{
  "planPath": "archreview/plans/PLAN-R2-07-ui-management-security.md",
  "tasks": [
    {
      "id": 1,
      "subject": "Task 1: Route the DebugStreamHub LDAP bind through ManagementAuthenticator (throttled) + fix the false doc claim",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 2,
      "subject": "Task 2: ForwardedHeadersSetup — trusted-proxy client-IP resolution for the throttle keys",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 3,
      "subject": "Task 3: Ship the ForwardedHeaders config to the Traefik topologies + document the lockout-DoS trade-off",
      "status": "pending",
      "blockedBy": [
        2
      ]
    },
    {
      "id": 4,
      "subject": "Task 4: Enforce site scope on secured-write submit / approve / reject",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 5,
      "subject": "Task 5: ISecuredWriteRepository — additive permitted-sites filter for scoped listing",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 6,
      "subject": "Task 6: Scope-filter HandleListSecuredWrites + amend Component-Security.md:141 + matrix verification",
      "status": "pending",
      "blockedBy": [
        4,
        5
      ]
    },
    {
      "id": 7,
      "subject": "Task 7: AlarmSummary.RefreshAsync stale-site guard — never display cross-site data",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 8,
      "subject": "Task 8: While live, the poll updates only _notReporting — never regresses live rows",
      "status": "pending",
      "blockedBy": [
        7
      ]
    },
    {
      "id": 9,
      "subject": "Task 9: House disposal guard on the live callback",
      "status": "pending",
      "blockedBy": [
        8
      ]
    },
    {
      "id": 10,
      "subject": "Task 10: Un-stick IsLive — deathwatch resets liveness when the aggregator terminates (MUTEX with PLAN-R2-02 SiteAlarmLiveCacheService task)",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Amortize LoginThrottle.Prune off the failure hot path",
      "status": "pending",
      "blockedBy": []
    },
    {
      "id": 12,
      "subject": "Task 12: Lock in the scrubber's fragment coverage + document the array-merge limitation",
      "status": "pending",
      "blockedBy": []
    }
  ],
  "lastUpdated": "2026-07-13T03:26:45Z"
}