From a9bc7de6da575da0972adb1ef78f3c0dd1a51cb1 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Wed, 21 Oct 2026 18:39:40 -0400
Subject: [PATCH 01/20] Sort and count findings without FindingSeverity in
 memory

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/backend/models/operations.py          |  5 +-
 pyrit/backend/services/operation_service.py | 13 ++++-
 pyrit/memory/memory_interface.py            | 45 +++++++++++----
 tests/unit/backend/test_finding_export.py   |  2 +-
 tests/unit/backend/test_operations.py       |  9 +++
 tests/unit/memory/test_findings.py          | 63 +++++++++++++++++----
 6 files changed, 109 insertions(+), 28 deletions(-)

diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 727b13f081..4805101c5c 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -12,7 +12,6 @@
     Finding,
     FindingCreate,
     FindingEvidence,
-    FindingSeverity,
     Operation,
     OperationUsage,
 )
@@ -27,9 +26,9 @@ class FindingOptionsResponse(BaseModel):
 
 
 class OperationListItem(Operation):
-    """An operation with its finding counts by severity. Severities with no findings are omitted."""
+    """An operation with its finding counts by stored severity value. Severities with no findings are omitted."""
 
-    finding_counts: dict[FindingSeverity, int]
+    finding_counts: dict[str, int]
 
 
 class OperationListResponse(BaseModel):
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index 8fa55438f0..79e3889348 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -25,6 +25,7 @@
     Finding,
     FindingCreate,
     FindingEvidence,
+    FindingSeverity,
     Operation,
     OperationCreate,
 )
@@ -196,7 +197,11 @@ async def list_findings_async(
         """
         await self.get_async(operation_id)
         findings = await CentralMemory.get_memory_instance().get_findings_async(
-            operation_id=operation_id, limit=limit + 1, offset=offset, title_query=title_query
+            operation_id=operation_id,
+            limit=limit + 1,
+            offset=offset,
+            title_query=title_query,
+            severity_order=[severity.value for severity in FindingSeverity],
         )
         has_more = len(findings) > limit
         page = findings[:limit]
@@ -269,7 +274,11 @@ async def get_findings_with_evidence_async(
         """
         await self.get_async(operation_id)
         memory = CentralMemory.get_memory_instance()
-        findings = await memory.get_findings_by_ids_async(operation_id=operation_id, finding_ids=finding_ids)
+        findings = await memory.get_findings_by_ids_async(
+            operation_id=operation_id,
+            finding_ids=finding_ids,
+            severity_order=[severity.value for severity in FindingSeverity],
+        )
         found = {finding.id for finding in findings}
         missing = next((finding_id for finding_id in finding_ids if finding_id not in found), None)
         if missing is not None:
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index e230165ae0..3596046b3f 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -120,7 +120,6 @@
     Finding,
     FindingCreate,
     FindingEvidence,
-    FindingSeverity,
     IdentifierFilter,
     IdentifierType,
     Message,
@@ -1044,10 +1043,21 @@ async def get_findings_async(
         limit: int = 20,
         offset: int = 0,
         title_query: str | None = None,
+        severity_order: Sequence[str] = (),
     ) -> list[Finding]:
         """
         Read one page of findings, highest severity first, then newest first.
 
+        Args:
+            operation_id (uuid.UUID | None): The operation whose findings to read. Defaults to None, which reads
+                findings from every operation.
+            limit (int): Maximum number of findings to return. Defaults to 20.
+            offset (int): Number of findings to skip. Defaults to 0.
+            title_query (str | None): Case-insensitive text the title must contain. Wildcard characters match
+                literally. Defaults to None.
+            severity_order (Sequence[str]): Severity keys from highest to lowest. Stored values that aren't listed
+                sort after them. Empty orders newest first.
+
         Returns:
             list[Finding]: The findings on the page.
 
@@ -1063,18 +1073,24 @@ async def get_findings_async(
             # SQL Server also treats "[" as a LIKE wildcard.
             escaped_title = title_query.replace("/", "//").replace("%", "/%").replace("_", "/_").replace("[", "/[")
             statement = statement.where(FindingEntry.title.ilike(f"%{escaped_title}%", escape="/"))
-        statement = statement.order_by(*self._finding_order()).limit(limit).offset(offset)
+        statement = statement.order_by(*self._finding_order(severity_order)).limit(limit).offset(offset)
         async with await self.get_session_async() as session:
             return [entry.get_finding() for entry in (await session.scalars(statement)).all()]
 
     async def get_findings_by_ids_async(
-        self, *, operation_id: uuid.UUID, finding_ids: Sequence[uuid.UUID]
+        self, *, operation_id: uuid.UUID, finding_ids: Sequence[uuid.UUID], severity_order: Sequence[str] = ()
     ) -> list[Finding]:
         """
         Read selected findings of one operation, highest severity first, then newest first.
 
         IDs that are not in the operation are omitted.
 
+        Args:
+            operation_id (uuid.UUID): The operation whose findings to read.
+            finding_ids (Sequence[uuid.UUID]): The findings to read.
+            severity_order (Sequence[str]): Severity keys from highest to lowest, as for
+                ``get_findings_async``. Defaults to an empty order, which sorts newest first.
+
         Returns:
             list[Finding]: The selected findings, in the same order as ``get_findings_async``.
         """
@@ -1087,7 +1103,7 @@ async def get_findings_by_ids_async(
             ordered_ids = await session.scalars(
                 select(FindingEntry.id)
                 .where(FindingEntry.operation_id == operation_id)
-                .order_by(*self._finding_order())
+                .order_by(*self._finding_order(severity_order))
             )
             selected_ids = [finding_id for finding_id in ordered_ids if finding_id in requested]
             findings: dict[uuid.UUID, Finding] = {}
@@ -1251,29 +1267,34 @@ async def get_finding_evidence_counts_async(self, *, finding_ids: Sequence[uuid.
         async with await self.get_session_async() as session:
             return dict((await session.execute(statement)).all())
 
-    async def get_finding_severity_counts_async(self) -> dict[uuid.UUID, dict[FindingSeverity, int]]:
+    async def get_finding_severity_counts_async(self) -> dict[uuid.UUID, dict[str, int]]:
         """
         Count every operation's findings by severity in one query.
 
         Returns:
-            dict[uuid.UUID, dict[FindingSeverity, int]]: Counts for operations with findings.
+            dict[uuid.UUID, dict[str, int]]: Counts for operations with findings.
         """
         statement = select(FindingEntry.operation_id, FindingEntry.severity, func.count()).group_by(
             FindingEntry.operation_id, FindingEntry.severity
         )
-        counts: dict[uuid.UUID, dict[FindingSeverity, int]] = {}
+        counts: dict[uuid.UUID, dict[str, int]] = {}
         async with await self.get_session_async() as session:
             for operation_id, severity, count in (await session.execute(statement)).all():
-                counts.setdefault(operation_id, {})[FindingSeverity(severity)] = count
+                counts.setdefault(operation_id, {})[severity] = count
         return counts
 
     @staticmethod
-    def _finding_order() -> "tuple[ColumnElement[Any], ...]":
-        severity_order = case(
-            {severity.value: position for position, severity in enumerate(FindingSeverity)},
+    def _finding_order(severity_order: Sequence[str]) -> "tuple[ColumnElement[Any], ...]":
+        newest_first = (FindingEntry.created_at.desc(), FindingEntry.id.desc())
+        if not severity_order:
+            # case() with no branches compiles to SQL that both dialects reject.
+            return newest_first
+        rank = case(
+            {key: position for position, key in enumerate(severity_order)},
             value=FindingEntry.severity,
+            else_=len(severity_order),
         )
-        return severity_order, FindingEntry.created_at.desc(), FindingEntry.id.desc()
+        return rank, *newest_first
 
     def _uses_legacy_memory_override(self) -> bool:
         return any(
diff --git a/tests/unit/backend/test_finding_export.py b/tests/unit/backend/test_finding_export.py
index e78411741c..1b8ea16598 100644
--- a/tests/unit/backend/test_finding_export.py
+++ b/tests/unit/backend/test_finding_export.py
@@ -543,7 +543,7 @@ async def test_report_matches_the_dashboard_listing_order(sqlite_instance: SQLit
         )
         for index, severity in enumerate(["low", "critical", "moderate", "critical"])
     ]
-    dashboard = await sqlite_instance.get_findings_async(operation_id=operation.id, limit=10)
+    dashboard = (await OperationService().list_findings_async(operation_id=operation.id, limit=10, offset=0)).items
 
     report = await _report_async(operation_id=operation.id, finding_ids=[finding.id for finding in findings])
 
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index 2a907c9431..b87fd81a66 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -147,6 +147,15 @@ def test_findings_are_created_and_listed_under_an_operation(compatibility_header
     assert counts == {"Case": {"informational": 1}, "Other": {"low": 1}}
 
 
+def test_findings_list_highest_severity_first(compatibility_headers: dict[str, str]) -> None:
+    client = TestClient(app, headers=compatibility_headers)
+    operation_id = client.post("/api/operations", json={"name": "Sorted"}).json()["id"]
+    for title, severity in [("First", "critical"), ("Second", "low")]:
+        client.post(f"/api/operations/{operation_id}/findings", json={"title": title, "severity": severity})
+    listed = client.get(f"/api/operations/{operation_id}/findings", params={"limit": 20}).json()["items"]
+    assert [item["title"] for item in listed] == ["First", "Second"]
+
+
 def test_finding_options_exposes_canonical_harm_types(compatibility_headers: dict[str, str]) -> None:
     client = TestClient(app, headers=compatibility_headers)
     response = client.get("/api/operations/finding-options")
diff --git a/tests/unit/memory/test_findings.py b/tests/unit/memory/test_findings.py
index 94d45c0e7a..45958f993a 100644
--- a/tests/unit/memory/test_findings.py
+++ b/tests/unit/memory/test_findings.py
@@ -24,11 +24,13 @@
     PromptMemoryEntry,
     ScoreEntry,
 )
-from pyrit.models import Finding, FindingCreate, FindingEvidence, FindingSeverity, Operation
+from pyrit.models import Finding, FindingCreate, FindingEvidence, Operation
 from pyrit.models.harm_category import HarmCategory
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
+SEVERITY_ORDER = ["critical", "important", "moderate", "low", "informational"]
+
 
 async def test_operations_are_unique_by_trimmed_case_folded_name(sqlite_instance: SQLiteMemory) -> None:
     saved = await sqlite_instance.add_operation_async(Operation(name=" Operation A "))
@@ -164,8 +166,10 @@ async def test_findings_paginate_within_one_operation(sqlite_instance: SQLiteMem
             )
         )
     await sqlite_instance.add_finding_async(finding=Finding(operation_id=other.id, title="Other", severity="critical"))
-    first = await sqlite_instance.get_findings_async(operation_id=operation.id, limit=2)
-    second = await sqlite_instance.get_findings_async(operation_id=operation.id, limit=2, offset=2)
+    first = await sqlite_instance.get_findings_async(operation_id=operation.id, limit=2, severity_order=SEVERITY_ORDER)
+    second = await sqlite_instance.get_findings_async(
+        operation_id=operation.id, limit=2, offset=2, severity_order=SEVERITY_ORDER
+    )
     assert [finding.title for finding in first + second] == ["3", "2", "1", "4"]
     async with await sqlite_instance.get_session_async() as session:
         for table in [AttackResultEntry, PromptMemoryEntry, ScoreEntry]:
@@ -218,7 +222,10 @@ async def test_update_finding_preserves_identity_and_reorders_severity(sqlite_in
     assert updated.created_at == original.created_at
     assert updated.title == "Edited"
     assert updated.description == "Notes"
-    assert [finding.title for finding in await sqlite_instance.get_findings_async()] == ["Edited", "Other"]
+    assert [finding.title for finding in await sqlite_instance.get_findings_async(severity_order=SEVERITY_ORDER)] == [
+        "Edited",
+        "Other",
+    ]
 
 
 async def test_finding_classifications_persist_and_clear_without_losing_evidence(sqlite_instance: SQLiteMemory) -> None:
@@ -272,7 +279,7 @@ async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteM
                 }
             )
         )
-    assert [finding.title for finding in await sqlite_instance.get_findings_async()] == [
+    assert [finding.title for finding in await sqlite_instance.get_findings_async(severity_order=SEVERITY_ORDER)] == [
         "critical",
         "important",
         "moderate",
@@ -282,6 +289,41 @@ async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteM
     ]
 
 
+async def test_get_findings_sorts_unlisted_severities_after_listed_ones(sqlite_instance: SQLiteMemory) -> None:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Partial order"))
+    stamp = datetime(2026, 10, 9, tzinfo=UTC)
+    for number, severity in enumerate(["low", "critical", "moderate"], start=1):
+        await sqlite_instance.add_finding_async(
+            finding=Finding.model_validate(
+                {
+                    "id": UUID(int=number),
+                    "created_at": stamp,
+                    "operation_id": operation.id,
+                    "title": severity,
+                    "severity": severity,
+                }
+            )
+        )
+    found = await sqlite_instance.get_findings_async(severity_order=["low"])
+    assert [finding.title for finding in found] == ["low", "moderate", "critical"]
+
+
+async def test_get_findings_without_severity_order_sorts_newest_first(sqlite_instance: SQLiteMemory) -> None:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Newest first"))
+    for number, (title, severity) in enumerate([("Old critical", "critical"), ("New low", "low")], start=1):
+        await sqlite_instance.add_finding_async(
+            finding=Finding.model_validate(
+                {
+                    "operation_id": operation.id,
+                    "title": title,
+                    "severity": severity,
+                    "created_at": datetime(2026, 10, number, tzinfo=UTC),
+                }
+            )
+        )
+    assert [finding.title for finding in await sqlite_instance.get_findings_async()] == ["New low", "Old critical"]
+
+
 async def test_finding_mutations_are_scoped_and_delete_only_the_finding(sqlite_instance: SQLiteMemory) -> None:
     operation = await sqlite_instance.add_operation_async(Operation(name="Case"))
     other = await sqlite_instance.add_operation_async(Operation(name="Other"))
@@ -430,7 +472,9 @@ async def test_get_findings_by_ids_follows_dashboard_order_and_scope(sqlite_inst
     )
     requested = [saved["Moderate"].id, foreign.id, saved["Low"].id, uuid4(), saved["Newer critical"].id]
     requested += [saved["Older critical"].id, saved["Low"].id]
-    findings = await sqlite_instance.get_findings_by_ids_async(operation_id=operation.id, finding_ids=requested)
+    findings = await sqlite_instance.get_findings_by_ids_async(
+        operation_id=operation.id, finding_ids=requested, severity_order=SEVERITY_ORDER
+    )
     assert [finding.title for finding in findings] == ["Newer critical", "Older critical", "Moderate", "Low"]
 
