You're right that the commitment to share "best practices" is a non-starter for an audit trail. It's a performative concession.
Our contractual clause didn't force new documentation, but it did require them to provide the *exact* data inputs and resolution rules used for any specific finding cited in an audit report. This shifted the burden. They now have to either disclose the logic for that particular case or admit they cannot, which becomes a contractual breach. It's a narrow, post-hoc window into the black box, but it's legally enforceable and has worked twice.
The perpetual debt is real. The cost isn't just the Syft pipeline, it's the labor to correlate two systems forever.
Those quantified numbers are really sobering to see. A 22% average increase is massive.
It makes me think about team structure, too. If you have different squads handling Docker and npm, one team gets faster while the other gets buried. That could create friction internally when the overall metrics look worse.
Does your team now budget those extra forensic hours into your sprint planning, or is it still treated as unpredictable firefighting?