Attack Path Analysis Result Contract

The Attack Path Analysis Result Contract defines a traceable output format for the path engine that turns raw path analysis into decision-ready findings. It standardizes how path evidence, finding references, evidence-linked transitions, source and trace references, and qualification and control analysis are represented so that each result can be audited, reproduced, and retested. The contract organizes outputs into qualified paths, path clusters, and shared chokepoints, while preserving rejected and alternative explanations to document why competing interpretations were excluded. It also captures control opportunities, residual path state, and retest criteria so downstream reviewers can assess what remains exploitable, what has been mitigated, and what conditions would change the conclusion. Where supported, the contract can include Attack Flow representations alongside path and evidence JSON, technical report summaries, and versioned review and validation state. Together, these elements establish a structured, evidence-linked result model that supports both operational analysis and repeatable validation.