 
@@ -494,10 +538,9 @@ async def test_finding_severity_counts_group_by_operation(sqlite_instance: SQLit
             finding=Finding(operation_id=operation.id, title="A", severity=severity)
         )
     await sqlite_instance.add_finding_async(finding=Finding(operation_id=other.id, title="B", severity="informational"))
-    assert await sqlite_instance.get_finding_severity_counts_async() == {
-        operation.id: {FindingSeverity.CRITICAL: 2, FindingSeverity.LOW: 1},
-        other.id: {FindingSeverity.INFORMATIONAL: 1},
-    }
+    result = await sqlite_instance.get_finding_severity_counts_async()
+    assert result == {operation.id: {"critical": 2, "low": 1}, other.id: {"informational": 1}}
+    assert all(type(key) is str for counts in result.values() for key in counts)
 
 
 async def test_delete_finding_removes_evidence_without_deleting_source(sqlite_instance: SQLiteMemory) -> None:

From 8850791e09706f3097fd977eb886b33e3bbb4b4d Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Sat, 24 Oct 2026 13:14:50 -0400
Subject: [PATCH 02/20] Add FindingFields models and finding value check

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/models/__init__.py                 |  10 +
 pyrit/models/finding_fields.py           | 551 +++++++++++++++++++++++
 tests/unit/models/test_finding_fields.py | 320 +++++++++++++
 3 files changed, 881 insertions(+)
 create mode 100644 pyrit/models/finding_fields.py
 create mode 100644 tests/unit/models/test_finding_fields.py

