Source: https://guthlabs.ai/docs/project-templates/security-remediation/deadlines/ project template / candidate # Security remediation โ€” deadlines The distinct deadlines record for Security remediation. This page is proposal-only. Status: **proposed**Lifecycle: **candidate** ## Record status **Record ID**: project:security-remediation **Parent lifecycle**: candidate **Page lane**: app_features **Lane lifecycle**: proposed **Owner**: Not separately recorded **Owner role**: Not separately recorded **Owner status**: Not separately recorded **Qualification result**: NOT RUN ยท held for evidence and human review **Working browser surface:** [Project templates & workflows โ€” overview]() โ€” Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held. ## Deadline and workback rules - A project cannot be accepted without a project owner, target completion date, severity, and scope status. - Every milestone must have an owner, due date, entry criteria, output, and evidence requirement. - Workback dates must be visibly derived from the target completion date and preserve timezone and revision history. - A missed deadline changes the item to overdue or blocked and requires an owner note; it does not silently reschedule work. - Any scope change requires a new scope revision and approval before dependent work proceeds. - Validation and closure deadlines cannot be marked complete without linked evidence and reviewer disposition. - Uncertain or missing dates remain explicitly unknown rather than being inferred. - External provider writes, credential use, database changes, customer effects, publication, and production effects remain held unless separately verified and approved. - A project must have an owner and reviewer before remediation to-dos are marked ready. - Every remediation step must have a due date or an explicit reason it is undated. - The final validation deadline must precede any proposed external effect deadline. - If a dependency is overdue, downstream steps show blocked rather than silently moving dates. - Agenda changes are drafts only and require human review before any external calendar write. - Recurring deadlines are proposals only and require confirmation before activation. - Overdue items remain visible in Today and the project workback until completed, rescheduled, or held. ## Workback sequence - Create the project and assign a human owner and reviewer. - Write the bounded issue statement and record explicit in-scope and out-of-scope actions. - Attach source-labelled notes and file references; preserve locators, provenance, revisions, and available hashes. - Create a containment or investigation workback with dependencies and human-owned deadlines. - Investigate using linked evidence without changing external systems or widening authority. - Draft the remediation change as a local proposal and record rollback or containment considerations. - Run local validation checks and record expected versus observed results. - Open an approval record for reviewer disposition: Needs review, Approved, or Held. - Update the project status and receipts; keep any provider, credential, database, customer, publication, or production action held. ## Scheduling records - milestone records - deadline and workback to-dos - dependency records - owner assignments - deadline and workback records ## Sources and evidence These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment. - `source_record:project:security-remediation` - `NotebookCollectionKind.project` - `NotebookTodoPayload.dueAt` - `Notebook Agenda deadlines/workbacks` - `Observed native contract: records preserve canonical IDs, provenance, revisions, lifecycle, tags, links, attachments, and record revisions` - `Observed native contract: PointGuard is a persistent cross-app context surface; specialist apps remain execution and canonical-record owners` - `Observed native contract: provider, credential, database, customer, publication, and production effects are held` - `/app/notebook/projects/` - `/app/notebook/to-dos/` - `/app/notebook/agenda/` - `/app/notebook/approvals/` - `/app/notebook/files/` - `/app/notebook/field-guides/` - `/app/notebook/agent-logs/` - `/app/pointguard/` - `Notebook records provenance and revision contract` - `PointGuard persistent cross-app context surface` - `Current GuthHub app routes and held web boundary` - `ALLOWED_INSTRUMENTS: checksum-verifier`