Some rules detect instead of prevent (“Flags after, with a fix”), and some actions get past a check anyway: Claros for Mac answered after the message was sent (“Already sent”), or a connected system reports an action that already happened. Then the fix is tracked.

​
When a fix opens

  • A send Claros for Mac didn’t hold breaks a stop rule: a fix opens at once.
  • A send it didn’t hold breaks an ask rule: the owner gets “Already sent — was this fine?”; Not fine opens a fix (with their reason as its note).
  • A system reports an action that already happened: POST /v1/check with happened: {source, channel?, ts?, repo?, pr?, url?, person?} — a Slack message (channel, ts), a GitHub pull request (repo, pr). A stop opens a fix for person.
Each fix says what to undo — the judge’s fix for that action, else the rule’s fix, else what undoes the action (“delete the message in #general”, “close or revert the pull request acme/app#42”) — and when: the workspace’s window, 24 hours by default (PUT /api/incidents/settings {due_hours}, admins).

​
Closing it

The person sees it in their Inbox — Fix: delete the message in #general — due tomorrow — and their channel tells them once. Done takes an optional note. The rule’s owner (or their stand-in while they’re away) sees it with Waive. Done is verified where Claros can look: the Slack message is gone (the workspace’s Slack connector), the pull request was closed without merging or reverted (the GitHub connector). Otherwise it’s done (self-reported) and the owner is told. Fixes with something to look at are re-checked every few minutes, so a message deleted without pressing Done is verified too. Every step — opened, done, verified, waived — is an entry in the tamper-evident log.

​
In the evidence

The evidence pack (remediation) and the oversight report give, per rule: fixes opened, verified, done (self-reported), waived, still open and overdue, and the time to remediate (opened → done or verified), median and longest, in hours.