diff --git a/pyrit/models/__init__.py b/pyrit/models/__init__.py
index f45b928039..9415a50a99 100644
--- a/pyrit/models/__init__.py
+++ b/pyrit/models/__init__.py
@@ -74,6 +74,12 @@
     from pyrit.models.conversation_summary import ConversationSummary
     from pyrit.models.embeddings import EmbeddingData, EmbeddingResponse, EmbeddingSupport, EmbeddingUsageInformation
     from pyrit.models.finding import Finding, FindingCreate, FindingEvidence, FindingSeverity
+    from pyrit.models.finding_fields import (
+        DEFAULT_FINDING_FIELDS,
+        FindingField,
+        FindingFields,
+        FindingValuesError,
+    )
     from pyrit.models.harm_definition import HarmDefinition, ScaleDescription, get_all_harm_definitions
     from pyrit.models.identifiers import (
         REGISTRY_NAME_PATTERN,
@@ -444,6 +450,10 @@
     "FindingCreate": "pyrit.models.finding",
     "FindingEvidence": "pyrit.models.finding",
     "FindingSeverity": "pyrit.models.finding",
+    "DEFAULT_FINDING_FIELDS": "pyrit.models.finding_fields",
+    "FindingField": "pyrit.models.finding_fields",
+    "FindingFields": "pyrit.models.finding_fields",
+    "FindingValuesError": "pyrit.models.finding_fields",
     "ConversationType": "pyrit.models.messages.conversation_reference",
     "ContentEntryScorable": "pyrit.models.score",
     "ContentScorable": "pyrit.models.score",
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
new file mode 100644
index 0000000000..ea789cf10a
--- /dev/null
+++ b/pyrit/models/finding_fields.py
@@ -0,0 +1,551 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import re
+from collections.abc import Iterable, Iterator
+from enum import StrEnum
+from typing import Any, ClassVar, Self
+
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
+
+from pyrit.models.harm_category import HarmCategory
+
+
+class FindingFieldType(StrEnum):
+    """How the finding dialog collects a field's value."""
+
+    TEXT = "text"
+    MULTILINE = "multiline"
+    CHOICE = "choice"
+
+
+class FindingSeverityColor(StrEnum):
+    """Badge color of a severity option. CoPyRIT renders each one with a Fluent UI badge color."""
+
+    RED = "red"
+    ORANGE = "orange"
+    YELLOW = "yellow"
+    GREEN = "green"
+    BLUE = "blue"
+    GRAY = "gray"
+    DARK = "dark"
+    NEUTRAL = "neutral"
+
+
+class FindingValuesError(ValueError):
+    """A finding's values do not fit the deployment's finding fields."""
+
+
+class FindingFieldOption(BaseModel):
+    """One option of a choice field, with the options of the next dropdown under it."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    key: str
+    label: str
+    children: list["FindingFieldOption"] = []
+
+
+class FindingField(BaseModel):
+    """
+    One field of the finding dialog, as a deployment defines it.
+
+    Attributes:
+        key (str): The stored name of the value. Keep it fixed; change ``label`` to rename what users see.
+        label (str): The name the finding dialog and cards show.
+        type (FindingFieldType): ``text``, ``multiline`` or ``choice``.
+        required (bool): Whether every finding needs a value. For a cascade, every level with options needs one.
+        options (list[FindingFieldOption]): A ``choice`` field's options. Write ``(key, label)`` pairs for one
+            dropdown, or a dict from each pair to its children for a cascade.
+        levels (list[tuple[str, str]]): The ``(key, label)`` of each dropdown under a cascade's first one.
+            Each level's value is stored under its own key.
+        default (str | None): A top-level option the finding dialog preselects for new findings.
+        allow_other (bool): Whether a single-level ``choice`` field also accepts typed text.
+        colors (dict[str, FindingSeverityColor]): The severity slot's badge color for each top-level option.
+        hint (str | None): Help text under the field in the finding dialog.
+        section (str | None): A heading the finding dialog shows where the section changes.
+    """
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    _KEY_PATTERN: ClassVar[re.Pattern[str]] = re.compile(r"[a-z0-9_]+")
+
+    key: str
+    label: str
+    type: FindingFieldType
+    required: bool = False
+    options: list[FindingFieldOption] = []
+    levels: list[tuple[str, str]] = []
+    default: str | None = None
+    allow_other: bool = False
+    colors: dict[str, FindingSeverityColor] = {}
+    hint: str | None = None
+    section: str | None = None
+
+    @field_validator("options", mode="before")
+    @classmethod
+    def _normalize_options(cls, value: Any) -> Any:
+        """
+        Turn ``(key, label)`` pairs and cascade dicts into option dicts.
+
+        Returns:
+            Any: The options in a form pydantic validates as ``FindingFieldOption`` objects.
+        """
+        return _parse_options(value)
+
+    @model_validator(mode="after")
+    def _validate_definition(self) -> Self:
+        """
+        Check keys, labels and the settings that the field's type allows.
+
+        Returns:
+            Self: The validated field.
+        """
+        self._check_key(self.key)
+        self._check_not_blank()
+        for level_key, _ in self.levels:
+            self._check_key(level_key)
+        if self.type == FindingFieldType.CHOICE:
+            self._check_choice()
+        else:
+            self._check_no_choice_settings()
+        return self
+
+    def _check_key(self, key: str) -> None:
+        """
+        Require a key of lowercase letters, digits and underscores.
+
+        Args:
+            key (str): The field or level key.
+
+        Raises:
+            ValueError: If the key uses any other character or is empty.
+        """
+        if not self._KEY_PATTERN.fullmatch(key):
+            raise ValueError(f"Key '{key}' must use only lowercase letters, digits and underscores.")
+
+    def _check_not_blank(self) -> None:
+        """
+        Require non-blank labels, option keys and option labels.
+
+        Raises:
+            ValueError: If any of them is blank.
+        """
+        texts = [self.label, *(label for _, label in self.levels)]
+        for option in _walk(self.options):
+            texts += [option.key, option.label]
+        if any(not text.strip() for text in texts):
+            raise ValueError(f"Labels, option keys and option labels of '{self.key}' must not be blank.")
+
+    def _check_no_choice_settings(self) -> None:
+        """
+        Reject the settings that only a choice field can use.
+
+        Raises:
+            ValueError: If the field sets options, levels, default, allow_other or colors.
+        """
+        settings = {
+            "options": bool(self.options),
+            "levels": bool(self.levels),
+            "default": self.default is not None,
+            "allow_other": self.allow_other,
+            "colors": bool(self.colors),
+        }
+        for name, is_set in settings.items():
+            if is_set:
+                raise ValueError(f"Field '{self.key}' is a {self.type} field and cannot have {name}.")
+
+    def _check_choice(self) -> None:
+        """
+        Check the option tree of a choice field and the settings that refer to it.
+
+        Raises:
+            ValueError: If the options are missing, repeat a sibling key, nest to a depth that
+                ``levels`` does not match, or ``allow_other`` is combined with levels.
+        """
+        if not self.options:
+            raise ValueError(f"Choice field '{self.key}' needs at least one option.")
+        self._check_unique_siblings()
+        depth = _depth(self.options)
+        if depth != len(self.levels) + 1:
+            raise ValueError(
+                f"Field '{self.key}' needs one entry in levels for each dropdown below the field; "
+                f"its options imply {depth - 1}, but levels has {len(self.levels)}."
+            )
+        self._check_top_level_references()
+        if self.allow_other and self.levels:
+            raise ValueError(f"Field '{self.key}' can take Other text only without levels.")
+
+    def _check_unique_siblings(self) -> None:
+        """
+        Require unique option keys among the options of each dropdown.
+
+        Raises:
+            ValueError: If two sibling options share a key.
+        """
+        for siblings in [self.options, *(option.children for option in _walk(self.options))]:
+            repeated = _first_repeated(option.key for option in siblings)
+            if repeated is not None:
+                raise ValueError(f"Field '{self.key}' repeats the option key '{repeated}' among sibling options.")
+
+    def _check_top_level_references(self) -> None:
+        """
+        Require ``default`` and every ``colors`` key to name a top-level option.
+
+        Raises:
+            ValueError: If either names anything else.
+        """
+        top_level = {option.key for option in self.options}
+        defaults = [] if self.default is None else [self.default]
+        for key in [*defaults, *self.colors]:
+            if key not in top_level:
+                raise ValueError(f"'{key}' is not a top-level option of '{self.key}'.")
+
+
+class FindingFields(BaseModel):
+    """A deployment's finding fields: the severity slot and the fields shown after it."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    severity: FindingField
+    fields: list[FindingField] = []
+
+    @property
+    def severity_order(self) -> list[str]:
+        """The top-level option keys of the severity slot, from highest to lowest severity."""
+        return [option.key for option in self.severity.options]
+
+    @field_validator("severity")
+    @classmethod
+    def _validate_severity_slot(cls, value: FindingField) -> FindingField:
+        """
+        Check the severity slot and mark it required.
+
+        Returns:
+            FindingField: The slot with ``required`` set to True.
+
+        Raises:
+            ValueError: If the slot's key is not ``severity``, it is not a choice field, or it sets
+                ``required=False``.
+        """
+        if value.key != "severity":
+            raise ValueError(f"The severity slot's key must be 'severity', not '{value.key}'.")
+        if value.type != FindingFieldType.CHOICE:
+            raise ValueError("The severity slot must be a choice field.")
+        if "required" in value.model_fields_set and not value.required:
+            raise ValueError("The severity slot is always required; leave required out or set it to True.")
+        return value.model_copy(update={"required": True})
+
+    @model_validator(mode="after")
+    def _validate_keys(self) -> Self:
+        """
+        Check colors and keys across the severity slot, the fields and their levels.
+
+        Returns:
+            Self: The validated fields.
+
+        Raises:
+            ValueError: If a field other than severity sets colors, a key is used more than once,
+                or a key is ``title``.
+        """
+        colored = next((field.key for field in self.fields if field.colors), None)
+        if colored is not None:
+            raise ValueError(f"Only the severity field can set colors, not '{colored}'.")
+        keys = [key for field in [self.severity, *self.fields] for key in _keys_of(field)]
+        repeated = _first_repeated(keys)
+        if repeated is not None:
+            raise ValueError(f"The key '{repeated}' is used more than once across fields and levels.")
+        if "title" in keys:
+            raise ValueError("The key 'title' is reserved for the finding title.")
+        return self
+
+    def check_values(
+        self,
+        *,
+        severity: str,
+        field_values: dict[str, str],
+        previous_severity: str | None = None,
+        previous_values: dict[str, str] | None = None,
+    ) -> None:
+        """
+        Check a finding's severity and field values against these fields.
+
+        On an edit, pass the stored finding's severity and values. A value that has not changed
+        since then may name an option or key that no longer exists.
+
+        Args:
+            severity (str): The severity slot's value.
+            field_values (dict[str, str]): The values of the other fields and of every level, by key.
+            previous_severity (str | None): The stored finding's severity, or None for a new finding.
+            previous_values (dict[str, str] | None): The stored finding's field values, or None for a
+                new finding.
+
+        Raises:
+            FindingValuesError: For the first unknown key, missing required value, or value that is
+                not an option.
+        """
+        previous_values = previous_values or {}
+        self._check_known_keys(field_values=field_values, previous_values=previous_values)
+        values = {**field_values, "severity": severity}
+        previous = {**previous_values, "severity": previous_severity or ""}
+        for field in [self.severity, *self.fields]:
+            _check_field_values(field=field, values=values, previous_values=previous)
+
+    def _check_known_keys(self, *, field_values: dict[str, str], previous_values: dict[str, str]) -> None:
+        """
+        Reject a key that no field or level uses, unless its value has not changed.
+
+        Args:
+            field_values (dict[str, str]): The values to check, by key.
+            previous_values (dict[str, str]): The stored finding's field values.
+
+        Raises:
+            FindingValuesError: If a key is unknown and its value differs from the stored one.
+        """
+        known = {key for field in [self.severity, *self.fields] for key in _keys_of(field)} - {"severity"}
+        for key, value in field_values.items():
+            if key not in known and previous_values.get(key) != value:
+                raise FindingValuesError(f"Unknown finding field {key!r}.")
+
+
+def _parse_options(value: Any) -> Any:
+    """
+    Turn authoring shorthand for options into a list of option dicts.
+
+    A dict maps each ``(key, label)`` pair to its children, written the same way. In a list, a
+    ``(key, label)`` pair becomes an option without children, and anything else passes through.
+
+    Args:
+        value (Any): The options as written.
+
+    Returns:
+        Any: The options as a list, or ``value`` unchanged if it is neither a dict nor a list.
+    """
+    if isinstance(value, dict):
+        return [_parse_branch(pair=pair, children=children) for pair, children in value.items()]
+    if isinstance(value, list):
+        return [{"key": item[0], "label": item[1]} if _is_pair(item) else item for item in value]
+    return value
+
+
+def _parse_branch(*, pair: Any, children: Any) -> dict[str, Any]:
+    """
+    Turn one cascade dict entry into an option dict with its children.
+
+    Args:
+        pair (Any): The entry's key, which must be a ``(key, label)`` pair.
+        children (Any): The options under it, as a list or a dict.
+
+    Returns:
+        dict[str, Any]: The option with its parsed children.
+
+    Raises:
+        ValueError: If ``pair`` is not a ``(key, label)`` pair.
+    """
+    if not _is_pair(pair):
+        raise ValueError(f"Option {pair!r} must be a (key, label) pair.")
+    return {"key": pair[0], "label": pair[1], "children": _parse_options(children)}
+
+
+def _is_pair(value: Any) -> bool:
+    """
+    Check whether a value is a 2-item tuple or list of strings.
+
+    Args:
+        value (Any): The value to check.
+
+    Returns:
+        bool: True if the value is a ``(key, label)`` pair.
+    """
+    return isinstance(value, tuple | list) and len(value) == 2 and all(isinstance(part, str) for part in value)
+
+
+def _walk(options: list[FindingFieldOption]) -> Iterator[FindingFieldOption]:
+    """
+    Yield every option in a tree, each parent before its children.
+
+    Args:
+        options (list[FindingFieldOption]): The top-level options.
+
+    Yields:
+        FindingFieldOption: Each option in the tree.
+    """
+    for option in options:
+        yield option
+        yield from _walk(option.children)
+
+
+def _depth(options: list[FindingFieldOption]) -> int:
+    """
+    Count the dropdowns that the deepest branch of an option tree needs.
+
+    Args:
+        options (list[FindingFieldOption]): The top-level options.
+
+    Returns:
+        int: The depth of the tree, or 0 for no options.
+    """
+    if not options:
+        return 0
+    return 1 + max(_depth(option.children) for option in options)
+
+
+def _first_repeated(keys: Iterable[str]) -> str | None:
+    """
+    Find the first key that appears a second time.
+
+    Args:
+        keys (Iterable[str]): The keys in written order.
+
+    Returns:
+        str | None: The first repeated key, or None if all keys are unique.
+    """
+    seen: set[str] = set()
+    for key in keys:
+        if key in seen:
+            return key
+        seen.add(key)
+    return None
+
+
+def _keys_of(field: FindingField) -> list[str]:
+    """
+    List a field's key followed by its level keys.
+
+    Args:
+        field (FindingField): The field.
+
+    Returns:
+        list[str]: The field key and level keys in written order.
+    """
+    return [field.key, *(level_key for level_key, _ in field.levels)]
+
+
+def _check_field_values(*, field: FindingField, values: dict[str, str], previous_values: dict[str, str]) -> None:
+    """
+    Check the value of one field and of its levels.
+
+    Args:
+        field (FindingField): The field.
+        values (dict[str, str]): Every value of the finding, by key.
+        previous_values (dict[str, str]): Every value of the stored finding, by key.
+
+    Raises:
+        FindingValuesError: If a required value is missing or a value is not an option.
+    """
+    if field.type == FindingFieldType.CHOICE:
+        _check_choice_values(field=field, values=values, previous_values=previous_values)
+    elif field.required and _non_blank(values.get(field.key)) is None:
+        raise FindingValuesError(f"{field.label} is required.")
+
+
+def _check_choice_values(*, field: FindingField, values: dict[str, str], previous_values: dict[str, str]) -> None:
+    """
+    Walk a choice field's dropdowns, checking each value against the options under its parent.
+
+    A value that is not an option passes if it and every value above it are unchanged.
+
+    Args:
+        field (FindingField): The choice field.
+        values (dict[str, str]): Every value of the finding, by key.
+        previous_values (dict[str, str]): Every value of the stored finding, by key.
+
+    Raises:
+        FindingValuesError: If a required dropdown with options has no value, or a value is not an
+            option and is neither unchanged nor allowed as Other text.
+    """
+    options = field.options
+    path_unchanged = True
+    for key, label in [(field.key, field.label), *field.levels]:
+        value = _non_blank(values.get(key))
+        path_unchanged = path_unchanged and value == _non_blank(previous_values.get(key))
+        options = _check_level(
+            label=label,
+            value=value,
+            options=options,
+            required=field.required,
+            accepts_unmatched=path_unchanged or field.allow_other,
+        )
+
+
+def _check_level(
+    *, label: str, value: str | None, options: list[FindingFieldOption], required: bool, accepts_unmatched: bool
+) -> list[FindingFieldOption]:
+    """
+    Check one dropdown's value and find the options of the next dropdown.
+
+    Args:
+        label (str): The dropdown's label.
+        value (str | None): The dropdown's value, or None if it is missing.
+        options (list[FindingFieldOption]): The options the dropdown offers.
+        required (bool): Whether the field is required.
+        accepts_unmatched (bool): Whether a value that is not an option passes.
+
+    Returns:
+        list[FindingFieldOption]: The children of the chosen option, or an empty list if there is
+            no matching option.
+
+    Raises:
+        FindingValuesError: If a required dropdown with options has no value, or the value is not
+            an option and ``accepts_unmatched`` is False.
+    """
+    if value is None:
+        if required and options:
+            raise FindingValuesError(f"{label} is required.")
+        return []
+    match = next((option for option in options if option.key == value), None)
+    if match is None and not accepts_unmatched:
+        raise FindingValuesError(f"{label} has no option {value!r}.")
+    return [] if match is None else match.children
+
+
+def _non_blank(value: str | None) -> str | None:
+    """
+    Treat a blank value as missing.
+
+    Args:
+        value (str | None): The value, or None if it is missing.
+
+    Returns:
+        str | None: The value, or None if it is missing or blank.
+    """
+    return value if value and value.strip() else None
+
+
+DEFAULT_FINDING_FIELDS = FindingFields(
+    severity=FindingField(
+        key="severity",
+        label="Severity",
+        type=FindingFieldType.CHOICE,
+        options=[
+            FindingFieldOption(key="critical", label="Critical"),
+            FindingFieldOption(key="important", label="Important"),
+            FindingFieldOption(key="moderate", label="Moderate"),
+            FindingFieldOption(key="low", label="Low"),
+            FindingFieldOption(key="informational", label="Informational"),
+        ],
+        default="moderate",
+        allow_other=True,
+        colors={
+            "critical": FindingSeverityColor.RED,
+            "important": FindingSeverityColor.YELLOW,
+            "moderate": FindingSeverityColor.YELLOW,
+            "low": FindingSeverityColor.GRAY,
+        },
+    ),
+    fields=[
+        FindingField(
+            key="harm_type",
+            label="Harm-type",
+            type=FindingFieldType.CHOICE,
+            options=[
+                FindingFieldOption(key=category.value, label=category.value)
+                for category in HarmCategory
+                if category is not HarmCategory.OTHER
+            ],
+            allow_other=True,
+            hint="Optional. Select a category, or choose Other for custom text.",
+        ),
+        FindingField(key="description", label="Description", type=FindingFieldType.MULTILINE, hint="Optional"),
+    ],
+)
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
new file mode 100644
index 0000000000..e3d3fdade2
--- /dev/null
+++ b/tests/unit/models/test_finding_fields.py
@@ -0,0 +1,320 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import pytest
+from pydantic import ValidationError
+
+from pyrit.models import (
+    DEFAULT_FINDING_FIELDS,
+    FindingField,
+    FindingFields,
+    FindingValuesError,
+)
+from pyrit.models.finding_fields import FindingFieldOption
+from pyrit.models.harm_category import HarmCategory
+
+CONTOSO = FindingFields(
+    severity=FindingField(
+        key="severity",
+        label="Severity",
+        type="choice",
+        section="Severity",
+        colors={"sev1": "red", "sev2": "yellow", "sev3": "blue"},
+        levels=[("severity_rationale", "Severity rationale")],
+        options={
+            ("sev1", "Sev 1"): [("remote_no_auth", "Remote, no sign-in needed")],
+            ("sev2", "Sev 2"): [("signed_in_user", "Needs a signed-in user")],
+            ("sev3", "Sev 3"): [("admin_only", "Needs admin access")],
+        },
+    ),
+    fields=[
+        FindingField(
+            key="category",
+            label="Category",
+            type="choice",
+            required=True,
+            section="Classification",
+            levels=[("subcategory", "Subcategory")],
+            options={
+                ("model_security", "Model security"): [
+                    ("system_prompt_leak", "System prompt leak"),
+                    ("tool_misuse", "Tool misuse"),
+                ],
+                ("content_safety", "Content safety"): [("hate_speech", "Hate speech"), ("self_harm", "Self-harm")],
+            },
+        ),
+        FindingField(
+            key="technique",
+            label="Technique",
+            type="choice",
+            section="Reproduction",
+            allow_other=True,
+            options=[("role_play", "Role play"), ("multi_turn", "Multi-turn escalation")],
+        ),
+        FindingField(
+            key="steps",
+            label="Steps to reproduce",
+            type="multiline",
+            required=True,
+            section="Reproduction",
+            hint="List the prompts in the order you sent them.",
+        ),
+        FindingField(key="owner", label="Owner", type="text", section="Tracking"),
+    ],
+)
+
+
+def test_finding_field_normalizes_pairs_and_nested_options() -> None:
+    assert CONTOSO.severity.options[0] == FindingFieldOption(
+        key="sev1",
+        label="Sev 1",
+        children=[FindingFieldOption(key="remote_no_auth", label="Remote, no sign-in needed")],
+    )
+    technique = CONTOSO.fields[1]
+    assert [(option.key, option.label, option.children) for option in technique.options] == [
+        ("role_play", "Role play", []),
+        ("multi_turn", "Multi-turn escalation", []),
+    ]
+
+
+def test_finding_fields_round_trip_through_json() -> None:
+    assert FindingFields.model_validate_json(CONTOSO.model_dump_json()) == CONTOSO
+
+
+def test_severity_slot_is_required_and_ordered() -> None:
+    assert CONTOSO.severity.required is True
+    assert CONTOSO.severity_order == ["sev1", "sev2", "sev3"]
+
+
+def test_default_finding_fields_match_3066() -> None:
+    severity, (harm, description) = DEFAULT_FINDING_FIELDS.severity, DEFAULT_FINDING_FIELDS.fields
+    assert DEFAULT_FINDING_FIELDS.severity_order == ["critical", "important", "moderate", "low", "informational"]
+    assert [option.label for option in severity.options] == [
+        "Critical",
+        "Important",
+        "Moderate",
+        "Low",
+        "Informational",
+    ]
+    assert (severity.default, severity.allow_other) == ("moderate", True)
+    assert severity.colors == {"critical": "red", "important": "yellow", "moderate": "yellow", "low": "gray"}
+    assert (harm.key, harm.label, harm.type, harm.required, harm.allow_other) == (
+        "harm_type",
+        "Harm-type",
+        "choice",
+        False,
+        True,
+    )
+    assert [option.key for option in harm.options] == [c.value for c in HarmCategory if c is not HarmCategory.OTHER]
+    assert harm.hint == "Optional. Select a category, or choose Other for custom text."
+    assert (description.key, description.label, description.type, description.hint) == (
+        "description",
+        "Description",
+        "multiline",
+        "Optional",
+    )
+
+
+SEVERITY = {"key": "severity", "label": "Severity", "type": "choice", "options": [("high", "High")]}
+
+
+@pytest.mark.parametrize("color", ["red", "orange", "yellow", "green", "blue", "gray", "dark", "neutral"])
+def test_severity_slot_accepts_every_badge_color(color: str) -> None:
+    fields = FindingFields.model_validate({"severity": {**SEVERITY, "colors": {"high": color}}, "fields": []})
+    assert fields.severity.colors == {"high": color}
+
+
+def test_severity_slot_rejects_an_unknown_color() -> None:
+    with pytest.raises(ValidationError, match="Input should be"):
+        FindingFields.model_validate({"severity": {**SEVERITY, "colors": {"high": "pink"}}, "fields": []})
+
+
+def _choice(**overrides: object) -> dict[str, object]:
+    return {"key": "area", "label": "Area", "type": "choice", "options": [("chat", "Chat")], **overrides}
+
+
+NESTED = {("chat", "Chat"): [("history", "History")]}
+
+
+@pytest.mark.parametrize(
+    ("severity", "fields", "match"),
+    [
+        (SEVERITY, [_choice(key="Bad-Key")], "lowercase letters, digits and underscores"),
+        (
+            SEVERITY,
+            [{"key": "notes", "label": "Notes", "type": "text", "options": [("a", "A")]}],
+            "cannot have options",
+        ),
+        (SEVERITY, [_choice(options=[])], "needs at least one option"),
+        (SEVERITY, [_choice(options=[("chat", "Chat"), ("chat", "Chat again")])], "repeats the option key 'chat'"),
+        (SEVERITY, [_choice(options=NESTED)], "one entry in levels"),
+        (SEVERITY, [_choice(levels=[("feature", "Feature")])], "one entry in levels"),
+        (SEVERITY, [_choice(default="search")], "'search' is not a top-level option of 'area'"),
+        (
+            SEVERITY,
+            [_choice(allow_other=True, levels=[("feature", "Feature")], options=NESTED)],
+            "Other text only without levels",
+        ),
+        (SEVERITY, [_choice(colors={"chat": "red"})], "Only the severity field can set colors"),
+        ({**SEVERITY, "colors": {"low": "red"}}, [], "'low' is not a top-level option of 'severity'"),
+        ({**SEVERITY, "key": "sev"}, [], "key must be 'severity'"),
+        ({**SEVERITY, "type": "text", "options": []}, [], "must be a choice field"),
+        ({**SEVERITY, "required": False}, [], "always required"),
+        (SEVERITY, [_choice(), _choice(label="Area again")], "'area' is used more than once"),
+        (SEVERITY, [_choice(levels=[("severity", "Severity")], options=NESTED)], "'severity' is used more than once"),
+        (SEVERITY, [_choice(key="title")], "'title' is reserved"),
+        (SEVERITY, [_choice(label=" ")], "must not be blank"),
+    ],
+)
+def test_finding_fields_rejects_invalid_definitions(severity: dict, fields: list, match: str) -> None:
+    with pytest.raises(ValidationError, match=match):
+        FindingFields.model_validate({"severity": severity, "fields": fields})
+
+
+@pytest.mark.parametrize(
+    ("field", "match"),
+    [
+        (_choice(levels=[("Feature", "Feature")], options=NESTED), "lowercase letters, digits and underscores"),
+        (_choice(options=[("chat", " ")]), "must not be blank"),
+        (_choice(levels=[("feature", "Feature")], options={("chat", "Chat"): [(" ", "History")]}), "must not be blank"),
+        ({"key": "notes", "label": "Notes", "type": "text", "default": "a"}, "cannot have default"),
+        (_choice(options={"chat": []}), r"\(key, label\) pair"),
+    ],
+)
+def test_finding_field_rejects_invalid_parts(field: dict, match: str) -> None:
+    with pytest.raises(ValidationError, match=match):
+        FindingField.model_validate(field)
+
+
+def test_severity_slot_accepts_explicit_required() -> None:
+    assert FindingFields.model_validate({"severity": {**SEVERITY, "required": True}}).severity.required is True
+
+
+VALID = {
+    "severity_rationale": "remote_no_auth",
+    "category": "model_security",
+    "subcategory": "system_prompt_leak",
+    "steps": "1. Open a new chat",
+}
+
+
+def _without(*keys: str) -> dict[str, str]:
+    return {key: value for key, value in VALID.items() if key not in keys}
+
+
+@pytest.mark.parametrize(
+    ("severity", "values", "previous_severity", "previous_values"),
+    [
+        pytest.param("sev1", VALID, None, None, id="complete"),
+        pytest.param("sev1", {**VALID, "technique": "Many-shot priming", "owner": "dana"}, None, None, id="other text"),
+        pytest.param("sev4", _without("severity_rationale"), "sev4", {}, id="unchanged unmatched severity"),
+        pytest.param("sev1", {**VALID, "repro": "old"}, "sev1", {"repro": "old"}, id="unchanged retired field"),
+        pytest.param(
+            "sev1",
+            {**VALID, "category": "gone", "subcategory": "old"},
+            "sev1",
+            {"category": "gone", "subcategory": "old"},
+            id="unchanged unmatched path",
+        ),
+    ],
+)
+def test_check_values_accepts(
+    severity: str, values: dict, previous_severity: str | None, previous_values: dict | None
+) -> None:
+    CONTOSO.check_values(
+        severity=severity, field_values=values, previous_severity=previous_severity, previous_values=previous_values
+    )
+
+
+@pytest.mark.parametrize(
+    ("severity", "values", "previous_severity", "previous_values", "message"),
+    [
+        pytest.param("", VALID, None, None, "Severity is required.", id="blank severity"),
+        pytest.param("sev9", VALID, None, None, "Severity has no option 'sev9'.", id="unknown severity"),
+        pytest.param("sev4", VALID, "sev1", VALID, "Severity has no option 'sev4'.", id="changed to unmatched"),
+        pytest.param(
+            "sev1", _without("severity_rationale"), None, None, "Severity rationale is required.", id="missing level"
+        ),
+        pytest.param(
+            "sev1", _without("category", "subcategory"), None, None, "Category is required.", id="missing field"
+        ),
+        pytest.param(
+            "sev1",
+            {**VALID, "subcategory": "hate_speech"},
+            None,
+            None,
+            "Subcategory has no option 'hate_speech'.",
+            id="child under wrong parent",
+        ),
+        pytest.param(
+            "sev1",
+            {**VALID, "category": "content_safety"},
+            "sev1",
+            VALID,
+            "Subcategory has no option 'system_prompt_leak'.",
+            id="stale child",
+        ),
+        pytest.param("sev1", {**VALID, "steps": "   "}, None, None, "Steps to reproduce is required.", id="blank text"),
+        pytest.param(
+            "sev1",
+            _without("steps"),
+            "sev1",
+            _without("steps"),
+            "Steps to reproduce is required.",
+            id="required field added after saving",
+        ),
+        pytest.param(
+            "sev1", {**VALID, "reviewer": "kim"}, None, None, "Unknown finding field 'reviewer'.", id="unknown key"
+        ),
+        pytest.param(
+            "sev1",
+            {**VALID, "severity": "sev1"},
+            None,
+            None,
+            "Unknown finding field 'severity'.",
+            id="severity in values",
+        ),
+        pytest.param(
+            "sev1",
+            {**VALID, "repro": "new"},
+            "sev1",
+            {**VALID, "repro": "old"},
+            "Unknown finding field 'repro'.",
+            id="changed retired field",
+        ),
+    ],
+)
+def test_check_values_rejects(
+    severity: str, values: dict, previous_severity: str | None, previous_values: dict | None, message: str
+) -> None:
+    with pytest.raises(FindingValuesError) as error:
+        CONTOSO.check_values(
+            severity=severity, field_values=values, previous_severity=previous_severity, previous_values=previous_values
+        )
+    assert str(error.value) == message
+
+
+AREA = _choice(
+    levels=[("feature", "Feature")],
+    options={("chat", "Chat"): [("history", "History")], ("search", "Search"): []},
+)
+AREAS = FindingFields.model_validate({"severity": SEVERITY, "fields": [AREA]})
+REQUIRED_AREAS = FindingFields.model_validate({"severity": SEVERITY, "fields": [{**AREA, "required": True}]})
+
+
+@pytest.mark.parametrize("values", [{"area": "chat"}, {}])
+def test_check_values_optional_cascade_allows_a_partial_path(values: dict) -> None:
+    AREAS.check_values(severity="high", field_values=values)
+
+
+def test_check_values_rejects_a_child_without_its_parent() -> None:
+    with pytest.raises(FindingValuesError) as error:
+        AREAS.check_values(severity="high", field_values={"feature": "history"})
+    assert str(error.value) == "Feature has no option 'history'."
+
+
+def test_check_values_required_cascade_skips_a_level_with_no_options() -> None:
+    REQUIRED_AREAS.check_values(severity="high", field_values={"area": "search"})
+    with pytest.raises(FindingValuesError) as error:
+        REQUIRED_AREAS.check_values(severity="high", field_values={"area": "chat"})
+    assert str(error.value) == "Feature is required."

