Source: https://guthlabs.ai/docs/project-templates/security-remediation/tools/

project template / candidate

# Security remediation — tools

The distinct tools record for Security remediation. This page is proposal-only.

Status: **proposed**Lifecycle: **candidate**

## Record status

**Record ID**: project:security-remediation

**Parent lifecycle**: candidate

**Page lane**: app_features

**Lane lifecycle**: proposed

**Owner**: Not separately recorded

**Owner role**: Not separately recorded

**Owner status**: Not separately recorded

**Qualification result**: NOT RUN · held for evidence and human review

**Working browser surface:** [Project templates & workflows — overview](<https://guthlabs.ai/labs.html#templates-workflows>) — Create a local project from this template and validate its forms. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

## Authoritative app_features lane tools and interfaces

### Canonical tools-page assignments

- **Projects** (interface · required) — Owns the local project grouping, lifecycle, linked records, and evidence view.

- **To-dos** (interface · required) — Owns due dates, priorities, completion state, tags, and review signals for remediation work.

- **Agenda** (interface · required) — Provides source-bound deadlines, conflict review, and draft workback scheduling without external calendar writes.

- **Notes** (interface · required) — Captures investigation reasoning and source-labelled observations with revisions.

- **Files** (interface · required) — Keeps local file references beside records while upload and protected storage remain held.

- **Approvals** (interface · required) — Creates an explicit human gate before accepting a proposed remediation or effect.

- **Agent Logs** (interface · required) — Makes delegated work, authority boundaries, receipts, and current state inspectable.

- **PointGuard** (interface · required) — Carries the current project context across Notebook surfaces without becoming the canonical project owner.

- **Checksum Verifier** (provider · optional) — May be staged for local integrity checks when a source hash is available; no external verification or authority is implied.

Only the page's admitted lane is rendered as an assignment. Other lane inventories remain source records but are not merged here. Tool kind and required/optional status are preserved.

## Authoritative lane instrument assignments

### Canonical tools-page assignments

[checksum-verifieroptional · Compare a locally supplied digest with a recorded source SHA-256 as an educational integrity check; do not treat the result as proof of trustworthiness or remediation success.](<https://guthlabs.ai/docs/instruments/checksum-verifier/>)

An instrument listed only for another lane does not become a tools-page assignment.

## Use boundary

- A security project can expose sensitive details in notes, search, PointGuard context, or file metadata; default views should minimize sensitive content and respect visibility partitions.

- A remediation plan may be mistaken for a completed repair; proposed, validated, approved, and externally effected states must remain distinct.

- Imported evidence may be stale, incomplete, or malicious; provenance and integrity checks do not establish trust.

- Overly broad scope can turn bounded investigation into unauthorized access or production change; require explicit out-of-scope fields.

- Deadline automation can create false urgency or hidden authority; all schedule changes and recurring actions remain drafts.

- Agent suggestions may be accepted without sufficient human review; preserve authority, receipts, and reviewer identity.

- Local browser persistence may be lost or unavailable; show storage state and provide a held export or recovery path without claiming durable backend storage.

- Accessibility failures in dense evidence tables, timelines, or status chips can hide blockers from keyboard and screen-reader users.

## Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

- `source_record:project:security-remediation`

- `NotebookCollectionKind.project`

- `NotebookTodoPayload.dueAt`

- `Notebook Agenda deadlines/workbacks`

- `Notebook records provenance and revision contract`

- `PointGuard persistent cross-app context surface`

- `Current GuthHub app routes and held web boundary`

- `ALLOWED_INSTRUMENTS: checksum-verifier`