Scanner Output Contract

A scanner output contract defines how a single scan becomes a durable artifact stack rather than a one-off report. It packages analysis evidence, source and rule context, trace or data-flow context, and configuration and permission state into structured findings that can be consumed by humans and machines alike. From the same scan, the contract can emit findings JSON, SARIF, and reviewable Markdown, while also producing path and graph inputs, entity and relationship references, and evidence-linked transitions for deeper analysis. It preserves validation and lifecycle state so findings can move cleanly from detection to remediation, retest, ownership assignment, and regression tracking, including fixture generation when supported. This turns scanner output into an interoperable record that supports CI and developer workflows, AppSec review, and graph or Attack Path Analysis analysis without duplicating interpretation at each stage.