Reports and remediation
Canonical report JSON, approval, deterministic exports, patch proposals, static rescans, and human-controlled GitHub pull requests.
Canonical first
Versioned Pydantic JSON is the report source of truth. UI views and every export render from the same revision. Agent prose never becomes an export without schema validation, evidence validation, and adjudication.
The report includes executive summary, coverage, architecture-impact dispositions, compliance evidence assessment, architecture diagnostics, comparable history, trust boundaries, threat model, active findings, evidence-gated exclusions, remediation plan, SBOM reference, and an evidence appendix.
The compliance section uses supported, partial, gap, not applicable, and unknown. It is an evidence mapping, not legal advice or certification. The diagnostic section describes the quality of Veriom's current understanding separately from weaknesses in the customer system. The history section distinguishes structural removal from a fact that was simply not re-observed because collection coverage changed.
Export pipeline
| Format | Derivation |
|---|---|
| JSON | canonical schema serialization |
| Markdown | deterministic renderer from JSON |
| Mermaid | approved constructs from canonical graph views |
| SVG / PNG | server-rendered Mermaid, sanitized before storage |
| DOCX | deterministic OOXML template |
| conversion from the verified DOCX |
Exports validate schema, links, diagram syntax, SVG safety, text extraction, pagination, and representative visual regressions. Format-specific failures are retryable without rerunning the audit.
Remediation flow
- A Developer or Analyst requests remediation for a confirmed finding.
- The Remediation Engineer proposes a bounded diff and identifies every touched file.
- The patch is applied in a disposable working copy.
- Static scanners rerun against the diff; builds and tests are not executed.
- An Analyst, Admin, or Owner reviews and approves the proposal.
- The connected GitHub App receives a short-lived, project-scoped write token and creates one branch and pull request.
- Veriom records pull-request state but never merges automatically.
Workflow changes require explicit approval
The GitHub App includes Workflow write permission, but Veriom adds it to the short-lived publication token only when an approved, validated patch changes .github/workflows/. Audits never receive write access.