Add accepted-controls workflow to remediation report

[Copilot]

The remediation report could identify control failures, but it had no way to record risk acceptance and remove those items from the active queue. This change adds an explicit accepted-controls workflow with required justification, acceptance date tracking, and a dedicated accepted view.

• Remediation workflow

  • Adds an Accept risk action to remediation cards
  • Requires a justification note before a control can be accepted
  • Records the acceptance timestamp and shows it on the accepted card
  • Moves accepted items out of the active remediation list into an Accepted Controls tab

• UI/state model

  • Introduces tabbed remediation views for:
    • active remediation actions
    • accepted controls
  • Persists accepted-control state per organization in browser storage
  • Uses a stable per-control key to avoid collisions between accepted items

• Accessibility and UX

  • Marks the acceptance note as required for assistive technology
  • Uses clearer labeling for the acceptance reason field
  • Keeps accepted metadata visible with the control for later review

• Test/docs updates

  • Extends the test bootstrap to cover remediation HTML helpers
  • Adds focused Pester coverage for accepted-controls rendering and storage wiring
  • Updates remediation-plan documentation to describe the accepted-controls flow

<button type="button" data-open-accept>Accept risk</button>

<div data-accept-form hidden>
  <label for="accepted-note-1">Reason for accepting this control</label>
  <textarea id="accepted-note-1" aria-required="true" data-accept-note></textarea>
  <button type="button" data-accept-save>Save accepted control</button>
</div>

<div data-accepted-meta hidden>
  <dd data-accepted-date></dd>
  <dd data-accepted-note></dd>
</div>

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• accounts.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5344 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.46f1SR --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1193721758381396485,16626853335326604329,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5312902848347411217,2154463804345275307,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --window-size=1440,1600 --screenshot=/tmp/adoqr-remediation-accepted.png --virtual-time-budget=3000 file:///tmp/adoqr-remediation-sample-accepted.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5462 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.wZ5zW6 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,439487259699399466,8333477991589366205,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5104935401185639191,8941135447521593099,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• clients2.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5344 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.46f1SR --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1193721758381396485,16626853335326604329,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5312902848347411217,2154463804345275307,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --window-size=1440,1600 --screenshot=/tmp/adoqr-remediation-accepted.png --virtual-time-budget=3000 file:///tmp/adoqr-remediation-sample-accepted.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5462 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.wZ5zW6 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,439487259699399466,8333477991589366205,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5104935401185639191,8941135447521593099,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• redirector.gvt1.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5344 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.46f1SR --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1193721758381396485,16626853335326604329,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5312902848347411217,2154463804345275307,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --window-size=1440,1600 --screenshot=/tmp/adoqr-remediation-accepted.png --virtual-time-budget=3000 file:///tmp/adoqr-remediation-sample-accepted.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5462 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.wZ5zW6 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,439487259699399466,8333477991589366205,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5104935401185639191,8941135447521593099,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• www.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5344 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.46f1SR --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1193721758381396485,16626853335326604329,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5312902848347411217,2154463804345275307,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --window-size=1440,1600 --screenshot=/tmp/adoqr-remediation-accepted.png --virtual-time-budget=3000 file:///tmp/adoqr-remediation-sample-accepted.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5462 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.wZ5zW6 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,439487259699399466,8333477991589366205,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5104935401185639191,8941135447521593099,4 --trace-process-track-uuid=3190708989122997041 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[aj-enns]

@copilot , accepted controls should be saved across runs so the user does not have to keep accepting them.

[Copilot]

@copilot , accepted controls should be saved across runs so the user does not have to keep accepting them.

This is already how the remediation report behaves: accepted controls are stored per organization in browser storage and reused by later remediation reports opened in the same browser. I clarified that in the UI and README in 35031fa.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• accounts.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5086 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1182160393889713888,18347818123195018802,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5653318598519555762,1753222294201030876,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• android.clients.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5086 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1182160393889713888,18347818123195018802,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5653318598519555762,1753222294201030876,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• clients2.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5086 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1182160393889713888,18347818123195018802,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5653318598519555762,1753222294201030876,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• redirector.gvt1.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5086 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1182160393889713888,18347818123195018802,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5653318598519555762,1753222294201030876,4 --trace-process-track-uuid=3190708989122997041 (dns block)
• update.googleapis.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
• www.google.com
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=4932 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,10529436040706369714,17367894148320738629,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,16229699168380285572,262893151296373264,4 --trace-process-track-uuid=3190708989122997041 (dns block)
  • Triggering command: /usr/bin/chromium chromium --headless --disable-gpu --no-sandbox --user-data-dir=/tmp/chromedata-test --dump-dom file:///tmp/localstorage-a.html (dns block)
  • Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=5086 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromedata-test --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1182160393889713888,18347818123195018802,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5653318598519555762,1753222294201030876,4 --trace-process-track-uuid=3190708989122997041 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)