when one is defined.
• A red breach emits a signal, which reuses the inlet of feat(ingest): POST /v1/signals and POST /v1/findings — the inlet the closed loop needs #544. The auto-draft of feat(workflow): risk auto-draft orchestrator — finding to scored draft, unattended #547 turns it into a draft risk, and a human approves it in the queue of feat(ux): human validation queue for auto-drafted risks — approve, edit, reject, defer #550.

Acceptance criteria (draft)

1. CRUD on KRIs and on their values, filtered by tenant_id, with the three CLAUDE.md rule 4 tests.
2. Crossing a threshold emits exactly one signal per state change, not one per value, and the signal carries its provenance (feat(provenance): every field answers "where did this come from?" #546).
3. The dashboard shows the status of the KRIs and their trend over the last 12 values.
4. A KRI fed by the API is proven by an integration test.

Definition of Done

A KRI crossing its red threshold produces a draft risk in the validation queue without any manual step.

Depends on: #319 (appetite) · #544 (signal inlet) · #547 (auto-draft). That is why it sits in Release 1.3 — Risk Auto-Draft, after the January launch.