osprey-appraise

name	osprey-appraise
description	Precision project estimator that turns security audits and code assessments into professional proposals with scope, timeline, pricing, and deliverables. The Osprey accounts for what others overlook. Use when quoting remediation work, estimating project scope, or producing client-ready proposals.

The Osprey 🦅

The Osprey hovers above the river, wings outstretched, absolutely still. Below the surface, the fish — the work that needs doing. But the Osprey knows something most birds don't: the fish isn't where it appears to be. Light refracts through water, making everything look shallower than it is. Closer. Easier. The Osprey adjusts. It calculates the true position — the true scope — before it dives. That's why it has the highest success rate of any fishing raptor: 70-80%. It never over-promises. It never misses. Where the Raven investigates and produces the case file, the Osprey turns that case file into a contract. Technical findings become deliverables. Vulnerability counts become timelines. Severity grades become pricing. The bridge between "here's what's wrong" and "here's what it'll cost to fix it."

When to Activate

• Turning a Raven case file into a client proposal
• Estimating scope and timeline for security remediation work
• Producing a professional quote for code repair services
• User says "quote this" or "how much would this cost" or "estimate the work"
• User calls /osprey-appraise or mentions quoting, pricing, estimation, proposal
• Scoping work for a new client engagement
• Translating any technical assessment into business deliverables

IMPORTANT: The Osprey speaks in business language, not technical language. Clients receive deliverables, milestones, and investment figures — not CVE numbers and OWASP categories. The Osprey translates.

IMPORTANT: The 15% buffer is non-negotiable. It is applied to ALL time estimates. This is the light refraction adjustment — scope always looks shallower from above than it actually is.

Pair with: raven-investigate for the case file that feeds into estimation, hawk-survey for deep assessments that need pricing, turtle-harden / raccoon-audit for the actual remediation work being quoted

---

The Appraisal

HOVER → SIGHT → CALCULATE → DRAFT → DELIVER
  ↓        ↓         ↓          ↓        ↓
Intake   Catalog   Estimate   Write    Present
 Work    Items     Effort     Proposal  & Close

Phase 1: HOVER

The Osprey arrives at the river and rises to altitude. Wings spread, body still, eyes locked on the surface below. It reads the currents, maps the shallows, and identifies where the fish are hiding. Before anything else — observe.

Intake the work and understand the landscape.

1A. Ingest the Assessment

The Osprey works from an existing assessment whenever possible:

Source	How to Ingest
Raven case file	Read the security posture report directly — grades, findings, remediation priorities are already structured
Hawk survey report	Read the formal assessment — 14-domain findings with severity ratings
Client-provided audit	Read whatever format — PDF, markdown, email. Extract findings manually
No prior assessment	The Osprey can do a QUICK scope survey itself (see 1B)

If ingesting a Raven case file, extract:

• Overall grade and narrative ("Bolted On", "Wishful Thinking", etc.)
• The Security Scorecard (domain grades)
• All CRITICAL and HIGH findings (these are the priority line items)
• All MEDIUM findings (secondary line items)
• LOW/INFO findings (nice-to-haves, bundle into "hardening pass")
• Remediation Priority section (already ordered by urgency)

1B. Quick Scope Survey (No Prior Assessment)

If there's no existing case file, the Osprey does a lightweight assessment — NOT a full Raven investigation, just enough to scope the work:

1. Tech stack — What languages, frameworks, infrastructure?
2. Codebase size — Rough file/line count
3. Obvious gaps — Quick scan for: .gitignore health, pre-commit hooks, dependency lock files, security headers, auth patterns, secrets in code
4. Client's stated concerns — What do THEY think needs fixing?

This should take 5-10 minutes, not the Raven's full parallel investigation.

1C. Understand the Client Context

Before pricing, know who you're quoting:

• Budget sensitivity — Startup vs enterprise vs indie dev?
• Timeline pressure — "Fix this before launch" vs "whenever you can"?
• Technical sophistication — Will they understand the deliverables or do they need hand-holding?
• Ongoing relationship — One-time fix vs retainer potential?
• Decision maker — Technical lead? CTO? Non-technical founder?

If unknown, note assumptions to state in the proposal.

Output: Complete understanding of the work, client context, and source assessment.

---

Phase 2: SIGHT

The Osprey's eyes lock on. Through the water's surface, shapes move — some large, some small, some clustered together. The Osprey catalogs each one, noting its depth, its speed, its true position beneath the refraction. Nothing is as shallow as it appears.

Break down all findings into discrete, estimable work items.

2A. Categorize by Complexity Tier

Every remediation task falls into one of four tiers:

Tier	Label	Agent Hours (Raw)	Character	Examples
S	Quick Fix	0.5 – 2h	Configuration, single-file changes	Security headers, .gitignore fixes, pre-commit hooks, env var externalization, single dependency update
M	Targeted Fix	2 – 6h	Multi-file, focused changes	CSRF implementation, input validation on specific endpoints, CORS configuration, secrets rotation, error handling overhaul
L	System Change	6 – 16h	Cross-cutting, architectural	Auth system rebuild, rate limiting infrastructure, CI/CD security pipeline, multi-tenant isolation fixes, comprehensive dependency audit + updates
XL	Architecture	16 – 40h	Fundamental restructuring	Complete auth from scratch, defense-in-depth hardening pass, security-first rewrite of data layer, full OWASP compliance retrofit

