cross-domain-audit-synthesis

Cross-Domain Audit Synthesis

Turn a stack of independent audits into one time-boxed roadmap. The signal is overlap: issues flagged by two or more auditors independently are the real priorities, everything else negotiates for the remaining slots.

Workflow

1. Extract top issues per domain. Take the 3 highest-severity findings from each audit. Preserve the original severity ratings, do not re-grade. Carry the specific evidence (file, count, query, metric) with each finding.
2. Find cross-domain hits. Any issue flagged independently by 2 or more audits is CRITICAL. Examples of the pattern: security and compute both flag auth gaps; types and data both flag unvalidated responses; velocity and compute both flag manual deploys. One auditor's opinion is a finding, two auditors' convergence is a fact.
3. Name the engineering tensions. State them explicitly ("Velocity vs Safety", "Decomposition vs Stabilization") so the roadmap's ordering is defensible. Resolution order is fixed: Safety, then Infrastructure, then Decomposition, then Features.
4. Build the time-boxed roadmap.
5. Week 1: stop the bleeding (revenue, security, data loss)
6. Week 2: type and test infrastructure (CI/CD, shared types, linting)
7. Week 3: structural decomposition (split monoliths, deduplicate)
8. Week 4: capabilities and observability (features, dashboards, evals)
9. Define the first PR. Small, shippable this week, addressing a Week 1 item. Its description captures: WHAT changed, WHY (the business risk, citing the audit evidence), HOW VERIFIED, and WHAT'S NEXT.

Good vs bad

Bad: roadmap opens with "migrate to a monorepo" because the velocity audit ranked it highest, while the security audit's auth-gap finding sits in Week 3.

Good: auth gap flagged by both security and compute audits goes first regardless of any single audit's internal ranking; the monorepo migration lands in Week 3 under decomposition.

Verification

Do this before presenting the roadmap: for every CRITICAL item, point to the two or more source audits that flagged it, quoting each audit's evidence line. Expect every CRITICAL to have at least two independent sources or an explicit note that it is single-source but revenue/security/data-loss class. If a CRITICAL has neither, demote it and re-sequence.

Then check Week 1 against the resolution order. Expect only safety-class items there. If a feature sits in Week 1, the tensions step was skipped: redo step 3.

Completion checklist

• [ ] Top 3 findings per audit extracted with original severity and evidence
• [ ] Every 2+ audit overlap identified and marked CRITICAL
• [ ] Tensions named with the fixed resolution order applied
• [ ] Four-week roadmap with every finding placed or explicitly deferred
• [ ] First PR defined with WHAT / WHY / HOW VERIFIED / WHAT'S NEXT
• [ ] No CRITICAL without two sources or a stated bleed-class justification

Any box unchecked: not done. Fix or say so.

Footguns

• Re-grading severities during synthesis. You launder the auditors' judgment into your own. Fix: preserve original ratings, sequence by overlap and class instead.
• Dropping the evidence while summarizing. A roadmap of assertions is unfundable. Fix: every item carries its file paths, counts, or metrics from the source audit.
• A first PR that is a project. "Adopt zero-trust" is not a PR. Fix: one reviewable change from Week 1, shippable in days.
• Averaging instead of intersecting. Ranking by mean severity buries convergent findings. Fix: overlap first, severity second.