Findings
Domains
Challenge
Outputs
The repoCode and history
Chat exportsDecisions and context
Spare filesNotes, screens, data
Findings47 total
F-014Authhigh3 evidence
F-009Deploymenthigh4 evidence
F-021Data layermedium2 evidence
F-033Code healthlow1 evidence
+ 43 more, each with its evidence
11 DOMAINS, READ AND SCORED
Auth3 findings
Data layer2 findings
API1 findings
Deployment4 findings
Error handling3 findings
Data + AI1 findings
Performance2 findings
Modernization2 findings
Code health5 findings
Data quality2 findings
Compliance1 findings
+ 5 healthcare domains when relevant
Each domain is a template: what to look for, how to score it and what proof counts. Add one and the next run reads it.
F-014Authhigh
Login has no rate limit and no lockout.
Challenge Deep diveCHALLENGE: RE-CHECK AGAINST THE EVIDENCE
auth.ts:42 has no throttle
Chat 3 confirms no lockout decision
Deploy config has no limiter
Holds: 3 of 3 evidence confirmed
DEEP DIVE: ONE FINDING, SPLIT INTO ITS PARTS
F-014a Reset flowTokens never expire
F-014b LockoutUnlimited attempts
F-014c SessionsCookie lives 90 days
FINDINGS, AS JSON
{ "id": "F-014",
"domain": "auth",
"severity": "high",
"evidence": 3,
"effort": "2 weeks" }
+ 46 more findings
RoadmapWhat to fix, in order
ProposalScope and fee from the gaps
Strategic briefPosition and the decision ahead
Due diligence briefRisk and debt for a review
Every fact is kept once, with proof. Each document reads only what it needs.
SNAPSHOT 1 · MARCH
47
findings
SNAPSHOT 2 · APRIL
41
8 resolved · 2 new
TODAY
36
5 resolved · 3 drifted
DRIFT SINCE THE LAST SNAPSHOTAuth F-014 resolvedDeployment F-052 newData layer unchanged
Re-run the investigation whenever the build moves. The snapshots show what got better and what quietly slipped.
Counts are illustrative.