From ca3d47dcc05589b007358e6a804848735dd6f723 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Mon, 26 Oct 2026 12:00:54 -0400
Subject: [PATCH 03/20] Add FindingFieldsInitializer and active finding fields

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/memory/memory_interface.py              |  2 +-
 pyrit/setup/finding_fields.py                 | 44 +++++++++
 pyrit/setup/initialization.py                 |  3 +
 pyrit/setup/initializers/__init__.py          |  2 +
 pyrit/setup/initializers/finding_fields.py    | 39 ++++++++
 tests/unit/setup/test_finding_fields.py       | 45 +++++++++
 .../setup/test_finding_fields_initializer.py  | 96 +++++++++++++++++++
 tests/unit/setup/test_initialization.py       | 87 ++++++++++++++++-
 8 files changed, 315 insertions(+), 3 deletions(-)
 create mode 100644 pyrit/setup/finding_fields.py
 create mode 100644 pyrit/setup/initializers/finding_fields.py
 create mode 100644 tests/unit/setup/test_finding_fields.py
 create mode 100644 tests/unit/setup/test_finding_fields_initializer.py

diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index 3596046b3f..ca6381f859 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -1046,7 +1046,7 @@ async def get_findings_async(
         severity_order: Sequence[str] = (),
     ) -> list[Finding]:
         """
-        Read one page of findings, highest severity first, then newest first.
+        Read one page of findings in ``severity_order``, then newest first.
 
         Args:
             operation_id (uuid.UUID | None): The operation whose findings to read. Defaults to None, which reads
diff --git a/pyrit/setup/finding_fields.py b/pyrit/setup/finding_fields.py
new file mode 100644
index 0000000000..6cc4607c67
--- /dev/null
+++ b/pyrit/setup/finding_fields.py
@@ -0,0 +1,44 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Hold the finding fields that the current setup pass configured."""
+
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingFields
+
+_active: tuple[FindingFields, str] | None = None
+
+
+def get_active_finding_fields() -> FindingFields:
+    """
+    Return the finding fields of the current setup pass.
+
+    Returns:
+        FindingFields: The fields set in this pass, or ``DEFAULT_FINDING_FIELDS`` when none were set.
+    """
+    return _active[0] if _active is not None else DEFAULT_FINDING_FIELDS
+
+
+def set_active_finding_fields(*, finding_fields: FindingFields, source: str) -> None:
+    """
+    Set the finding fields for the current setup pass.
+
+    Args:
+        finding_fields (FindingFields): The deployment's finding fields.
+        source (str): The setter's name, which the error names when two setters run in one pass.
+
+    Raises:
+        ValueError: If finding fields were already set in this setup pass.
+    """
+    global _active
+    if _active is not None:
+        raise ValueError(
+            f"{source} cannot set the finding fields: {_active[1]} already set them in this setup pass. "
+            "Use one FindingFieldsInitializer per deployment."
+        )
+    _active = (finding_fields, source)
+
+
+def reset_active_finding_fields() -> None:
+    """Restore the default finding fields at the start of a setup pass."""
+    global _active
+    _active = None
diff --git a/pyrit/setup/initialization.py b/pyrit/setup/initialization.py
index be385594f2..686dea2365 100644
--- a/pyrit/setup/initialization.py
+++ b/pyrit/setup/initialization.py
@@ -16,6 +16,7 @@
     load_environment_files,
     validate_env_akv_strict,
 )
+from pyrit.setup.finding_fields import reset_active_finding_fields
 
 if TYPE_CHECKING:
     from pyrit.setup.pyrit_initializer import PyRITInitializer
@@ -206,6 +207,7 @@ async def initialize_pyrit_async(
     # Reset all default values before executing initialization scripts
     # This ensures a clean state for each initialization
     reset_default_values()
+    reset_active_finding_fields()
 
     # Set up memory BEFORE executing initialization scripts
     # This is critical because initialization scripts may instantiate objects
@@ -302,6 +304,7 @@ async def reinitialize_pyrit_async(
     os.environ.update(environment_values)
     configure_random_seed(seed=seed)
     reset_default_values()
+    reset_active_finding_fields()
     CentralMemory.set_memory_instance(memory)
     initializers = await asyncio.to_thread(initializer_factory)
     await _execute_initializers_async(initializers=initializers, raise_on_initializer_error=True)
diff --git a/pyrit/setup/initializers/__init__.py b/pyrit/setup/initializers/__init__.py
index d5693e3c80..6bd9964d5f 100644
--- a/pyrit/setup/initializers/__init__.py
+++ b/pyrit/setup/initializers/__init__.py
@@ -11,6 +11,7 @@
 if TYPE_CHECKING:
     from pyrit.models.parameter import Parameter
     from pyrit.setup.initializers.converters import ConverterInitializer
+    from pyrit.setup.initializers.finding_fields import FindingFieldsInitializer
     from pyrit.setup.initializers.load_default_datasets import LoadDefaultDatasets
     from pyrit.setup.initializers.preload_scenario_metadata import PreloadScenarioMetadata
     from pyrit.setup.initializers.refresh_datasets import RefreshDatasets
@@ -24,6 +25,7 @@
     "Parameter": "pyrit.models.parameter",
     "PyRITInitializer": "pyrit.setup.pyrit_initializer",
     "ConverterInitializer": "pyrit.setup.initializers.converters",
+    "FindingFieldsInitializer": "pyrit.setup.initializers.finding_fields",
     "TechniqueInitializer": "pyrit.setup.initializers.techniques",
     "ToolsInitializer": "pyrit.setup.initializers.tools",
     "ScorerInitializer": "pyrit.setup.initializers.scorers",
diff --git a/pyrit/setup/initializers/finding_fields.py b/pyrit/setup/initializers/finding_fields.py
new file mode 100644
index 0000000000..d4025b0d3d
--- /dev/null
+++ b/pyrit/setup/initializers/finding_fields.py
@@ -0,0 +1,39 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Base initializer for a deployment's finding fields."""
+
+from abc import abstractmethod
+from typing import Any
+
+from pyrit.models import FindingFields
+from pyrit.setup.finding_fields import set_active_finding_fields
+from pyrit.setup.pyrit_initializer import PyRITInitializer
+
+
+class FindingFieldsInitializer(PyRITInitializer):
+    """Set a deployment's finding fields from ``get_finding_fields``."""
+
+    @abstractmethod
+    def get_finding_fields(self) -> FindingFields:
+        """
+        Return the deployment's finding fields.
+
+        Returns:
+            FindingFields: The fields that setup makes active.
+        """
+
+    async def initialize_async(self) -> None:
+        """Make the fields from ``get_finding_fields`` the active finding fields."""
+        set_active_finding_fields(finding_fields=self.get_finding_fields(), source=type(self).__name__)
+
+    async def get_dynamic_default_values_info_async(self) -> dict[str, Any]:
+        """
+        Report no default values or global variables without running ``initialize_async``.
+
+        The base class runs ``initialize_async`` to find out, which would change the active finding fields.
+
+        Returns:
+            dict[str, Any]: Empty ``default_values`` and ``global_variables`` lists.
+        """
+        return {"default_values": [], "global_variables": []}
diff --git a/tests/unit/setup/test_finding_fields.py b/tests/unit/setup/test_finding_fields.py
new file mode 100644
index 0000000000..be8dc16a04
--- /dev/null
+++ b/tests/unit/setup/test_finding_fields.py
@@ -0,0 +1,45 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+from collections.abc import Iterator
+
+import pytest
+
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
+from pyrit.setup.finding_fields import (
+    get_active_finding_fields,
+    reset_active_finding_fields,
+    set_active_finding_fields,
+)
+
+CUSTOM = FindingFields(
+    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+)
+
+
+@pytest.fixture(autouse=True)
+def reset_finding_fields() -> Iterator[None]:
+    yield
+    reset_active_finding_fields()
+
+
+def test_active_finding_fields_default_to_3066() -> None:
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
+def test_set_active_finding_fields_replaces_the_default() -> None:
+    set_active_finding_fields(finding_fields=CUSTOM, source="First")
+    assert get_active_finding_fields() is CUSTOM
+
+
+def test_set_active_finding_fields_twice_names_both_sources() -> None:
+    set_active_finding_fields(finding_fields=CUSTOM, source="First")
+    with pytest.raises(ValueError, match="Second cannot set the finding fields: First already set them"):
+        set_active_finding_fields(finding_fields=DEFAULT_FINDING_FIELDS, source="Second")
+    assert get_active_finding_fields() is CUSTOM
+
+
+def test_reset_restores_the_default() -> None:
+    set_active_finding_fields(finding_fields=CUSTOM, source="First")
+    reset_active_finding_fields()
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
diff --git a/tests/unit/setup/test_finding_fields_initializer.py b/tests/unit/setup/test_finding_fields_initializer.py
new file mode 100644
index 0000000000..955ffc7e4a
--- /dev/null
+++ b/tests/unit/setup/test_finding_fields_initializer.py
@@ -0,0 +1,96 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import importlib.util
+from collections.abc import Iterator
+from pathlib import Path
+
+import pytest
+
+import pyrit.setup.initializers
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
+from pyrit.registry import InitializerRegistry
+from pyrit.registry.discovery import discover_in_directory
+from pyrit.setup.finding_fields import get_active_finding_fields, reset_active_finding_fields
+from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.pyrit_initializer import PyRITInitializer
+
+EXAMPLE = FindingFields(
+    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+)
+
+CONTOSO_SCRIPT = '''
+from pyrit.models import FindingField, FindingFields
+from pyrit.setup.initializers import FindingFieldsInitializer
+
+
+class ContosoFindingFields(FindingFieldsInitializer):
+    """Contoso finding fields."""
+
+    def get_finding_fields(self) -> FindingFields:
+        return FindingFields(
+            severity=FindingField(key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1")])
+        )
+'''
+
+
+class ExampleFindingFields(FindingFieldsInitializer):
+    """Example finding fields."""
+
+    def get_finding_fields(self) -> FindingFields:
+        return EXAMPLE
+
+
+@pytest.fixture(autouse=True)
+def reset_finding_fields() -> Iterator[None]:
+    yield
+    reset_active_finding_fields()
+
+
+async def test_finding_fields_initializer_sets_the_active_fields() -> None:
+    await ExampleFindingFields().initialize_async()
+    assert get_active_finding_fields() is EXAMPLE
+
+
+@pytest.mark.usefixtures("patch_central_database")
+async def test_get_info_leaves_the_active_fields_alone() -> None:
+    await ExampleFindingFields.get_info_async()
+    info = await ExampleFindingFields.get_info_async()
+
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+    assert info["default_values"] == []
+    assert info["global_variables"] == []
+
+
+def test_finding_fields_initializer_is_skipped_by_builtin_discovery() -> None:
+    directory = Path(pyrit.setup.initializers.__file__).parent
+    names = [
+        cls.__name__
+        for _, _, cls in discover_in_directory(directory=directory, base_class=PyRITInitializer, recursive=True)
+    ]
+    assert "FindingFieldsInitializer" not in names
+
+
+async def test_discovery_copy_shares_the_active_finding_fields() -> None:
+    path = Path(pyrit.setup.initializers.__file__).parent / "finding_fields.py"
+    spec = importlib.util.spec_from_file_location("discovered_module.finding_fields", path)
+    copy = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(copy)
+
+    class CopiedFindingFields(copy.FindingFieldsInitializer):
+        def get_finding_fields(self) -> FindingFields:
+            return EXAMPLE
+
+    await CopiedFindingFields().initialize_async()
+    assert get_active_finding_fields() is EXAMPLE
+
+
+async def test_custom_script_subclass_sets_the_active_fields(tmp_path: Path) -> None:
+    script = tmp_path / "contoso_fields.py"
+    script.write_text(CONTOSO_SCRIPT)
+    [initializer] = InitializerRegistry.get_registry_singleton().create_from_script_paths(
+        script_paths=[script], strict=True
+    )
+    assert type(initializer).__name__ == "ContosoFindingFields"
+    await initializer.initialize_async()
+    assert get_active_finding_fields().severity_order == ["sev1"]
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index 73c275d49f..2525b79883 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -5,19 +5,32 @@
 import os
 import pathlib
 import tempfile
+from collections.abc import Iterator
 from unittest import mock
 
