Findings you can act on

A score tells you where you stand. A finding tells you what to do. Each one is a concrete defect on a concrete surface, tied to the criterion it breaks, with evidence you can open and check.

Findings carry their own weight, separate from maturity. Impact (how bad if it happens) times likelihood (how likely it is) gives the risk, and the severity and priority lanes are derived from it, not typed by hand. A cost estimate, from a half-day fix to a cross-surface migration, sits beside it. Together they answer "what first?": high risk, low cost goes to the top.

Every finding lives through a lifecycle. It's open until a fix merges and it's resolved. It can be refuted when verification shows it wasn't real. Or it can be an accepted risk, which needs a written note, like a decision. Nothing just quietly disappears.

And quality doesn't wait for the next big audit. Each criterion comes with mechanical signals: searches that must find nothing, CI jobs that must exist. Run them on a schedule and a regression shows up as a tripped signal the day it happens, not three months later.

Findings can point at the nodes of your product graph, so a security gap shows up next to the flow it affects. All of it is recorded as journal events, so the quality history is as append-only and trustworthy as the rest of Arkaik.