- 19.7-SECURITY-REVIEW.md: T-19.7-01..41 and T-19.7-SC with file, line and pinning test; two production fixes (c49983d,1111828); superuser reach accepted as designed with audit and ceiling - 19.7-SECURITY.md: threats_open 0, accepted risks AR-19.7-01..05 - the frontend permission and account link todos move to todos/done with their closing notes
Todos
pending/: open todos. Each one has a matching g15office task, and its frontmatter carries the task ID asg15office: <id>.done/: closed todos, each ending with a## Closed <date>note.
Keep todos synchronized with g15office (project summercms). Creating, closing or promoting a todo updates its g15office task in the same session. The rules and the phase → task map are in ../G15OFFICE.md.