Repository navigation
Risks
Karthik P edited this page Nov 1, 2026
·
2 revisions
This page lists the known risks to fiscalclock, with likelihood, impact, mitigation and the phase that owns each one.
Last reviewed: 1 Nov 2026
Status of this page: Proposed. The first ten risks and their likelihoods come from the research proposal's "Risks and decisions" table. The proposal gives no impact or owner phase, so those columns, and every row after the first ten, are this page's proposal and open to review. Phases follow the Roadmap. "Built" in a mitigation means it exists in the repository today; everything else is planned.
The proposal names losing focus as the biggest risk, and a definition format that needs a breaking change once real enterprise calendars arrive as the second.
| # | Risk | Likelihood | Impact | Mitigation | Owner phase |
|---|---|---|---|---|---|
| R1 | Scope creep into holidays, business days and pay periods | High | High | Out-of-scope list in the README and AGENTS.md (built); periods exposed as plain intervals (ADR-0015) | All phases |
| R2 | The definition format needs a breaking change | Medium | High | Independent blocks (ADR-0005); spec_version required from day one (built); reserved features rejected with UNSUPPORTED_FEATURE rather than misread (built). The proposal wanted table, anchored and transitions in the format before v0.1; they are designed but deferred to 0.2 (ADR-0021), which leaves this risk open (contradiction D12). No upgrade() function exists yet. |
Phase 2: v0.2, frozen in Phase 5: v1.0 |
| R3 | Enterprises do not trust a new library with reporting dates | Medium | High | Conformance vectors, the claim verification script and the 400-year check are public and run in CI (built); per-filer SEC vectors (planned, Gate C). See Testing-Strategy. | Phase 1: v0.1 onwards |
| R4 | Rule conflicts in real calendars (Care.com) | Medium | Medium |
RULE_CONFLICT at validation naming the years affected, and overrides to resolve them (planned, Gate C). The divergence years depend on how "closest and prior to December 31" is read and on the window checked (checks C16 and C17, contradiction D11). |
Phase 2: v0.2 |
| R5 | WebAssembly toolchain churn | Medium | Medium | wasm-bindgen used directly, no wasm-pack (built, ADR-0020); the wasm-bindgen CLI version is pinned in CI (built); bundle-size budget in CI (planned) | Phase 1: v0.1 |
| R6 | Free-threaded Python wheels | Medium | Medium |
cp314t wheels next to the abi3 wheels (built); move to abi3t once Python 3.15 is the floor, since PEP 803 brings abi3t in 3.15 (status Final as of 31 Oct 2026) (ADR-0011) |
Phase 1: v0.1 |
| R7 | A Polars plug-in breaks on Polars upgrades | Medium | Low | Arrow PyCapsule path first (ADR-0012, planned for 0.2); any plug-in is a separate package, built only on demand | Phase 2: v0.2 |
| R8 | Registry entries go stale or are wrong | Medium | High | Each entry cites its filing and is tested against reported period ends; the registry is versioned apart from the core (ADR-0027, Accepted 1 Nov 2026) | Phase 4: v0.4 |
| R9 |
infer returns several matches |
Certain with few inputs | Medium | Return every candidate with the first date where they diverge; accept quarter ends and labels as extra inputs (planned) | Phase 4: v0.4 |
| R10 | A competing JS package covers the same ground | Low | Low | Compete on correctness evidence and cross-language identity; test fiscal-year-calendar's 53-week behaviour (planned) | Phase 4: v0.4 |
| # | Risk | Likelihood | Impact | Mitigation | Owner phase |
|---|---|---|---|---|---|
| R11 | Supply-chain compromise through a dependency or a CI action | Low | High | Built: every action in the workflows is pinned to a full commit SHA; each job gets only the permissions it needs; Dependabot updates the pinned actions (dependabot.yml); the core has three dependencies (serde, serde_json, sha2) and adding one needs the maintainer's agreement (AGENTS.md); release artefacts get build provenance attestations (release.yml). |
Phase 1: v0.1 |
| R12 | A registry account or token is compromised and a malicious version is published | Low | High | Built: the publish jobs run in the GitHub environments crates-io, pypi and npm, each with a required reviewer and a deployment policy that allows only v* tags (check with gh api repos/Karthik-beta/fiscalclock/environments). PyPI uses trusted publishing, so it needs no stored token. Planned: two-factor authentication on every registry account and a move to trusted publishing on crates.io and npm after the first release. |
Phase 1: v0.1 |
| R13 | The first publish needs long-lived tokens | Certain for 0.1.0 | Medium | crates.io: a Rust blog post of 11 Jul 2025 says the first release must be published manually before trusted publishing can be set up (Rust blog); the crates.io documentation was not confirmed, so this is partly verified. npm: trusted publishing needs npm CLI 11.5.1 or later and Node.js 22.14.0 or later (npm docs); whether the package must already exist is not stated there (unverified). Mitigation: tokens were stored only as environment secrets and used for 0.1.0; trusted publishing was then configured on crates.io and npm and both secrets were deleted (#35). Closed on 1 Nov 2026. | Phase 1: v0.1 |
| R14 |
Temporal is not available in Safari |
Certain as of 31 Oct 2026 | Low | ISO strings are the main input and Temporal.PlainDate is accepted only when present; no polyfill is required (built). caniuse lists no stable Safari release with Temporal as of 31 Oct 2026, and WebKit bug 320164 is closed as a duplicate of the implementation bug 223166. Node.js 26 enables Temporal by default (release notes). |
Phase 1: v0.1 |
| R15 | Package names are taken before the first publish | Low | Medium |
fiscalclock was free on crates.io, PyPI and npm as of 31 Oct 2026 (ADR-0026); re-check just before tagging. |
Phase 1: v0.1 |
| # | Risk | Likelihood | Impact | Mitigation | Owner phase |
|---|---|---|---|---|---|
| R16 | A claim in the documentation rests on an unverified or misquoted source | Medium | Medium | Every claim has a source link or a reproducible check, or is marked unverified (Evidence); conformance vectors use only cited or independent sources; examples not checked against their source are marked illustrative. | All phases |
Claims currently unverified or disputed, as recorded on the Evidence page:
- Monthly downloads of fiscalyear: the proposal's "about 345,000" matches neither source as of 31 Oct 2026. ecosyste.ms reports 339,074 for its last month in a snapshot of 25 Aug 2026; pypistats reports 206,407 for the last month.
- Nepal's year start "16, 17 or 18 July": the source is a user forum comment.
- Thai government years in the Buddhist Era, "many Japanese companies" naming by start year, and "FY 2025-26" being common in the UK and Australia: no primary source found (contradiction D10).
- Vishay's Q1 anchor (the Saturday nearest 31 March): the filing does not name it.
- SEC filing quotes (Vishay, Costco, Kroger, Care.com): sec.gov refused the automated fetch, so these were checked only through page excerpts. Apple's quotes were compared with a saved copy of the page.
- ThreeTen-Extra's "8064 combinations": the source's own product evaluates to a different number.
- Several gap-analysis quotes (SAP, Jiff, Polars, Business Standard) are not verbatim; the corrected wording is on the Evidence page.
These ADRs were decided on 1 Nov 2026 under the maintainer's delegation. Their designs are untested until implemented, which is the remaining risk.
fiscalclock is licensed under MIT OR Apache-2.0 (MIT, Apache-2.0). Last reviewed: 31 Oct 2026. Found an error on this page? Report it with the documentation form.