A finding is an observation to review, and a person decides what it means.
In plain words
A findingFindingA difference in the records that needs a decision. It includes its sources and can describe a slow handoff, disputed fact or missing owner. is the product saying: “these two things in your records do not agree, and here is the evidence.” It never says which side is right. A named person decides, and the product keeps both accounts and the decision on the record.
Three facts matter for an executive. Only an Executive, or the owner of the team the finding concerns, may resolve it. A challengeChallengeA recorded dispute of a value. Both the original and the disputed version are kept, and the challenge is listed under Findings. to a recorded value never overwrites it. Both versions stay visible until a person decides. An empty list means nothing in your records needs a decision, not that nothing is wrong. The table of kinds and the code references sit lower down, under “The kinds” and “Implementation detail”.
What it is
A finding is a difference the product has noticed in the records and can point to evidence for. Examples include a dependencyDependencyA link where one unit needs something from another. A dependency is not a reporting line: it shows where work relies on something else. whose stated and measured classes differ, a team without a recorded accountable ownerAccountable ownerThe person recorded as answerable for a team, service or agent. NovusLens does not assume that this person is also the one who runs it day to day. and written notes that appear to disagree. A finding is raised with its subject, its kind, its detail and the date it was opened. The product does not decide which side is right. A person does.
Each side of a finding is held against its own evidence ladder rungRungOne of three levels of support for a recorded value: told, shown or measured. The level appears beside the value. and source, so both accounts stay on the record. The product never replaces one account with the other silently. The wider principle is set out in measure, not forecast: a finding describes what the records show now, not what will happen.
An example
A finding may say that a measured handoffHandoffWork or information passed from one team or service to another. Its measured or stated completion time determines the dependency class. differs from the stated one. It gives both classes and the measured lead timeLead timeThe elapsed time between starting a request or handoff and completing it. in days. Below the statement sit the sources and two actions, inspect sources and resolve. The wording comes from the product’s own findings, so the exact text of a finding depends on what was measured.
How to read one
Read a finding in this order:
- Why it was raised. The kind tells you the rule that fired. The table below says what each kind means.
- Who is named. Most findings name a unit. Some name a domain, a provider or an agent. A finding about a unit outside your scopeScopeThe work, data, activity or access that a rule, statement or calculation covers. For access, it names the records an account can see. For team measures, “Own operations” covers the selected unit. “Including descendants” adds the units beneath it. is worded from your side, and the other unit is not named.
- The evidence. Open the sources. Each side shows where its claim came from and when it was observed.
- The date. A finding carries the time it was opened. Its evidence may be older or newer than that.
Some findings state their coverageCoverageWhat the available records cover, and what is missing. A count such as “3 of 5 dependencies measured” names the measured portion and the gap.. An estate-drift or network-egress finding says how many records could be compared and what the export covered. A sweep that finds nothing may mean the records agree, or that nothing was comparable. The coverage tells you which.
Life cycle
A finding moves through these states. Each change is recorded on the organisation’s log, so the history is kept.
- Raised. The product opens the finding as open.
- Acknowledged, accepted, resolved. A person records a response with their reasons. A response note is required. An Executive (the
cxorole) may resolve any finding in the organisation. A Team owner may resolve findings on their unit or a unit directly beneath it. Findings with no unit stay with the Executive. Resolving a disputed value clears the marker on that value, and the finding keeps its history. - Challenged. A writer can dispute a recorded value. This opens a disputed-value finding that names the challenger and their reason, and marks the value as disputed. The challenge does not edit the value. Both versions remain visible until a person resolves the finding.
- RetractedRetractionThe withdrawal of a finding or meaning entry, with the reason recorded. The record keeps who withdrew it, when and why; it is not deleted.. An Executive, an operator, or the person who spoke the testimony can retract a finding with a reason. The log keeps who retracted it, when and why.
Five status values are in use: open, acknowledged, accepted, resolved and retracted.
Implementation detail
The state is held on the finding row. The default of open is set in the findings table (apps/graph/migrations/0001_init.sql). resolve_finding in operations.py accepts acknowledged, accepted or resolved, and requires a response note. The role check is may_resolve. A writer disputes a value through the /dispute endpointEndpointA particular address on a service that accepts a defined kind of request. in serve.py, and retract_finding performs the retraction. The FindingStatus enum in model.py lists only the first four statuses. The retract operation in operations.py writes retracted directly.
