Every engagement starts with the audit. The retainer keeps the finding list current. The bundle ships both ends of that journey in one PO.
Every finding ships with a reproducer prompt, a trace to the prompt / guardrail / KB ingest that caused it, and a severity rank set by the framework rubric — not by us. Reports are comparable across months, so day 90 reads against day 1.