From attack result to qualified path.

This template describes a governed lifecycle for turning a raw attack result or trace into a qualified path that can support analysis, review, and remediation. The core idea is that a successful exploit observation is only an initial signal, not proof of a reusable or defensible multi-step path. Each step in the lifecycle makes assumptions explicit: evidence is normalized, system context is added, the path is constructed, challenged, and reviewed by an analyst before it is considered qualified. The diagram also distinguishes exception paths, where a segment is unsupported, an inferred extension remains explicit, or more context is required before the path can be trusted. When a qualified path exposes a control or chokepoint, remediation can be applied and the path retested to determine the residual state. The result is a traceable process that preserves uncertainty, prevents overclaiming, and ties findings to validation and response.