Fix, Retest, Prove

Fix, Retest, Prove describes a governed remediation lifecycle for security and reliability findings. The pattern treats remediation as a controlled process rather than a one-time code change: first accept the finding, then design the control that should prevent recurrence, implement and instrument the change, and retest the path that originally exposed the issue. The outcome is not considered complete until the retest produces evidence that either closes the finding or formally updates its residual risk state.

This lifecycle makes evidence part of the control, not an afterthought. It requires preserving regression fixtures so the original failure mode remains reproducible, and it ensures failed or partially remediated paths are returned to the remediation queue instead of being prematurely marked resolved. By coupling implementation with verification and governance, the pattern creates an auditable loop from defect to control to proof. The result is a durable remediation practice that reduces drift, improves accountability, and keeps findings aligned with their current evidence state.