• Turning a Raven case file into a client proposal
• Estimating scope and timeline for security remediation work
• Producing a professional quote for code repair services
• User says "quote this" or "how much would this cost" or "estimate the work"
• User calls

  /osprey-appraise

  or mentions quoting, pricing, estimation, proposal
• Scoping work for a new client engagement
• Translating any technical assessment into business deliverables

raven-investigate

hawk-survey

turtle-harden

raccoon-audit

• Overall grade and narrative ("Bolted On", "Wishful Thinking", etc.)
• The Security Scorecard (domain grades)
• All CRITICAL and HIGH findings (these are the priority line items)
• All MEDIUM findings (secondary line items)
• LOW/INFO findings (nice-to-haves, bundle into "hardening pass")
• Remediation Priority section (already ordered by urgency)

1. Tech stack — What languages, frameworks, infrastructure?
2. Codebase size — Rough file/line count
3. Obvious gaps — Quick scan for: .gitignore health, pre-commit hooks, dependency lock files, security headers, auth patterns, secrets in code
4. Client's stated concerns — What do THEY think needs fixing?

• Budget sensitivity — Startup vs enterprise vs indie dev?
• Timeline pressure — "Fix this before launch" vs "whenever you can"?
• Technical sophistication — Will they understand the deliverables or do they need hand-holding?
• Ongoing relationship — One-time fix vs retainer potential?
• Decision maker — Technical lead? CTO? Non-technical founder?

| #   | Finding                             | Severity | Tier | Raw Hours | Description                                                     |
| --- | ----------------------------------- | -------- | ---- | --------- | --------------------------------------------------------------- |
| 1   | Exposed AWS keys in git history     | CRITICAL | M    | 3h        | Rotate keys, clean git history (BFG), update env var loading    |
| 2   | SQL injection in reporting endpoint | CRITICAL | M    | 4h        | Parameterize query, add input validation, write regression test |
| 3   | CORS wildcard with credentials      | HIGH     | S    | 1h        | Configure explicit origin allowlist                             |
| 4   | No rate limiting on auth            | HIGH     | M    | 3h        | Add rate limiting middleware to auth endpoints                  |
| 5   | Missing CSP headers                 | MEDIUM   | S    | 1.5h      | Configure CSP with nonce-based approach                         |
| ... | ...                                 | ...      | ...  | ...       | ...                                                             |

• "Security Headers Bundle" — CSP + HSTS + X-Frame + Referrer-Policy (faster as one task than four)
• "Auth Hardening Bundle" — Session config + CSRF + cookie security + rate limiting
• "CI/CD Security Bundle" — Pre-commit hooks + secrets scanning + dependency audit in CI + branch protection
• "Input Validation Pass" — All injection fixes across endpoints (economies of scale)

Final Hours = Raw Hours × 1.15

• Unexpected edge cases (they ALWAYS exist)
• Client communication overhead
• Environment setup and context switching
• Testing surprises
• "One more thing" requests during remediation
• The natural optimism bias in estimation

undefined

• Complete remediation of all [N] findings listed in scope
• Verification testing for each fix
• Re-assessment scan upon completion
• Final security posture report (before/after comparison)
• Security documentation and maintenance runbook
• [N] days of post-delivery support for questions

• New feature development
• Performance optimization (unless security-related)
• UI/UX changes
• Infrastructure migration
• Ongoing security monitoring (available as retainer — see below)
• Findings discovered AFTER initial assessment (quoted separately)

• Monthly dependency audits and updates
• Quarterly security posture re-assessment
• Priority response for new vulnerabilities
• Pre-commit hooks and CI/CD maintenance

• This proposal is valid for 30 days from the date above
• Work begins upon signed acceptance and deposit receipt
• Timeline assumes prompt environment access and reasonable client response times (within 24-48h for questions)
• Scope changes after acceptance are quoted separately
• All work is performed on a dedicated branch with full git history

1. Review this proposal
2. Reply with any questions or adjustments
3. Sign and return with deposit to begin
4. We'll schedule the kickoff call

**4B. Adapt Language to Client**

| Client Type              | Language Style                                               |
| ------------------------ | ------------------------------------------------------------ |
| Technical lead / CTO     | Use specific technical terms, reference CVEs, mention tools  |
| Non-technical founder    | Plain language, focus on business impact, avoid jargon       |
| Enterprise security team | Formal, reference compliance frameworks, include methodology |
| Indie dev / solo founder | Warm, conversational, focus on practical outcomes            |

**4C. Review the Draft**

Before finalizing, check:

- [ ] All findings from the assessment are accounted for
- [ ] Hours are buffered (×1.15)
- [ ] Pricing is clear and unambiguous
- [ ] Timeline is realistic with the buffer built in
- [ ] Scope exclusions are explicit (prevents scope creep)
- [ ] Payment terms are defined
- [ ] Language matches the client's sophistication level
- [ ] No technical jargon in executive summary
- [ ] "What's Not Included" section is present (critical for scope management)

**Output:** Complete proposal document ready for delivery.

---

Hi [Client],

Following our security assessment of [project], I've put together a
remediation proposal covering [N] findings across [N] security domains.