 import pytest
+from pydantic import ValidationError
 
 from pyrit.common.apply_defaults import reset_default_values
 from pyrit.common.random_context import get_configured_random_seed
 from pyrit.common.singleton import Singleton
 from pyrit.memory import AzureSQLMemory, CentralMemory, SQLiteMemory
-from pyrit.models import MessagePiece
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields, MessagePiece
 from pyrit.registry import InitializerRegistry
-from pyrit.setup import IN_MEMORY, initialize_pyrit_async
+from pyrit.setup import IN_MEMORY, initialization, initialize_pyrit_async
+from pyrit.setup.finding_fields import (
+    get_active_finding_fields,
+    reset_active_finding_fields,
+    set_active_finding_fields,
+)
+from pyrit.setup.initialization import reinitialize_pyrit_async
+from pyrit.setup.initializers import FindingFieldsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
+CUSTOM = FindingFields(
+    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+)
+
 
 @pytest.mark.parametrize("existing_memory", [False, True])
 async def test_initializer_failure_closes_only_newly_installed_memory(
@@ -440,3 +453,73 @@ async def test_initialize_forwards_silent_to_memory(self, mock_load_environment,
         await initialize_pyrit_async(memory_db_type=IN_MEMORY, silent=silent, load_defaults=False)
 
         assert CentralMemory.get_memory_instance()._silent is silent
+
+
+class _SetsCustomFields(PyRITInitializer):
+    async def initialize_async(self) -> None:
+        set_active_finding_fields(finding_fields=CUSTOM, source="pass")
+
+
+@pytest.fixture
+def reset_finding_fields() -> Iterator[None]:
+    yield
+    reset_active_finding_fields()
+
+
+@pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
+async def test_each_setup_pass_resets_finding_fields() -> None:
+    with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):
+        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[_SetsCustomFields()])
+        assert get_active_finding_fields() is CUSTOM
+
+        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[_SetsCustomFields()])
+        assert get_active_finding_fields() is CUSTOM
+
+        await initialize_pyrit_async(memory_db_type=IN_MEMORY, load_defaults=False)
+        assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_reinitialize_resets_finding_fields() -> None:
+    set_active_finding_fields(finding_fields=CUSTOM, source="pass")
+    with (
+        mock.patch.object(CentralMemory, "set_memory_instance"),
+        mock.patch.object(initialization, "_execute_initializers_async", new_callable=mock.AsyncMock),
+    ):
+        await reinitialize_pyrit_async(
+            memory=mock.MagicMock(spec=SQLiteMemory), initializer_factory=list, environment_values={}, seed=None
+        )
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
+@pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
+async def test_second_finding_fields_initializer_stops_setup() -> None:
+    class FirstFindingFields(FindingFieldsInitializer):
+        def get_finding_fields(self) -> FindingFields:
+            return CUSTOM
+
+    class SecondFindingFields(FindingFieldsInitializer):
+        def get_finding_fields(self) -> FindingFields:
+            return CUSTOM
+
+    with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):
+        with pytest.raises(
+            ValueError, match="SecondFindingFields cannot set the finding fields: FirstFindingFields already set them"
+        ):
+            await initialize_pyrit_async(
+                memory_db_type=IN_MEMORY, initializers=[FirstFindingFields(), SecondFindingFields()]
+            )
+
+
+@pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
+async def test_invalid_finding_fields_stop_setup() -> None:
+    class BrokenFindingFields(FindingFieldsInitializer):
+        def get_finding_fields(self) -> FindingFields:
+            return FindingFields(
+                severity=CUSTOM.severity,
+                fields=[FindingField(key="broken", label="Broken", type="choice", options=[])],
+            )
+
+    with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):
+        with pytest.raises(ValidationError, match="needs at least one option"):
+            await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[BrokenFindingFields()])

From 627cba2beae489206daa151d64e63d90891cce76 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Tue, 27 Oct 2026 10:52:19 -0400
Subject: [PATCH 04/20] Store finding severity and field values without CHECK
 constraints

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/backend/services/operation_service.py   |   6 +-
 ...d43b1bcf9c56_store_finding_field_values.py |  95 +++++++++
 pyrit/memory/memory_models.py                 |  52 +----
 pyrit/models/__init__.py                      |   3 +-
 pyrit/models/finding.py                       |  61 ++----
 tests/unit/backend/test_operations.py         |  48 ++---
 .../test_finding_field_values_migration.py    | 185 ++++++++++++++++++
 tests/unit/memory/test_findings.py            |  87 +++-----
 .../test_operations_and_findings_migration.py |  34 +++-
 tests/unit/models/test_finding.py             |  74 ++-----
 10 files changed, 404 insertions(+), 241 deletions(-)
 create mode 100644 pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
 create mode 100644 tests/unit/memory/test_finding_field_values_migration.py

diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index 79e3889348..4b1621b310 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -25,10 +25,10 @@
     Finding,
     FindingCreate,
     FindingEvidence,
-    FindingSeverity,
     Operation,
     OperationCreate,
 )
+from pyrit.setup.finding_fields import get_active_finding_fields
 
 # Keeps every ID list a batch reads within SQL Server's 2100-parameter limit.
 _EVIDENCE_BATCH_SIZE = 500
@@ -201,7 +201,7 @@ async def list_findings_async(
             limit=limit + 1,
             offset=offset,
             title_query=title_query,
-            severity_order=[severity.value for severity in FindingSeverity],
+            severity_order=get_active_finding_fields().severity_order,
         )
         has_more = len(findings) > limit
         page = findings[:limit]
@@ -277,7 +277,7 @@ async def get_findings_with_evidence_async(
         findings = await memory.get_findings_by_ids_async(
             operation_id=operation_id,
             finding_ids=finding_ids,
-            severity_order=[severity.value for severity in FindingSeverity],
+            severity_order=get_active_finding_fields().severity_order,
         )
         found = {finding.id for finding in findings}
         missing = next((finding_id for finding_id in finding_ids if finding_id not in found), None)
diff --git a/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py b/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
new file mode 100644
index 0000000000..b1ee65fb17
--- /dev/null
+++ b/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
@@ -0,0 +1,95 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+Store each finding as a severity plus a JSON object of field values.
+
+Drops the three classification CHECK constraints on ``FindingEntries``, makes ``severity`` unbounded Unicode
+(binary-collated on SQL Server), replaces an Other severity with its custom text, and moves the harm type (its
+custom text when it is Other) and any description that isn't empty or only spaces into the new ``field_values``
+column. Finding IDs, Operation links, creation times, and evidence links do not change. Downgrading restores the
+old columns only while no findings exist.
+
+Revision ID: d43b1bcf9c56
+Revises: c8d3e5f7a901
+Create Date: 2026-10-27 12:00:00.000000
+"""
+
+from collections.abc import Sequence  # noqa: TC003
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "d43b1bcf9c56"
+down_revision: str | None = "c8d3e5f7a901"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_SEVERITY_TYPE = sa.Unicode().with_variant(sa.Unicode(collation="Latin1_General_100_BIN2"), "mssql")
+_HARM_TYPE_SQL = "CASE WHEN harm_type = 'Other' THEN harm_type_other ELSE harm_type END"
+_DESCRIPTION_SQL = "CASE WHEN LTRIM(RTRIM(description)) = '' THEN NULL ELSE description END"
+_OLD_COLUMNS = ("description", "severity_other", "harm_type", "harm_type_other")
+_CHECKS = {
+    "ck_findings_severity": "severity IN ('critical', 'important', 'moderate', 'low', 'informational', 'other')",
+    "ck_findings_severity_other": (
+        "(severity = 'other' AND severity_other IS NOT NULL AND LTRIM(RTRIM(severity_other)) <> '') "
+        "OR (severity <> 'other' AND severity_other IS NULL)"
+    ),
+    "ck_findings_harm_type_other": (
+        "(harm_type IS NOT NULL AND harm_type = 'Other' AND harm_type_other IS NOT NULL "
+        "AND LTRIM(RTRIM(harm_type_other)) <> '') "
+        "OR ((harm_type IS NULL OR harm_type <> 'Other') AND harm_type_other IS NULL)"
+    ),
+}
+
+
+def upgrade() -> None:
+    """Drop the classification checks and move each finding's values into ``severity`` and ``field_values``."""
+    # SQL Server rejects ALTER COLUMN while a CHECK references the column, so the checks go first.
+    with op.batch_alter_table("FindingEntries") as batch_op:
+        for name in _CHECKS:
+            batch_op.drop_constraint(name, type_="check")
+        batch_op.add_column(sa.Column("field_values", sa.JSON(), nullable=True))
+        batch_op.alter_column("severity", existing_type=sa.String(32), type_=_SEVERITY_TYPE, existing_nullable=False)
+    op.execute(sa.text("UPDATE FindingEntries SET severity = severity_other WHERE LOWER(severity) = 'other'"))
+    op.execute(sa.text(f"UPDATE FindingEntries SET field_values = {_field_values_sql()}"))
+    with op.batch_alter_table("FindingEntries") as batch_op:
+        batch_op.alter_column("field_values", existing_type=sa.JSON(), nullable=False)
+        for column in _OLD_COLUMNS:
+            batch_op.drop_column(column)
+
+
+def _field_values_sql() -> str:
+    """
+    Build the dialect's SQL expression for a JSON object of harm type and description, leaving out NULL values.
+
+    Returns:
+        str: The SQL expression.
+    """
+    if op.get_context().dialect.name == "mssql":
+        return (
+            f"JSON_MODIFY(JSON_MODIFY(N'{{}}', '$.harm_type', {_HARM_TYPE_SQL}), '$.description', {_DESCRIPTION_SQL})"
+        )
+    return f"json_patch('{{}}', json_object('harm_type', {_HARM_TYPE_SQL}, 'description', {_DESCRIPTION_SQL}))"
+
+
+def downgrade() -> None:
+    """
+    Restore the classification columns and checks only when no findings exist.
+
+    Raises:
+        ValueError: If the downgrade is offline or findings would be lost.
+    """
+    if op.get_context().as_sql:
+        raise ValueError("Finding downgrade requires online data validation.")
+    if op.get_bind().execute(sa.text("SELECT COUNT(*) FROM FindingEntries")).scalar():
+        raise ValueError("Remove retained findings explicitly before downgrading.")
+    with op.batch_alter_table("FindingEntries") as batch_op:
+        batch_op.add_column(sa.Column("description", sa.Unicode(), nullable=False))
+        for column in _OLD_COLUMNS[1:]:
+            batch_op.add_column(sa.Column(column, sa.Unicode(), nullable=True))
+        batch_op.alter_column("severity", existing_type=_SEVERITY_TYPE, type_=sa.String(32), existing_nullable=False)
+        batch_op.drop_column("field_values")
+        for name, condition in _CHECKS.items():
+            batch_op.create_check_constraint(name, condition)
diff --git a/pyrit/memory/memory_models.py b/pyrit/memory/memory_models.py
index a693c7d71b..33cabd6639 100644
--- a/pyrit/memory/memory_models.py
+++ b/pyrit/memory/memory_models.py
@@ -16,7 +16,6 @@
     INTEGER,
     JSON,
     Boolean,
-    CheckConstraint,
     Computed,
     DateTime,
     Float,
@@ -84,7 +83,6 @@
     TargetIdentifier,
     scorable_from_dict,
 )
-from pyrit.models.harm_category import HarmCategory
 from pyrit.models.operation import operation_name_key
 from pyrit.models.results.attack_result import normalize_legacy_attack_attribution
 
@@ -295,36 +293,18 @@ class FindingEntry(Base):
     """A saved finding, kept separate from scores and attack results."""
 
