Reports, freeze, release

A report is a generated artifact, produced per milestone of an engagement (a first delivery, interim retest reports, a final report). Understanding a report means understanding two independent axes and one irreversible moment.

Generation is one axis

A generated report has a production status: pending while the job runs, ready once the file exists on disk (with its path, size and hash recorded), or failed with a reason. A ready report is a real PDF (or the chosen format) that PEART produced, with a content hash it can show as an integrity fingerprint.

Release is the other axis

Release is separate from generation. A ready report is internal until it is released, at which point it becomes visible to the client through the portal. Release is the moment the report crosses the boundary from your work to the client's hands, and the portal only ever serves released reports, scoped to the client they belong to.

What release freezes

Release freezes the report into a fixed record. The published finding revisions it contains, and the compliance mappings for each finding, are captured as they were at release, with their provenance, so a delivered report keeps stating what it stated even as the live findings keep evolving afterward. The remediation due date is fixed at release the same way. Withdrawing a release and releasing again re-freezes from the current state.

The retest summary

Not every deliverable is a full report. A retest summary is a document of its own kind: a short PDF that states where the engagement's findings stand after the retest cycles, without repeating the full report.

Kind and format are separate things. The format is the encoding (PDF, Markdown, XLSX); the kind says what the document is, full or retest summary. A summary exists only as PDF, because that is the form that circulates and the one that can be signed.

A summary names the full report it summarises. That reference is chosen and frozen when the summary is generated: identifier, format, generation date and the hash of the generated document. If no full report had been released at that moment, the summary says so in writing rather than pointing at nothing.

Because of that, withdrawing a full report withdraws every released summary of the same engagement, in the same operation. The numbers a summary states come from the engagement's frozen revisions, so once the full report is withdrawn, a summary left in the client's hands would be asserting something the consultancy has just taken back. Releasing again is one gesture; a document with a false statement circulating is not recoverable.

Reports and the portal

The client reaches released reports through the portal, over an authenticated, scoped, TLS channel. A report profile governs what the client's view shows. Every released milestone is downloadable there, so the deliverables live in one controlled place rather than as email attachments.