Turn Audit Findings into Runner-Ready Work

‘The system has security issues’ is a useful alarm but a poor task. A runner-ready finding identifies the affected file or boundary, explains the consequence, and states what a safe correction must prove.

Keep diagnosis separate from implementation. The audit should produce bounded child tasks such as ‘remove the default credential fallback and add a regression test,’ not a broad instruction to harden everything.

This format makes delegation safer because the agent receives a current, inspectable unit of work while the operator retains the decision about priority and acceptance.