     __tablename__ = "FindingEntries"
-    # Harm types are deliberately unconstrained: HarmCategory changes over time, so reads map unknown values instead.
-    __table_args__ = (
-        Index("ix_FindingEntries_operation_id", "operation_id"),
-        CheckConstraint(
-            "severity IN ('critical', 'important', 'moderate', 'low', 'informational', 'other')",
-            name="ck_findings_severity",
-        ),
-        CheckConstraint(
-            "(severity = 'other' AND severity_other IS NOT NULL AND LTRIM(RTRIM(severity_other)) <> '') "
-            "OR (severity <> 'other' AND severity_other IS NULL)",
-            name="ck_findings_severity_other",
-        ),
-        CheckConstraint(
-            "(harm_type IS NOT NULL AND harm_type = 'Other' AND harm_type_other IS NOT NULL "
-            "AND LTRIM(RTRIM(harm_type_other)) <> '') "
-            "OR ((harm_type IS NULL OR harm_type <> 'Other') AND harm_type_other IS NULL)",
-            name="ck_findings_harm_type_other",
-        ),
-    )
+    __table_args__ = (Index("ix_FindingEntries_operation_id", "operation_id"),)
 
     id: Mapped[uuid.UUID] = mapped_column(CustomUUID, primary_key=True)
     operation_id: Mapped[uuid.UUID] = mapped_column(
         CustomUUID, ForeignKey(f"{OperationEntry.__tablename__}.id"), nullable=False
     )
     title: Mapped[str] = mapped_column(Unicode, nullable=False)
-    description: Mapped[str] = mapped_column(Unicode, nullable=False)
-    severity: Mapped[str] = mapped_column(String(32), nullable=False)
-    severity_other: Mapped[str | None] = mapped_column(Unicode, nullable=True)
-    harm_type: Mapped[str | None] = mapped_column(Unicode, nullable=True)
-    harm_type_other: Mapped[str | None] = mapped_column(Unicode, nullable=True)
+    # Binary collation makes SQL Server sort and count severities exactly, as SQLite does.
+    severity: Mapped[str] = mapped_column(
+        Unicode().with_variant(Unicode(collation="Latin1_General_100_BIN2"), "mssql"), nullable=False
+    )
+    field_values: Mapped[dict[str, str]] = mapped_column(JSON, nullable=False)
     created_at: Mapped[datetime] = mapped_column(UTCDateTime, nullable=False)
 
     def __init__(self, finding: Finding) -> None:
@@ -333,37 +313,23 @@ def __init__(self, finding: Finding) -> None:
         self.id = validated.id
         self.operation_id = validated.operation_id
         self.title = validated.title
-        self.description = validated.description
-        self.severity = validated.severity.value
-        self.severity_other = validated.severity_other
-        self.harm_type = validated.harm_type.value if validated.harm_type is not None else None
-        self.harm_type_other = validated.harm_type_other
+        self.severity = validated.severity
+        self.field_values = dict(validated.field_values)
         self.created_at = validated.created_at.astimezone(UTC)
 
     def get_finding(self) -> Finding:
         """
         Rebuild the finding model.
 
-        A stored harm type that is no longer a ``HarmCategory`` maps through its aliases, or to
-        Other with the stored text, rather than making the finding unreadable.
-
         Returns:
             Finding: The stored finding.
         """
-        harm_type, harm_type_other = self.harm_type, self.harm_type_other
-        if harm_type is not None and harm_type not in set(HarmCategory):
-            # parse() logs a warning when it falls back to Other.
-            parsed = HarmCategory.parse(harm_type)
-            harm_type, harm_type_other = parsed, harm_type if parsed == HarmCategory.OTHER else None
         return Finding(
             id=self.id,
             operation_id=self.operation_id,
             title=self.title,
-            description=self.description,
             severity=self.severity,
-            severity_other=self.severity_other,
-            harm_type=harm_type,
-            harm_type_other=harm_type_other,
+            field_values=self.field_values,
             created_at=self.created_at,
         )
 
diff --git a/pyrit/models/__init__.py b/pyrit/models/__init__.py
index 9415a50a99..8aca6abb6b 100644
--- a/pyrit/models/__init__.py
+++ b/pyrit/models/__init__.py
@@ -73,7 +73,7 @@
     from pyrit.models.conversation_stats import ConversationStats
     from pyrit.models.conversation_summary import ConversationSummary
     from pyrit.models.embeddings import EmbeddingData, EmbeddingResponse, EmbeddingSupport, EmbeddingUsageInformation
-    from pyrit.models.finding import Finding, FindingCreate, FindingEvidence, FindingSeverity
+    from pyrit.models.finding import Finding, FindingCreate, FindingEvidence
     from pyrit.models.finding_fields import (
         DEFAULT_FINDING_FIELDS,
         FindingField,
@@ -449,7 +449,6 @@
     "Finding": "pyrit.models.finding",
     "FindingCreate": "pyrit.models.finding",
     "FindingEvidence": "pyrit.models.finding",
-    "FindingSeverity": "pyrit.models.finding",
     "DEFAULT_FINDING_FIELDS": "pyrit.models.finding_fields",
     "FindingField": "pyrit.models.finding_fields",
     "FindingFields": "pyrit.models.finding_fields",
diff --git a/pyrit/models/finding.py b/pyrit/models/finding.py
index 09563386b3..0fa2a9c2d8 100644
--- a/pyrit/models/finding.py
+++ b/pyrit/models/finding.py
@@ -2,24 +2,9 @@
 # Licensed under the MIT license.
 
 from datetime import UTC, datetime
-from enum import Enum
-from typing import Self
 from uuid import UUID, uuid4
 
-from pydantic import AwareDatetime, BaseModel, ConfigDict, Field, field_validator, model_validator
-
-from pyrit.models.harm_category import HarmCategory
-
-
-class FindingSeverity(str, Enum):
-    """Operator-selected severity, ordered from highest to lowest."""
-
-    CRITICAL = "critical"
-    IMPORTANT = "important"
-    MODERATE = "moderate"
-    LOW = "low"
-    INFORMATIONAL = "informational"
-    OTHER = "other"
+from pydantic import AwareDatetime, BaseModel, ConfigDict, Field, field_validator
 
 
 class FindingCreate(BaseModel):
@@ -28,39 +13,14 @@ class FindingCreate(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
     title: str
-    description: str = ""
-    severity: FindingSeverity
-    severity_other: str | None = None
-    harm_type: HarmCategory | None = None
-    harm_type_other: str | None = None
-
-    @model_validator(mode="after")
-    def _validate_classifications(self) -> Self:
-        """
-        Require custom text only for an Other selection.
-
-        Returns:
-            Self: The validated finding.
+    severity: str
+    field_values: dict[str, str] = {}
 
-        Raises:
-            ValueError: If custom text is missing, blank, or has no Other selection.
-        """
-        for field, is_other, text in [
-            ("severity", self.severity == FindingSeverity.OTHER, self.severity_other),
-            ("harm_type", self.harm_type == HarmCategory.OTHER, self.harm_type_other),
-        ]:
-            if is_other:
-                if text is None or not text.strip():
-                    raise ValueError(f"{field}_other must not be blank when {field} is Other.")
-            elif text is not None:
-                raise ValueError(f"{field}_other is only allowed when {field} is Other.")
-        return self
-
-    @field_validator("title")
+    @field_validator("title", "severity")
     @classmethod
     def _reject_blank(cls, value: str) -> str:
         """
-        Reject a blank title without normalizing its contents.
+        Reject blank text without normalizing its contents.
 
         Returns:
             str: The original value.
@@ -72,6 +32,17 @@ def _reject_blank(cls, value: str) -> str:
             raise ValueError("Must not be blank.")
         return value
 
+    @field_validator("field_values")
+    @classmethod
+    def _drop_blank_values(cls, value: dict[str, str]) -> dict[str, str]:
+        """
+        Drop empty and whitespace-only values, keeping other text exactly as entered.
+
+        Returns:
+            dict[str, str]: The non-blank values.
+        """
+        return {key: text for key, text in value.items() if text.strip()}
+
 
 class Finding(FindingCreate):
     """A saved finding in one operation."""
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index b87fd81a66..c631e11d9e 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -139,7 +139,7 @@ def test_findings_are_created_and_listed_under_an_operation(compatibility_header
     assert created.status_code == 201
     finding = created.json()
     assert finding["operation_id"] == operation_id
-    assert finding["description"] == ""
+    assert finding["field_values"] == {}
     client.post(f"/api/operations/{other_id}/findings", json={"title": "Elsewhere", "severity": "low"})
     listed = client.get(f"/api/operations/{operation_id}/findings", params={"limit": 1}).json()
     assert listed == {"items": [{**finding, "evidence_count": 0}], "has_more": False, "next_offset": None}
@@ -165,39 +165,34 @@ def test_finding_options_exposes_canonical_harm_types(compatibility_headers: dic
     assert TestClient(app).get("/api/operations/finding-options").status_code != 200
 
 
-def test_finding_api_round_trips_optional_and_custom_classifications(compatibility_headers: dict[str, str]) -> None:
+def test_finding_api_round_trips_field_values_and_drops_blanks(compatibility_headers: dict[str, str]) -> None:
     client = TestClient(app, headers=compatibility_headers)
-    operation_id = client.post("/api/operations", json={"name": "Classifications"}).json()["id"]
+    operation_id = client.post("/api/operations", json={"name": "Field values"}).json()["id"]
     path = f"/api/operations/{operation_id}/findings"
     body = {
         "title": "Custom",
-        "severity": "other",
-        "severity_other": "  Team severity  ",
-        "harm_type": "Other",
-        "harm_type_other": "  Team harm  ",
+        "severity": "  Team severity  ",
+        "field_values": {"harm_type": "Malware", "description": " "},
     }
     response = client.post(path, json=body)
     assert response.status_code == 201
     finding = response.json()
-    assert {key: finding[key] for key in body} == body
+    assert finding["severity"] == "  Team severity  "
+    assert finding["field_values"] == {"harm_type": "Malware"}
     assert client.get(path).json()["items"] == [{**finding, "evidence_count": 0}]
-    updated = client.put(f"{path}/{finding['id']}", json={"title": "Edited", "severity": "low", "harm_type": "Malware"})
+    updated = client.put(f"{path}/{finding['id']}", json={"title": "Edited", "severity": "low"})
     assert updated.status_code == 200
-    assert updated.json()["harm_type"] == "Malware"
-    assert updated.json()["severity_other"] is None
-    assert updated.json()["harm_type_other"] is None
+    assert updated.json()["field_values"] == {}
     assert updated.json()["id"] == finding["id"]
     assert updated.json()["created_at"] == finding["created_at"]
     for invalid in [
-        {"severity": "other"},
-        {"severity": "low", "severity_other": "Stray"},
-        {"severity": "low", "harm_type": "Other"},
-        {"severity": "low", "harm_type": "Unknown"},
+        {"severity": " "},
+        {"severity": "low", "harm_type": "Malware"},
+        {"severity": "low", "field_values": {"harm_type": 3}},
     ]:
         assert client.post(path, json={"title": "Invalid", **invalid}).status_code == 422
         assert client.put(f"{path}/{finding['id']}", json={"title": "Invalid", **invalid}).status_code == 422
-    cleared = client.put(f"{path}/{finding['id']}", json={"title": "No harm type", "severity": "moderate"})
-    assert cleared.json()["harm_type"] is None
+    assert client.get(path).json()["items"] == [{**updated.json(), "evidence_count": 0}]
 
