The shape is deliberate. Collapsing any pair of them loses something that
cannot be reconstructed later:
The path through them
Why identity comes first
Every other property in this document depends on one thing: that the finding in tonight’s scan is recognisably the same finding as the one somebody triaged last month. A scanner has no notion of that. Run one twice and you get two reports with no link between them. TRUSTIVAN derives a fingerprint from the content of a finding — which advisory, which package, which install path — and deliberately excludes everything that changes while the issue does not: severity, line numbers, the installed version, the engine that found it. That is what makes the decision record durable, and it is covered in Findings and identity.Why decisions are recorded rather than derived
Two of these objects are append-only, and for the same reason. A finding event records what happened, not what is true now. The current status of a finding is one column; how it got there is a table nothing in the application can rewrite. A verdict records a decision that was made, not one that could be made now. Re-running a March policy evaluation in December against a re-rated CVE and an updated advisory database would produce a different answer — which is the correct answer for December and a fiction about March. So the March answer is stored, along with the immutable policy version that produced it and the full reasoning behind it. See Policies and verdicts.What is tenant-scoped, and how
Every one of these objects belongs to an organisation, and every query that touches one is scoped to it by construction rather than by convention. The mechanism — aScope value a handler cannot forge, and a data layer that will
not compile without one — is described in
Tenancy and isolation.
Where to go next
- Assets and scans — what identity means
for the thing being protected, and what a
202does and does not promise. - Findings and identity — fingerprints, and the audit trail behind each finding.
- The finding lifecycle — five states and the transitions between them.
- Suppression — accepting a risk, with a reason and an end date.
- Policies and verdicts — turning findings into a build decision.
- Tenancy and isolation — organisations, roles and API key scopes.