PatchClock Client Release Onboarding (Delivery)

PatchClock Client Release Onboarding (Delivery)

1. 01

   Connect the client repository in the PatchClock workspace and run the free CRA readiness check

   Register the product against the client's site and optional public GitHub repo. The readiness check establishes the baseline for security.txt, disclosure policy, and SBOM visibility before any release is tagged.

2. 02

   Confirm composer.lock and package-lock.json are read on tagged releases

   Verify both lock files resolve in the product configuration. If the client ships only Composer dependencies, note that npm coverage is unused so the SBOM scope is documented accurately in the handoff.

3. 03

   Declare the support period per version on the public support period page

   Set the version support window the client will honour. This page is customer-readable, so agree the wording with the client before publishing rather than editing it after a release.

4. 04

   Trigger a test release to verify SBOM generation and CVE alert routing

   Tag a release and confirm the CycloneDX SBOM regenerates and that CVE alerts reach the agreed recipients. Check the alert destination matches the client's security contact, not the agency's general inbox.

5. 05

   Verify the hosted security.txt and disclosure policy renew automatically

   PatchClock warns before the copy on the client's own site expires. Confirm the renewal path works on the client domain so the agency is not manually re-uploading files each cycle.

6. 06

   Walk the client through the Article 14 incident runbook clocks

   Show the 24-hour, 72-hour, and 14-day deadline tracking and who drafts the incident report. Agree in writing which client contact authorises a report submission before any deadline starts running.

7. 07

   Record the retainer scope in the handoff note

   List products covered, support periods declared, alert recipients, and the plan tier backing the account so the next delivery operator knows what the retainer includes and what triggers a plan change.