 
 def test_findings_require_an_existing_operation(compatibility_headers: dict[str, str]) -> None:
@@ -274,7 +269,8 @@ def test_finding_create_saves_nothing_when_its_evidence_cannot_be_linked(
         ("/api/operations", {"name": " "}),
         ("/api/operations", {"name": "😀" * 65}),
         ("findings", {"title": "", "severity": "low"}),
-        ("findings", {"title": "Assessment", "severity": "urgent"}),
+        ("findings", {"title": "Assessment", "severity": " "}),
+        ("findings", {"title": "Assessment", "severity": "low", "description": "x"}),
         ("findings", {"title": "Assessment", "severity": "low", "operation": "Case"}),
     ],
 )
@@ -306,9 +302,16 @@ def test_finding_update_and_delete_preserve_identity_and_operation(
     path = f"/api/operations/{operation['id']}/findings"
     original = client.post(path, json={"title": "Original", "severity": "low"}).json()
     finding_path = f"{path}/{original['id']}"
-    edited = client.put(finding_path, json={"title": "Edited", "severity": "critical", "description": "Notes"})
+    edited = client.put(
+        finding_path, json={"title": "Edited", "severity": "critical", "field_values": {"description": "Notes"}}
+    )
     assert edited.status_code == 200
-    assert edited.json() == {**original, "title": "Edited", "severity": "critical", "description": "Notes"}
+    assert edited.json() == {
+        **original,
+        "title": "Edited",
+        "severity": "critical",
+        "field_values": {"description": "Notes"},
+    }
     assert client.get(path).json()["items"] == [{**edited.json(), "evidence_count": 0}]
     deleted = client.delete(finding_path)
     assert deleted.status_code == 204
@@ -335,7 +338,8 @@ def test_finding_mutations_reject_wrong_operations_and_invalid_fields(
     finding_path = f"{path}/{original['id']}"
     for invalid in [
         {**body, "title": " "},
-        {**body, "severity": "urgent"},
+        {"title": "Assessment", "severity": " "},
+        {"title": "Assessment", "severity": "low", "description": "x"},
         {**body, "operation_id": other_id},
         {**body, "created_at": original["created_at"]},
     ]:
diff --git a/tests/unit/memory/test_finding_field_values_migration.py b/tests/unit/memory/test_finding_field_values_migration.py
new file mode 100644
index 0000000000..0042d39573
--- /dev/null
+++ b/tests/unit/memory/test_finding_field_values_migration.py
@@ -0,0 +1,185 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import importlib
+import io
+import json
+import re
+from pathlib import Path
+
+import pytest
+import sqlalchemy as sa
+from alembic import command
+from alembic.config import Config
+from alembic.migration import MigrationContext
+from alembic.operations import Operations
+from sqlalchemy.dialects import mssql, sqlite
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.schema import CreateTable
+
+from pyrit.memory.memory_models import FindingEntry
+from pyrit.memory.migration import check_schema_migrations
+
+PREVIOUS_REVISION = "c8d3e5f7a901"
+REVISION = "d43b1bcf9c56"
+CHECKS = ("ck_findings_severity", "ck_findings_severity_other", "ck_findings_harm_type_other")
+OPERATION_ID = "00000000-0000-0000-0000-000000000001"
+ATTACK_ID = "00000000-0000-0000-0000-0000000000aa"
+A, B, C, D = (f"00000000-0000-0000-0000-00000000010{number}" for number in range(1, 5))
+STAMP = "2026-10-09 12:00:00"
+
+
+def _config_for(connection: sa.Connection) -> Config:
+    config = Config()
+    config.set_main_option("script_location", str(Path(__file__).resolve().parents[3] / "pyrit" / "memory" / "alembic"))
+    config.attributes["connection"] = connection
+    config.attributes["version_table"] = "pyrit_memory_alembic_version"
+    return config
+
+
+def _migration():
+    return importlib.import_module("pyrit.memory.alembic.versions.d43b1bcf9c56_store_finding_field_values")
+
+
+def _columns(inspector: sa.Inspector, table: str) -> list[tuple[str, str, bool]]:
+    return [(c["name"], str(c["type"]), c["nullable"]) for c in inspector.get_columns(table)]
+
+
+def _insert_operation(connection: sa.Connection) -> None:
+    connection.execute(
+        sa.text(
+            "INSERT INTO OperationEntries (id, name, name_key, created_at, description) "
+            "VALUES (:id, 'Contoso review', 'contoso review', :stamp, '')"
+        ),
+        {"id": OPERATION_ID, "stamp": STAMP},
+    )
+
+
+def _insert_finding(*, connection: sa.Connection, **values: str) -> None:
+    row = {"operation_id": OPERATION_ID, "title": "Contoso finding", "created_at": STAMP, **values}
+    connection.execute(
+        sa.text(f"INSERT INTO FindingEntries ({', '.join(row)}) VALUES ({', '.join(f':{name}' for name in row)})"),
+        row,
+    )
+
+
+def test_upgrade_moves_existing_findings_into_field_values() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config_for(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            _insert_operation(connection)
+            _insert_finding(connection=connection, id=A, severity="important", description="")
+            _insert_finding(
+                connection=connection,
+                id=B,
+                severity="other",
+                severity_other="Sev 2.5",
+                harm_type="Other",
+                harm_type_other="Model theft",
+                description="Steps to reproduce",
+            )
+            connection.execute(
+                sa.text(
+                    "INSERT INTO FindingEvidenceEntries (id, finding_id, attack_result_id, attached_at) "
+                    "VALUES ('00000000-0000-0000-0000-000000000201', :finding_id, :attack_id, :stamp)"
+                ),
+                {"finding_id": B, "attack_id": ATTACK_ID, "stamp": STAMP},
+            )
+            _insert_finding(connection=connection, id=C, severity="low", harm_type="Jailbreak", description="   ")
+            _insert_finding(connection=connection, id=D, severity="critical", description='Quote " and \\ backslash')
+
+            command.upgrade(config, REVISION)
+
+            rows = {
+                finding_id: (severity, json.loads(field_values))
+                for finding_id, severity, field_values in connection.execute(
+                    sa.text("SELECT id, severity, field_values FROM FindingEntries")
+                )
+            }
+            assert rows == {
+                A: ("important", {}),
+                B: ("Sev 2.5", {"harm_type": "Model theft", "description": "Steps to reproduce"}),
+                C: ("low", {"harm_type": "Jailbreak"}),
+                D: ("critical", {"description": 'Quote " and \\ backslash'}),
+            }
+            evidence_rows = [
+                tuple(row)
+                for row in connection.execute(
+                    sa.text("SELECT finding_id, attack_result_id FROM FindingEvidenceEntries")
+                )
+            ]
+            assert evidence_rows == [(B, ATTACK_ID)]
+        check_schema_migrations(engine=engine)
+    finally:
+        engine.dispose()
+
+
+def test_upgrade_drops_the_finding_check_constraints() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            command.upgrade(_config_for(connection), REVISION)
+            _insert_operation(connection)
+            _insert_finding(connection=connection, id=A, severity="sev1", field_values='{"category": "x"}')
+            assert connection.execute(sa.text("SELECT severity, field_values FROM FindingEntries")).one() == (
+                "sev1",
+                '{"category": "x"}',
+            )
+    finally:
+        engine.dispose()
+
+
+def test_downgrade_restores_the_old_columns_only_without_findings() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config_for(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            columns = sorted(_columns(sa.inspect(connection), "FindingEntries"))
+            command.upgrade(config, REVISION)
+            command.downgrade(config, PREVIOUS_REVISION)
+            assert sorted(_columns(sa.inspect(connection), "FindingEntries")) == columns
+            with pytest.raises(IntegrityError, match="CHECK"):
+                _insert_finding(connection=connection, id=A, severity="urgent", description="")
+
+            command.upgrade(config, REVISION)
+            _insert_operation(connection)
+            _insert_finding(connection=connection, id=A, severity="low", field_values="{}")
+            with pytest.raises(ValueError, match="findings"):
+                command.downgrade(config, PREVIOUS_REVISION)
+            assert connection.scalar(sa.text("SELECT id FROM FindingEntries")) == A
+    finally:
+        engine.dispose()
+
+
+def test_downgrade_refuses_offline() -> None:
+    context = MigrationContext.configure(dialect_name="mssql", opts={"as_sql": True, "output_buffer": io.StringIO()})
+    with Operations.context(context), pytest.raises(ValueError, match="online"):
+        _migration().downgrade()
+
+
+def test_upgrade_compiles_for_sql_server() -> None:
+    output = io.StringIO()
+    context = MigrationContext.configure(dialect_name="mssql", opts={"as_sql": True, "output_buffer": output})
+    with Operations.context(context):
+        _migration().upgrade()
+    ddl = output.getvalue()
+    assert _migration().down_revision == "c8d3e5f7a901"
+    for name in CHECKS:
+        assert f"DROP CONSTRAINT {name}" in ddl
+    drops = [match.start() for match in re.finditer("DROP CONSTRAINT", ddl)]
+    assert len(drops) == 3 and max(drops) < ddl.index("ALTER COLUMN severity")
+    assert "COLLATE Latin1_General_100_BIN2" in ddl
+    assert "JSON_MODIFY" in ddl
+    for column in ("description", "severity_other", "harm_type", "harm_type_other"):
+        assert f"DROP COLUMN {column}" in ddl
+
+
+def test_finding_severity_is_binary_collated_only_on_sql_server() -> None:
+    table = FindingEntry.__table__
+    assert "severity NVARCHAR(max) COLLATE Latin1_General_100_BIN2 NOT NULL" in str(
+        CreateTable(table).compile(dialect=mssql.dialect())
+    )
+    assert "COLLATE" not in str(CreateTable(table).compile(dialect=sqlite.dialect()))
diff --git a/tests/unit/memory/test_findings.py b/tests/unit/memory/test_findings.py
index 45958f993a..85dd032e9c 100644
--- a/tests/unit/memory/test_findings.py
+++ b/tests/unit/memory/test_findings.py
@@ -9,7 +9,7 @@
 
 import pytest
 from pydantic import ValidationError
-from sqlalchemy import func, insert, select
+from sqlalchemy import func, select
 from sqlalchemy.dialects import mssql
 from sqlalchemy.engine import ScalarResult
 from sqlalchemy.exc import IntegrityError
@@ -25,7 +25,6 @@
     ScoreEntry,
 )
 from pyrit.models import Finding, FindingCreate, FindingEvidence, Operation
-from pyrit.models.harm_category import HarmCategory
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
@@ -125,34 +124,14 @@ async def test_operation_identity_follows_casefold_not_database_collation(
     assert len(await sqlite_instance.get_operations_async()) == (1 if same else 2)
 
 
-@pytest.mark.parametrize(
-    ("stored", "harm_type", "harm_type_other"),
-    [("Malwar", HarmCategory.OTHER, "Malwar"), ("malware", HarmCategory.MALWARE, None)],
-)
-async def test_unknown_stored_harm_type_stays_readable(
-    sqlite_instance: SQLiteMemory,
-    caplog: pytest.LogCaptureFixture,
-    stored: str,
-    harm_type: HarmCategory,
-    harm_type_other: str | None,
-) -> None:
-    operation = await sqlite_instance.add_operation_async(Operation(name="Written elsewhere"))
-    with sqlite_instance.engine.begin() as connection:
-        connection.execute(
-            insert(FindingEntry).values(
-                id=uuid4(),
-                operation_id=operation.id,
-                title="Stored outside PyRIT",
-                description="",
-                severity="low",
-                harm_type=stored,
-                created_at=datetime.now(UTC),
-            )
-        )
-    with caplog.at_level("WARNING"):
-        [finding] = await sqlite_instance.get_findings_async(operation_id=operation.id)
-    assert (finding.harm_type, finding.harm_type_other) == (harm_type, harm_type_other)
-    assert ("Unknown harm category 'Malwar'" in caplog.text) is (harm_type_other is not None)
+async def test_stored_field_values_read_back_unchanged(sqlite_instance: SQLiteMemory) -> None:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Retired values"))
+    field_values = {"harm_type": "Not a current category", "retired_key": "kept"}
+    saved = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=operation.id, title="Stored", severity="low", field_values=field_values)
+    )
+    read = await sqlite_instance.get_finding_async(operation_id=operation.id, finding_id=saved.id)
+    assert read.field_values == field_values
 
 
 async def test_findings_paginate_within_one_operation(sqlite_instance: SQLiteMemory) -> None:
@@ -215,58 +194,43 @@ async def test_update_finding_preserves_identity_and_reorders_severity(sqlite_in
     updated = await sqlite_instance.update_finding_async(
         operation_id=operation.id,
         finding_id=original.id,
-        request=FindingCreate(title="Edited", severity="critical", description="Notes"),
+        request=FindingCreate(title="Edited", severity="critical", field_values={"description": "Notes"}),
     )
     assert updated.id == original.id
     assert updated.operation_id == original.operation_id
     assert updated.created_at == original.created_at
     assert updated.title == "Edited"
-    assert updated.description == "Notes"
+    assert updated.field_values == {"description": "Notes"}
     assert [finding.title for finding in await sqlite_instance.get_findings_async(severity_order=SEVERITY_ORDER)] == [
         "Edited",
         "Other",
     ]
 
 
-async def test_finding_classifications_persist_and_clear_without_losing_evidence(sqlite_instance: SQLiteMemory) -> None:
-    operation = await sqlite_instance.add_operation_async(Operation(name="Classifications"))
-    original = Finding.model_validate(
-        {
-            "operation_id": operation.id,
-            "title": "Custom",
-            "severity": "other",
-            "severity_other": "  Review needed  ",
-            "harm_type": "Other",
-            "harm_type_other": "  Team harm  ",
-        }
+async def test_update_finding_replaces_field_values_without_losing_evidence(sqlite_instance: SQLiteMemory) -> None:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Field values"))
+    original = Finding(operation_id=operation.id, title="Values", severity="low", field_values={"a": "1", "b": "2"})
+    saved = await sqlite_instance.add_finding_async(
+        finding=original, evidence=FindingEvidence(finding_id=original.id, attack_result_id=uuid4())
     )
-    saved = await sqlite_instance.add_finding_async(finding=original)
     assert saved == original
-    evidence = FindingEvidence(finding_id=saved.id, attack_result_id=uuid4())
-    await sqlite_instance.add_finding_evidence_async(evidence=evidence)
-    read = await sqlite_instance.get_finding_async(operation_id=operation.id, finding_id=saved.id)
-    assert read == original
     updated = await sqlite_instance.update_finding_async(
         operation_id=operation.id,
         finding_id=saved.id,
-        request=FindingCreate(title="Canonical", severity="important", harm_type="Malware"),
-    )
-    assert updated.id == saved.id
-    assert updated.created_at == saved.created_at
-    assert updated.severity_other is None
-    assert updated.harm_type.value == "Malware"
-    assert updated.harm_type_other is None
-    cleared = await sqlite_instance.update_finding_async(
-        operation_id=operation.id, finding_id=saved.id, request=FindingCreate(title="Optional", severity="low")
+        request=FindingCreate(title="Values", severity="low", field_values={"a": "1"}),
     )
-    assert cleared.harm_type is None
-    assert await sqlite_instance.get_finding_evidence_async(finding_id=saved.id, limit=20, offset=0) == [evidence]
+    assert (updated.id, updated.created_at) == (saved.id, saved.created_at)
+    read = await sqlite_instance.get_finding_async(operation_id=operation.id, finding_id=saved.id)
+    assert read.field_values == {"a": "1"}
+    assert await sqlite_instance.get_finding_evidence_counts_async(finding_ids=[saved.id]) == {saved.id: 1}
 
 
 async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteMemory) -> None:
     operation = await sqlite_instance.add_operation_async(Operation(name="Order"))
     stamp = datetime(2026, 10, 9, tzinfo=UTC)
-    for number, severity in enumerate(["other", "informational", "low", "moderate", "important", "critical"], start=1):
+    for number, severity in enumerate(
+        ["Sev 2.5", "informational", "low", "moderate", "important", "critical"], start=1
+    ):
         await sqlite_instance.add_finding_async(
             finding=Finding.model_validate(
                 {
@@ -275,7 +239,6 @@ async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteM
                     "operation_id": operation.id,
                     "title": severity,
                     "severity": severity,
-                    "severity_other": "Critical" if severity == "other" else None,
                 }
             )
         )
@@ -285,7 +248,7 @@ async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteM
         "moderate",
         "low",
         "informational",
-        "other",
+        "Sev 2.5",
     ]
 
 
diff --git a/tests/unit/memory/test_operations_and_findings_migration.py b/tests/unit/memory/test_operations_and_findings_migration.py
index c9b0299cda..d8153542b8 100644
--- a/tests/unit/memory/test_operations_and_findings_migration.py
+++ b/tests/unit/memory/test_operations_and_findings_migration.py
@@ -19,7 +19,6 @@
 
 from pyrit.memory.memory_models import (
     AttackResultEntry,
-    FindingEntry,
     FindingEvidenceEntry,
     OperationEntry,
     ScenarioResultEntry,
@@ -30,6 +29,24 @@
 REVISION = "c8d3e5f7a901"
 TABLES = {"OperationEntries", "FindingEntries", "FindingEvidenceEntries"}
 ACTIVITY_TABLES = ("AttackResultEntries", "ScenarioResultEntries")
+# FindingEntry models the head revision, which no longer has the #3066 finding columns.
+FINDINGS = sa.table(
+    "FindingEntries",
+    *(
+        sa.column(name)
+        for name in (
+            "id",
+            "operation_id",
+            "title",
+            "description",
+            "severity",
+            "severity_other",
+            "harm_type",
+            "harm_type_other",
+            "created_at",
+        )
+    ),
+)
 