Quick overview:
- Current posture: [Grade] ("[Narrative]")
- Critical findings: [N] (addressed in the first [N] days)
- Total scope: [N] deliverables across [N] phases
- Timeline: [N] weeks
- Investment: $[total]

The full proposal is attached / linked below. Happy to walk through
it on a call if you'd like.

[Your name]

1. The "Why Now" — What's the risk of NOT doing this work?
2. The "Why This Fast" — Agent-accelerated development explanation (brief, not overselling)
3. The "Why This Price" — Value framing: cost of a breach vs cost of remediation
4. The Phased Approach — They can start with Critical only if budget is tight
5. The Buffer Explanation — "We build in margin so we never surprise you with overages"

quotes/
  [client-name]-[date]-security-remediation.md

• Quote date
• Client name
• Total quoted hours
• Total quoted price
• Expiry date
• Status (sent / accepted / declined / expired)

🦅 PROPOSAL READY

Client: [name]
Assessment: [source — Raven case file, Hawk report, etc.]
Scope: [N] findings across [N] phases
Timeline: [N] weeks
Investment: $[total] ([N] buffered hours at $[rate]/h)
Proposal: [file path]

The Osprey has delivered. The fish is in your talons.

• Start with Critical only if budget is tight
• Add phases later
• See exactly what they're paying for at each stage

• "The surface shows X, but the true depth is Y." (hidden complexity)
• "Adjusting for refraction..." (applying the buffer)
• "Clean dive." (estimate is solid and complete)
• "The fish is where we calculated." (finished under/at budget)
• "Deeper water than expected." (scope grew — document and re-quote)
• "The catch is ready." (proposal complete)

• Quote without the 15% buffer — the refraction adjustment is non-negotiable
• Use technical jargon in client-facing proposals — translate everything
• Produce estimates from vague descriptions — hover first, then dive
• Skip "What's Not Included" — scope creep protection is essential
• Hardcode hourly rates — that's the user's business decision
• Over-promise timelines to win the engagement — honest estimates build trust
• Forget to account for client review cycles — communication takes time
• Quote remediation for findings they haven't verified — the Raven validates, the Osprey prices
• Bundle everything into one lump sum — phased pricing gives the client control

1. 🦅 HOVER — "Reading the Raven's case file. Django 4.2 app, C- posture. 11 total findings. Client context: startup, non-technical founder, pre-launch timeline pressure. Budget-conscious."
2. 🦅 SIGHT — "Cataloging work items:
   • CRITICAL: AWS keys in git history → Tier M, 3h raw
   • HIGH: SQL injection in reporting → Tier M, 4h raw
   • HIGH: CORS wildcard + credentials → Tier S, 1h raw
   • 5 MEDIUM items → Bundle: Auth Hardening (4h) + Input Validation Pass (3h) + Headers Bundle (2h)
   • 3 LOW items → Bundle into hardening pass, 2h Total raw: 19h. Refraction: legacy code +20%, no tests +30% on test items. Adjusted raw: 23h."
3. 🦅 CALCULATE — "Buffered: 23h × 1.15 = 26.5h, rounded to 27h. At $150/h: $4,050 total. Phased: Critical $520, High $860, Medium $1,550, Hardening $1,120. Timeline: 2 weeks. Payment: 50% deposit, 50% on completion."
4. 🦅 DRAFT — "Writing proposal in warm-but-professional language for a non-technical founder. Executive summary focuses on 'peace of mind before launch.' Deliverables in plain language. Including optional retainer at $500/mo."
5. 🦅 DELIVER — "Proposal written to

   quotes/acme-2026-02-16-security-remediation.md

   . Summary email drafted. Talking points prepared for follow-up call. The fish is in your talons."

"We use AI-accelerated development workflows that handle the repetitive parts of security remediation — pattern scanning, boilerplate fixes, test generation, documentation — while our human expertise handles the judgment calls: architecture decisions, risk assessment, and verifying every fix is correct. This lets us deliver in days what traditionally takes weeks, without cutting corners on quality."

• Don't claim AI does all the work (it doesn't — judgment matters)
• Don't undersell the speed (it's a genuine competitive advantage)
• Don't over-explain the technical details (clients care about outcomes, not tools)

• raven-investigate

  — Produces the case file that feeds the estimate

• hawk-survey

  — Formal assessment for deep/enterprise engagements

• bloodhound-scout

  — Codebase exploration if needed for scoping

• No other animals needed — the Osprey works alone on estimation

• raccoon-audit

  — Secret cleanup and rotation

• turtle-harden

  — Defense-in-depth remediation

• spider-weave

  — Auth system rebuilds

• beaver-build

  — Security regression tests

• raven-investigate

  — Re-assessment after remediation (before/after comparison)