The kinds
The table lists the kinds the product opens as findings, confirmed in the code. The first two columns are for everyone. The last column names the file that raises each kind, and is for engineers. Further kinds appear in calculation results and are listed after the table.
| Kind | What it means | Where raised |
|---|---|---|
key-person-risk | A cellCellA box on the map that stands for a team, service, supplier or AI agent. It is a unit you can inspect, not necessarily a department or a person. on the measured critical pathCritical pathThe dependency chain with the greatest total coordination weight in the map. It identifies a structural constraint. It does not state elapsed time. has one to four people in the personnel mapping. The key-person check skips cells with no mapped people. Names no person and gives no count. | apps/graph/src/conway_graph/keyperson.py |
cpl-not-computable | The organisation model holds cyclesDependency cycleA loop in the dependencies: one unit needs another, which eventually needs the first unit again. For example, Sales waits on Finance and Finance waits on Sales., and the exact search for the critical path ran out of its work budget. An organisation model without cycles is always computed. The finding names the cells on the cycles. | apps/graph/src/conway_graph/engine.py, packages/common_py/src/common_py/cpl.py |
contested-structure | An interview challenged structure supported by a document. That picture stands until a person resolves the dispute. | apps/mesh/src/conway_mesh/build_agent.py |
disputed-value | A writer challenged a recorded value. | apps/reasoning/src/conway_reasoning/serve.py (/dispute) |
provenance-conflict | A lower-rung statement from a different source was refused, and the disagreement is held. | apps/graph/src/conway_graph/materialiser.py |
observation-source-purged | A measurement cites a source document that has been purgedPurgeRemoving a stored document’s contents while keeping a record that it was removed and why. Conclusions that used it must be checked again., so it is not applied. | apps/graph/src/conway_graph/materialiser.py |
unmatched-telemetry | A measurement matches no declared dependency, or a capability name shared by several. It is held for review rather than attached to a guessed dependency. | apps/connectors/src/conway_connectors/corrector.py |
first-measurement | A dependency was measured for the first time. There was no earlier estimate, so this is not a contradiction. | apps/connectors/src/conway_connectors/corrector.py |
asserted-observed-delta | The class told for a dependency differs from the class measured. | apps/connectors/src/conway_connectors/corrector.py |
meaning-contradiction | Two written notes appear to contradict each other, and both judgements agree. An unsettled comparison is marked UNRESOLVED for a person. | apps/meaning/src/conway_meaning/deep_sweep.py |
meaning-graph-incoherence | A meaning-canon entry is keyed to cells the organisation model does not hold. | apps/meaning/src/conway_meaning/sweep.py |
estate-drift-absent-resource | The infrastructure codeInfrastructure codeFiles that describe the computing resources an organisation intends to create and how they should be configured. declares a resource that the provider’s export does not report. | apps/connectors/src/conway_connectors/estate_drift.py |
estate-drift-undeclared-resource | The provider reports a resource inside a containerContainerA running program with its own packaged software and isolated environment, managed by Docker on the host. a tool manages, and the code does not describe it. | apps/connectors/src/conway_connectors/estate_drift.py |
estate-drift-attribute | The code and the provider describe the same resource differently, for example its region. | apps/connectors/src/conway_connectors/estate_drift.py |
undeclared-egress | The network forwarded traffic to an explicitly excluded destination, or an unlisted destination when the allowed list was declared complete. | apps/connectors/src/conway_connectors/flow_acquire.py |
egress-blocked | The network dropped connection attempts from a cell. The record is the network’s own. | apps/connectors/src/conway_connectors/flow_acquire.py |
boundary-smeared-domain | A business domainDomainA business area defined by the work it does, such as purchasing or customs. It may involve several teams, and one team may serve several areas. is spread across several teams. | apps/graph/src/conway_graph/misalignment.py |
boundary-overloaded-team | A team serves several business domains. | apps/graph/src/conway_graph/misalignment.py |
boundary-unowned-domain | A declared domain has no owning cell. | apps/graph/src/conway_graph/misalignment.py |
unowned-capability | A unit named in an interview has no owner. The key-person check does not create this finding from an absence of mapped people. | apps/mesh/src/conway_mesh/build_agent.py |
external-status-unknown | A unit is named only as a dependency, and nobody has said whether it is a vendor or one of your own units. | apps/mesh/src/conway_mesh/build_agent.py |
possible-alias | Two unit names partly match. They are held as separate units until a person decides. | apps/mesh/src/conway_mesh/build_agent.py |
completeness-gap | A cell has no granted authority or accountable owner declared, or an attribute sits below the rung that is attainable. | apps/mesh/src/conway_mesh/percell.py |
duplicate-unit-id | Several resources in an estate export share one identifier. They are held out of the mapMapThe view of teams, services and their dependencies for the selected part of the organisation. Details appear beside the map., not merged. | apps/connectors/src/conway_connectors/domain_ingest.py |
resilience-cross-boundary | A dependency crosses a provider or a region boundary. This is recoverability evidence from the arrangement of dependencies, not a verdict. | apps/connectors/src/conway_connectors/domain_ingest.py |
structurally-starved | A cost centre lies on the measured dependency chain. Funding adequacy is not assessed. | apps/connectors/src/conway_connectors/finance_ingest.py |
