Security remediation — deadlines

The distinct deadlines record for Security remediation. This page is proposal-only.

Status: proposedLifecycle: candidate

Record status

Record ID: project:security-remediation
Parent lifecycle: candidate
Page lane: app_features
Lane lifecycle: proposed
Owner: Not separately recorded
Owner role: Not separately recorded
Owner status: Not separately recorded
Qualification result: NOT RUN · held for evidence and human review

Working browser surface: Project templates & workflows — overview — Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

Deadline and workback rules

A project cannot be accepted without a project owner, target completion date, severity, and scope status.
Every milestone must have an owner, due date, entry criteria, output, and evidence requirement.
Workback dates must be visibly derived from the target completion date and preserve timezone and revision history.
A missed deadline changes the item to overdue or blocked and requires an owner note; it does not silently reschedule work.
Any scope change requires a new scope revision and approval before dependent work proceeds.
Validation and closure deadlines cannot be marked complete without linked evidence and reviewer disposition.
Uncertain or missing dates remain explicitly unknown rather than being inferred.
External provider writes, credential use, database changes, customer effects, publication, and production effects remain held unless separately verified and approved.
A project must have an owner and reviewer before remediation to-dos are marked ready.
Every remediation step must have a due date or an explicit reason it is undated.
The final validation deadline must precede any proposed external effect deadline.
If a dependency is overdue, downstream steps show blocked rather than silently moving dates.
Agenda changes are drafts only and require human review before any external calendar write.
Recurring deadlines are proposals only and require confirmation before activation.
Overdue items remain visible in Today and the project workback until completed, rescheduled, or held.

Workback sequence

Create the project and assign a human owner and reviewer.
Write the bounded issue statement and record explicit in-scope and out-of-scope actions.
Attach source-labelled notes and file references; preserve locators, provenance, revisions, and available hashes.
Create a containment or investigation workback with dependencies and human-owned deadlines.
Investigate using linked evidence without changing external systems or widening authority.
Draft the remediation change as a local proposal and record rollback or containment considerations.
Run local validation checks and record expected versus observed results.
Open an approval record for reviewer disposition: Needs review, Approved, or Held.
Update the project status and receipts; keep any provider, credential, database, customer, publication, or production action held.

Scheduling records

milestone records
deadline and workback to-dos
dependency records
owner assignments
deadline and workback records

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

source_record:project:security-remediation
NotebookCollectionKind.project
NotebookTodoPayload.dueAt
Notebook Agenda deadlines/workbacks
Observed native contract: records preserve canonical IDs, provenance, revisions, lifecycle, tags, links, attachments, and record revisions
Observed native contract: PointGuard is a persistent cross-app context surface; specialist apps remain execution and canonical-record owners
Observed native contract: provider, credential, database, customer, publication, and production effects are held
/app/notebook/projects/
/app/notebook/to-dos/
/app/notebook/agenda/
/app/notebook/approvals/
/app/notebook/files/
/app/notebook/field-guides/
/app/notebook/agent-logs/
/app/pointguard/
Notebook records provenance and revision contract
PointGuard persistent cross-app context surface
Current GuthHub app routes and held web boundary
ALLOWED_INSTRUMENTS: checksum-verifier