finding-merge.prose.md

name: finding-merge kind: service

Finding Merge

Description

Merge validated candidates by root cause without erasing disagreement.

Requires

  • brief: review brief
  • candidate_ledger: closed candidate ledger
  • validation_report: validator verdicts

Ensures

  • merged_findings: Markdown finding groups with final IDs, candidate IDs, source lanes, validator verdicts, confidence, dissent, and rejected candidates

Shape

  • self: decide which candidates survive into user-facing findings
  • prohibited: upgrading unsupported claims, hiding rejected candidates, averaging away dissent, or creating candidate IDs

Strategies

  • Use F001, F002, ... for accepted or needs-human-check groups.
  • Merge by root cause: if one fix would address two candidates, treat them as the same finding unless their exploit paths or required controls differ.
  • Treat weaken as lower confidence/severity, not automatic rejection.
  • Keep needs-human-check visible unless clearly out of scope.