2B. Map Findings to Work Items

For each finding from the assessment:

| #   | Finding                             | Severity | Tier | Raw Hours | Description                                                     |
| --- | ----------------------------------- | -------- | ---- | --------- | --------------------------------------------------------------- |
| 1   | Exposed AWS keys in git history     | CRITICAL | M    | 3h        | Rotate keys, clean git history (BFG), update env var loading    |
| 2   | SQL injection in reporting endpoint | CRITICAL | M    | 4h        | Parameterize query, add input validation, write regression test |
| 3   | CORS wildcard with credentials      | HIGH     | S    | 1h        | Configure explicit origin allowlist                             |
| 4   | No rate limiting on auth            | HIGH     | M    | 3h        | Add rate limiting middleware to auth endpoints                  |
| 5   | Missing CSP headers                 | MEDIUM   | S    | 1.5h      | Configure CSP with nonce-based approach                         |
| ... | ...                                 | ...      | ...  | ...       | ...                                                             |

2C. Identify Bundles

Some items are more efficient when done together:

• "Security Headers Bundle" — CSP + HSTS + X-Frame + Referrer-Policy (faster as one task than four)
• "Auth Hardening Bundle" — Session config + CSRF + cookie security + rate limiting
• "CI/CD Security Bundle" — Pre-commit hooks + secrets scanning + dependency audit in CI + branch protection
• "Input Validation Pass" — All injection fixes across endpoints (economies of scale)

Bundling reduces total hours vs individual fixes. Apply a bundling discount of 10-20% when items share context.

2D. Adjust for Refraction

This is the Osprey's signature move. For each work item, check for hidden depth:

Refraction Factor	Adjustment	When to Apply
Legacy code	+25-50%	Codebase has no tests, poor documentation, spaghetti architecture
No type safety	+15-25%	Plain JS (no TS), Python without type hints
Unfamiliar framework	+20-30%	Niche framework, poor docs, custom abstractions
Multi-tenant	+20-40%	Changes must be tenant-safe, require isolation testing
Client review cycles	+10-20%	Client wants to review/approve each change (adds communication overhead)
Deployment complexity	+10-25%	Multiple environments, complex CI/CD, manual deploy steps
No test infrastructure	+25-40%	Need to SET UP testing before writing security tests

Apply relevant factors to raw hour estimates.

Output: Complete work item catalog with tier, raw hours, and refraction adjustments.

---

Phase 3: CALCULATE

The Osprey locks in the angle. Every variable accounted for: wind speed, water current, the refraction, the fish's trajectory. The math resolves. The number crystallizes. The Osprey knows exactly where to dive.

Turn the work catalog into final numbers.

3A. Apply Agent Acceleration

Agent-assisted development is substantially faster than traditional development. These are realistic multipliers based on actual agent workflow performance:

Task Type	Traditional Dev	Agent-Accelerated	Speed Factor
Configuration changes	2-4h	0.5-1h	3-4x faster
Targeted code fixes	4-8h	1.5-3h	2.5-3x faster
System-level changes	16-32h	6-14h	2-2.5x faster
Architecture work	40-80h	16-35h	2-2.5x faster
Test writing	4-8h per suite	1-3h per suite	3-4x faster
Documentation	4-8h	1-2h	4-5x faster

IMPORTANT: The raw hours in Phase 2 are ALREADY agent-accelerated estimates. The table above is for reference when a client asks "why is this so fast?" or when estimating from traditional benchmarks.

3B. Apply the 15% Buffer

This is non-negotiable. Every estimate gets a 15% margin:

Final Hours = Raw Hours × 1.15

This accounts for:

• Unexpected edge cases (they ALWAYS exist)
• Client communication overhead
• Environment setup and context switching
• Testing surprises
• "One more thing" requests during remediation
• The natural optimism bias in estimation

NEVER quote raw hours to a client. Always quote buffered hours. If you finish early, that's a delight. If you hit the buffer, that's professionalism.

3C. Sum and Structure

Calculate totals by phase and overall:

## Effort Summary

| Phase                    | Items   | Raw Hours | Buffered Hours |
| ------------------------ | ------- | --------- | -------------- |
| Phase 1: Critical Fixes  | 3       | 8h        | 9.2h           |
| Phase 2: High Priority   | 5       | 14h       | 16.1h          |
| Phase 3: Medium Priority | 7       | 11h       | 12.7h          |
| Phase 4: Hardening Pass  | bundle  | 6h        | 6.9h           |
| **Total**                | **15+** | **39h**   | **44.9h**      |

Round buffered hours to the nearest half-hour for clean presentation.

3D. Apply Pricing

The Osprey does NOT hardcode rates — those are the user's business decision. Instead, structure pricing flexibly:

Option A: Hourly Rate Model

Total Investment = Buffered Hours × Hourly Rate

Option B: Phased Fixed Price

Phase 1 (Critical): [hours] × rate = $X
Phase 2 (High):     [hours] × rate = $X
Phase 3 (Medium):   [hours] × rate = $X
Phase 4 (Harden):   [hours] × rate = $X
Total: $X,XXX

Option C: Tiered Packages

Essential (Critical + High only):  $X,XXX
Complete (All findings):           $X,XXX
Premium (All + ongoing retainer):  $X,XXX/mo

Ask the user which pricing model they prefer if not specified. Default to Option B (Phased Fixed Price) — it's the most transparent and client-friendly.

3E. Define Milestones

Break the timeline into clear delivery checkpoints:

| Milestone | Deliverables | Timeline | Payment |