Canonical flow (both apps):

1. Data enters system
2. Findings are generated
3. Findings are normalized
4. Analyst reviews findings
5. Analyst takes action or escalates

Rules:
- No app may bypass normalization
- No alert without a finding
- All actions trace back to a finding