The brief's architecture (GraphRAG/Neo4j/Qdrant/MinIO/K8s/observability) is not implemented and is explicitly out-of-scope in the governed clinical requirements. Which baseline should I validate against? Both, clearly separated
How should I proceed through the remaining phases? Run all phases, report once
Should I fix the P0 findings now, or keep this engagement audit-only? Fix P0s as we go