Remediation Plan

Which K fixes, in what order — and watch my exposure curve drop?

Every other AgentSmack meta-layer stops one step short of the literal sprint-planning question. The risk register ranks findings but gives no sequenced plan and no residual projection; the chokepoint finds only the single minimum-cut; fix-impact ranks surfaces. None answer: I have budget for K fixes this sprint — which K findings, in what optimal order, and what is my residual exposure curve after each one? This is that artifact. It consumes the same cross-surface findings envelope every scan emits (plus an optional sprint budget) and emits a greedy marginal-value-ordered remediation sequence plus a projected posture-recovery trajectory — the residual exposure band after each fix is applied. Each step is ordered by a documented total key: a fix that breaks a confirmed kill-chain first, then exploitability, then severity. The greedy is residual-aware — after each pick the remaining findings' chain-break value is recomputed against the shrinking remainder, so it is a true plan, not a static sort. Severity, exploitability, chain-anchoring, and the paste-able fix are inherited verbatim from the risk register so the closed vocabulary cannot drift; the chain-break predicate is the EXACT kill-chain completeness check. It adds no new surface and no new scorecard dimension — a pure plan OVER the others. Load a sample to watch the exposure curve drop fix-by-fix with no live infra.