regulatory-posture-gap | A cell is mapped in scope of a regulation that calls for recoverability evidence, and holds none measured. It is an evidence gap, not a verdict. | apps/connectors/src/conway_connectors/regulation_ingest.py |
unknown-scored-cell | An operations report scores a unit no one has declared. | apps/connectors/src/conway_connectors/scorecard_ingest.py |
agent-facts-unverified | An agent’s published capability document failed signatureDigital signatureA check calculated with a signing key that can detect whether a record has changed. Identifying the signer also requires a trusted link between that key and its owner. or signer verification, so its declared authority is unproven and not mapped. | apps/connectors/src/conway_connectors/agent_ingest.py |
agent-facts-malformed | A verified agent document declares no agent identifier, so there is nothing to map it as. | apps/connectors/src/conway_connectors/agent_ingest.py |
remit-drift | An agent’s activity breaks an explicit exclusion or falls outside a list declared complete. One finding per subject, remitRemitA written list of an agent’s allowed actions, resources and destinations for information. The list states whether it is complete. and window lists the observations. An incomplete allowed list alone cannot establish a prohibition. | apps/graph/src/conway_graph/remit.py |
fleet-incident | Several agent evaluations share one pattern (over-mandate, or remit driftRemit driftReported agent activity that breaks a recorded exclusion or falls outside a list declared complete. An incomplete list alone does not prove that activity is forbidden.) inside a time window, grouped by parent, provider or grant. | apps/graph/src/conway_graph/fleet.py |
control-gap-declared-control-unmet | For an external node, a declared availability target is set beside a measured figure that does not meet it. | apps/graph/src/conway_graph/governance.py |
Two further agent kinds are raised in governance.py: control-gap-overdelegation and control-gap-beyond-authority. A third, control-gap-declaration-missing, is raised there when an agent has reported activity but no mapped capability declaration. remit-drift is a finding kind raised by remit.py. Related remit-drift findings can also contribute to a fleet-incident grouping. Interview capture and ingestIngestRead supplied records or documents and add their information to NovusLens, after the required checks. also raise kinds such as told-observation and undeclared-domain-cell.
The Complexity, Agility and RecoverabilityRecoverabilityThe R in C/A/R: how well a team or service restores acceptable service after a failure. Recovery times and tested alternatives can supply evidence. (C/A/RC/A/RThree separate scores for a team or service: Complexity, Agility and Recoverability. Each uses current evidence and the customer’s stated scoring rules.) calculation returns its own findings in its recorded results (car_assessment.py): conflicting-evidence, overlapping-evidence, dependency-cycle, recovery-option-not-demonstrated and resource-position-to-review. They describe the inputs to a score and are not rows in the findings table. conflicting-evidence is also a result status in agent authority and remit checks, where it means that overlapping grants or records disagree. That status is not a finding kind.
Three states are not findings. coverage-incomplete, review-required and records as of are described in the guide. The code raises none of them as a finding. The guide treats them as states that say what the product can and cannot show.
Limits
- A finding is a difference to review. It is not a verdict and not a score.
- An empty list means nothing in your records needs a decision. It does not mean nothing is wrong.
- A meaning contradictionMeaning contradictionTwo written accounts, or a written account and the organisation model, appear to disagree about the same subject, scope and time. is a model’s judgement. The sweep can miss one or raise one that does not stand. A sweep that raises nothing is not proof that the notes agree.
- Network findings are only as complete as the declaration they are compared with. A VPCVPCVirtual private cloud: a private network defined inside a cloud provider's infrastructure. (virtual private cloud) is a provider-managed network for your systems. Its flow record summarises network traffic over a period. It does not describe just one connection.
- Most findings need a human response. Some checks close their own findings when the recorded condition clears, with the reason kept in history. Network findings do not close just because later traffic disappears.
- The Overview is not a risk ranking. It shows items that meet fixed selection rules, described on the page under “How these items were selected” (
apps/ui/app/overview/page.tsx).
What to do next
Open the finding and inspect both sources. If the difference is real, record a resolution with your reasons. If a source is wrong, ask its owner to publish a correction through the relevant import or stewardshipStewardshipCare of recorded information, such as correcting or withdrawing entries. The action allowed depends on the record type and the reader’s role. path, and recheck the affected conclusion. Where a finding asks for a document, attaching that document can move a told fact up the evidence ladderEvidence ladderThe three levels of support a record can have, in order: told, shown and measured..
Where it is implemented
The lifecycle states are in apps/mesh/src/conway_mesh/model.py (FindingStatus) and apps/mesh/src/conway_mesh/commits.py (finding_open, finding_update). The commits are applied to the findings table in apps/graph/src/conway_graph/materialiser.py. The human transitions and the dispute, retract and resolve rules are in apps/reasoning/src/conway_reasoning/operations.py and apps/reasoning/src/conway_reasoning/serve.py. Support for generated meaning findings is in apps/reasoning/src/conway_reasoning/finding_support.py.