1---
 2name: finding-merge
 3kind: service
 4---
 5
 6# Finding Merge
 7
 8### Description
 9
10Merge validated candidates by root cause without erasing disagreement.
11
12### Requires
13
14- `brief`: review brief
15- `candidate_ledger`: closed candidate ledger
16- `validation_report`: validator verdicts
17
18### Ensures
19
20- `merged_findings`: Markdown finding groups with final IDs, candidate IDs,
21  source lanes, validator verdicts, confidence, dissent, and rejected candidates
22
23### Shape
24
25- `self`: decide which candidates survive into user-facing findings
26- `prohibited`: upgrading unsupported claims, hiding rejected candidates,
27  averaging away dissent, or creating candidate IDs
28
29### Strategies
30
31- Use `F001`, `F002`, ... for accepted or needs-human-check groups.
32- Merge by root cause: if one fix would address two candidates, treat them as
33  the same finding unless their exploit paths or required controls differ.
34- Treat `weaken` as lower confidence/severity, not automatic rejection.
35- Keep `needs-human-check` visible unless clearly out of scope.