The sequence every piece of work runs. Each step opens what the previous one found. Nothing is taken from a description of the system.
The binary, the image, the policy store, the capture on the wire. The object itself, not its documentation.
Trust boundaries, callers and callees, what each component assumes about its neighbour. What the artifact enforces is rarely what the design says.
Single findings are inventory. A chain is a route from an attacker's starting position to an outcome, each step demonstrated on the artifact.
The fix is defined by the chain, not by the finding — the one link that, removed, leaves no route. Closed means the chain no longer runs on the artifact.