 
 def _config_for(connection: sa.Connection) -> Config:
@@ -65,6 +82,7 @@ def test_migration_adds_tables_without_changing_existing_ones() -> None:
             assert {name: columns for name, columns in after.items() if name not in ACTIVITY_TABLES} == {
                 name: columns for name, columns in existing.items() if name not in ACTIVITY_TABLES
             }
+            command.upgrade(config, "head")
         check_schema_migrations(engine=engine)
     finally:
         engine.dispose()
@@ -128,28 +146,28 @@ def test_migration_enforces_unique_evidence_source() -> None:
     ],
 )
 def test_migration_rejects_inconsistent_finding_classifications(invalid: dict[str, str]) -> None:
-    valid = {"title": "Finding", "description": "", "severity": "low", "created_at": datetime.now(UTC)}
+    valid = {"title": "Finding", "description": "", "severity": "low", "created_at": "2026-10-09 12:00:00"}
     engine = sa.create_engine("sqlite:///:memory:")
     try:
         with engine.begin() as connection:
             command.upgrade(_config_for(connection), REVISION)
-            insert = sa.insert(FindingEntry)
-            connection.execute(insert.values(id=uuid4(), operation_id=uuid4(), **valid))
+            insert = sa.insert(FINDINGS)
+            connection.execute(insert.values(id=str(uuid4()), operation_id=str(uuid4()), **valid))
             # Harm types are unconstrained so HarmCategory can change without a migration.
             connection.execute(
-                insert.values(id=uuid4(), operation_id=uuid4(), **valid, harm_type="Not a current category")
+                insert.values(id=str(uuid4()), operation_id=str(uuid4()), **valid, harm_type="Not a current category")
             )
             connection.execute(
                 insert.values(
-                    id=uuid4(),
-                    operation_id=uuid4(),
+                    id=str(uuid4()),
+                    operation_id=str(uuid4()),
                     **{**valid, "severity": "other", "severity_other": "Custom"},
                     harm_type="Other",
                     harm_type_other="Custom",
                 )
             )
             with pytest.raises(IntegrityError, match="CHECK"):
-                connection.execute(insert.values(id=uuid4(), operation_id=uuid4(), **{**valid, **invalid}))
+                connection.execute(insert.values(id=str(uuid4()), operation_id=str(uuid4()), **{**valid, **invalid}))
     finally:
         engine.dispose()
 
diff --git a/tests/unit/models/test_finding.py b/tests/unit/models/test_finding.py
index e334e332fb..7a5dbb39d8 100644
--- a/tests/unit/models/test_finding.py
+++ b/tests/unit/models/test_finding.py
@@ -7,79 +7,41 @@
 from pydantic import ValidationError
 
 from pyrit.models.finding import Finding, FindingCreate
-from pyrit.models.harm_category import HarmCategory
 
 OPERATION_ID = UUID(int=1)
 
 
-@pytest.mark.parametrize("severity", ["critical", "important", "moderate", "low", "informational"])
-def test_finding_round_trips_named_severity(severity: str) -> None:
-    finding = Finding(operation_id=OPERATION_ID, title="Assessment", severity=severity)
+def test_finding_round_trips_severity_and_field_values() -> None:
+    finding = Finding(
+        operation_id=OPERATION_ID, title="Assessment", severity="moderate", field_values={"harm_type": "Malware"}
+    )
     assert Finding.model_validate_json(finding.model_dump_json()) == finding
-    assert finding.description == ""
+    assert FindingCreate(title="Assessment", severity="low").field_values == {}
     assert finding.created_at.utcoffset().total_seconds() == 0
 
 
-def test_finding_round_trips_custom_classifications_without_normalizing_text() -> None:
-    finding = Finding.model_validate(
-        {
-            "operation_id": OPERATION_ID,
-            "title": "Assessment",
-            "severity": "other",
-            "severity_other": "  Team assessment  ",
-            "harm_type": "Other",
-            "harm_type_other": "  Team harm  ",
-        }
+def test_finding_drops_blank_field_values_and_keeps_other_text_exactly() -> None:
+    finding = FindingCreate(
+        title="Leak", severity="  Sev 2.5  ", field_values={"steps": "", "owner": "   ", "notes": "  kept  "}
     )
-    assert finding.severity.value == "other"
-    assert finding.severity_other == "  Team assessment  "
-    assert finding.harm_type.value == "Other"
-    assert finding.harm_type_other == "  Team harm  "
-    assert Finding.model_validate_json(finding.model_dump_json()) == finding
-
-
-def test_finding_harm_type_is_optional_and_accepts_every_canonical_category() -> None:
-    assert FindingCreate(title="Optional", severity="low").harm_type is None
-    for category in HarmCategory:
-        finding = FindingCreate.model_validate(
-            {
-                "title": "Classified",
-                "severity": "moderate",
-                "harm_type": category.value,
-                "harm_type_other": "Custom harm" if category == HarmCategory.OTHER else None,
-            }
-        )
-        assert finding.harm_type == category
+    assert finding.severity == "  Sev 2.5  "
+    assert finding.field_values == {"notes": "  kept  "}
 
 
 @pytest.mark.parametrize(
-    "fields",
+    "data",
     [
-        {"severity": "other"},
-        {"severity": "other", "severity_other": " "},
-        {"severity": "low", "severity_other": "Stray custom severity"},
-        {"harm_type": "Other"},
-        {"harm_type": "Other", "harm_type_other": " "},
-        {"harm_type": "Malware", "harm_type_other": "Stray custom harm"},
-        {"harm_type_other": "Custom without category"},
-        {"harm_type": "Unknown category"},
+        {"title": " ", "severity": "low"},
+        {"title": "Leak", "severity": " "},
+        {"title": "Leak", "severity": "low", "description": "a #3066 field"},
+        {"title": "Leak", "severity": "low", "field_values": {"steps": 3}},
     ],
 )
-def test_finding_rejects_inconsistent_classifications(fields: dict[str, str]) -> None:
+def test_finding_rejects_invalid_input(data: dict[str, object]) -> None:
     with pytest.raises(ValidationError):
-        FindingCreate.model_validate({"title": "Assessment", "severity": "low", **fields})
+        FindingCreate.model_validate(data)
 
 
-@pytest.mark.parametrize("title", ["", "  "])
-def test_finding_rejects_blank_title(title: str) -> None:
-    with pytest.raises(ValidationError):
-        FindingCreate(title=title, severity="low")
-
-
-def test_finding_rejects_unknown_input_and_requires_operation() -> None:
-    with pytest.raises(ValidationError):
-        FindingCreate(title="Assessment", severity="urgent")
-    with pytest.raises(ValidationError):
-        FindingCreate.model_validate({"title": "Assessment", "severity": "low", "operation": "Case"})
+def test_finding_requires_an_operation() -> None:
     with pytest.raises(ValidationError):
         Finding(title="Assessment", severity="low")

From 1f206df85ed8675bdbf039315209625934104b0e Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Tue, 27 Oct 2026 11:08:29 -0400
Subject: [PATCH 05/20] Check findings against the active finding fields

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/backend/models/operations.py            |   7 -
 pyrit/backend/routes/operations.py            |  32 +++--
 pyrit/backend/services/operation_service.py   |  12 ++
 tests/unit/backend/test_operations.py         | 126 +++++++++++++++++-
 tests/unit/conftest.py                        |  10 +-
 tests/unit/setup/test_finding_fields.py       |  10 +-
 .../setup/test_finding_fields_initializer.py  |  11 +-
 tests/unit/setup/test_initialization.py       |  13 +-
 8 files changed, 166 insertions(+), 55 deletions(-)

diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 4805101c5c..6062ce1f32 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -15,16 +15,9 @@
     Operation,
     OperationUsage,
 )
-from pyrit.models.harm_category import HarmCategory
 from pyrit.models.operation import OperationName
 
 
-class FindingOptionsResponse(BaseModel):
-    """Harm categories a finding can use."""
-
-    harm_types: list[HarmCategory]
-
-
 class OperationListItem(Operation):
     """An operation with its finding counts by stored severity value. Severities with no findings are omitted."""
 
diff --git a/pyrit/backend/routes/operations.py b/pyrit/backend/routes/operations.py
index 69894dcab3..610bd54158 100644
--- a/pyrit/backend/routes/operations.py
+++ b/pyrit/backend/routes/operations.py
@@ -14,7 +14,6 @@
     FindingEvidenceListResponse,
     FindingExportRequest,
     FindingListResponse,
-    FindingOptionsResponse,
     OperationDetail,
     OperationListResponse,
     OperationUpdateRequest,
@@ -29,8 +28,8 @@
     OperationService,
 )
 from pyrit.memory.memory_interface import OperationInUseError
-from pyrit.models import Finding, FindingCreate, Operation, OperationCreate
-from pyrit.models.harm_category import HarmCategory
+from pyrit.models import Finding, FindingCreate, FindingFields, FindingValuesError, Operation, OperationCreate
+from pyrit.setup.finding_fields import get_active_finding_fields
 
 T = TypeVar("T")
 
@@ -65,15 +64,15 @@ async def list_operations_async() -> OperationListResponse:
     return OperationListResponse(items=await OperationService().list_async())
 
 
-@router.get("/finding-options", response_model=FindingOptionsResponse)
-async def get_finding_options_async() -> FindingOptionsResponse:
+@router.get("/finding-fields", response_model=FindingFields)
+async def get_finding_fields_async() -> FindingFields:
     """
-    List the harm categories a finding can use.
+    Read the finding fields that this deployment's setup configured.
 
     Returns:
-        FindingOptionsResponse: Selectable categories, including Other.
+        FindingFields: The severity slot and the fields shown after it.
     """
-    return FindingOptionsResponse(harm_types=list(HarmCategory))
+    return get_active_finding_fields()
 
 
 @router.get("/{operation_id}", response_model=OperationDetail)
@@ -137,7 +136,8 @@ async def create_operation_finding_async(*, operation_id: UUID, request: Finding
         Finding: The saved finding.
 
     Raises:
-        HTTPException: 409 when the ID already belongs to a different finding.
+        HTTPException: 409 when the ID already belongs to a different finding, and 422 when the values
+            do not fit the active finding fields.
     """
     try:
         return await _require_operation_async(
@@ -145,6 +145,8 @@ async def create_operation_finding_async(*, operation_id: UUID, request: Finding
         )
     except FindingConflictError as exc:
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(exc)) from exc
+    except FindingValuesError as exc:
+        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_CONTENT, detail=str(exc)) from exc
 
 
 @router.get("/{operation_id}/findings", response_model=FindingListResponse)
@@ -191,10 +193,16 @@ async def update_operation_finding_async(*, operation_id: UUID, finding_id: UUID
 
     Returns:
         Finding: The updated finding.
+
+    Raises:
+        HTTPException: 422 when the values do not fit the active finding fields.
     """
-    return await _require_operation_async(
-        OperationService().update_finding_async(operation_id=operation_id, finding_id=finding_id, request=request)
-    )
+    try:
+        return await _require_operation_async(
+            OperationService().update_finding_async(operation_id=operation_id, finding_id=finding_id, request=request)
+        )
+    except FindingValuesError as exc:
+        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_CONTENT, detail=str(exc)) from exc
 
 
 @router.delete("/{operation_id}/findings/{finding_id}", status_code=status.HTTP_204_NO_CONTENT)
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index 4b1621b310..6c002e9843 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -163,8 +163,10 @@ async def create_finding_async(self, *, operation_id: UUID, request: FindingCrea
 
         Raises:
             FindingConflictError: If the ID already belongs to a different finding.
+            FindingValuesError: If the values do not fit the active finding fields.
         """
         await self.get_async(operation_id)
+        get_active_finding_fields().check_values(severity=request.severity, field_values=request.field_values)
         finding = Finding(
             operation_id=operation_id,
             id=request.id or uuid4(),
@@ -435,13 +437,23 @@ async def update_finding_async(self, *, operation_id: UUID, finding_id: UUID, re
         """
         Replace a finding's editable fields within an existing operation.
 
+        Values that have not changed since the last save may use fields or options that no longer exist.
+
         Returns:
             Finding: The updated finding.
 
         Raises:
             FindingNotFoundError: If the finding is missing or belongs to another operation.
+            FindingValuesError: If the values do not fit the active finding fields.
         """
         await self.get_async(operation_id)
+        stored = await self._require_finding_async(operation_id=operation_id, finding_id=finding_id)
+        get_active_finding_fields().check_values(
+            severity=request.severity,
+            field_values=request.field_values,
+            previous_severity=stored.severity,
+            previous_values=stored.field_values,
+        )
         try:
             return await CentralMemory.get_memory_instance().update_finding_async(
                 operation_id=operation_id, finding_id=finding_id, request=request
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index c631e11d9e..3147ad153a 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -18,6 +18,7 @@
 from pyrit.memory import CentralMemory, SQLiteMemory
 from pyrit.memory.memory_models import AttackResultEntry, Base, PromptMemoryEntry
 from pyrit.models import (
+    DEFAULT_FINDING_FIELDS,
     AttackOutcome,
     AttackResult,
     ComponentIdentifier,
@@ -25,17 +26,25 @@
     ConversationType,
     Finding,
     FindingEvidence,
+    FindingField,
+    FindingFields,
     Message,
     MessagePiece,
     Operation,
     Score,
 )
-from pyrit.models.harm_category import HarmCategory
+from pyrit.setup.finding_fields import set_active_finding_fields
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
 MISSING_ID = UUID(int=404)
 EMPTY_USAGE = {"findings": 0, "attacks": 0, "scenario_runs": 0}
+CONTOSO = FindingFields(
+    severity=FindingField(
+        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
+    ),
+    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
+)
 
 
 def test_operations_create_list_and_get(compatibility_headers: dict[str, str]) -> None:
@@ -156,13 +165,56 @@ def test_findings_list_highest_severity_first(compatibility_headers: dict[str, s
     assert [item["title"] for item in listed] == ["First", "Second"]
 
 
-def test_finding_options_exposes_canonical_harm_types(compatibility_headers: dict[str, str]) -> None:
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_findings_list_in_the_active_severity_order_async(
+    sqlite_instance: SQLiteMemory, compatibility_headers: dict[str, str]
+) -> None:
+    set_active_finding_fields(finding_fields=CONTOSO, source="test")
     client = TestClient(app, headers=compatibility_headers)
-    response = client.get("/api/operations/finding-options")
-    assert response.status_code == 200
-    assert response.json() == {"harm_types": [category.value for category in HarmCategory]}
-    assert response.json()["harm_types"].count("Other") == 1
-    assert TestClient(app).get("/api/operations/finding-options").status_code != 200
+    operation_id = client.post("/api/operations", json={"name": "Contoso"}).json()["id"]
+    path = f"/api/operations/{operation_id}/findings"
+    steps = {"steps": "1. Open"}
+    assert client.post(path, json={"title": "Second", "severity": "sev2", "field_values": steps}).status_code == 201
+    await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=UUID(operation_id), title="Unmatched", severity="Sev 2.5", field_values=steps)
+    )
+    assert client.post(path, json={"title": "First", "severity": "sev1", "field_values": steps}).status_code == 201
+    listed = client.get(path).json()["items"]
+    assert [item["severity"] for item in listed] == ["sev1", "sev2", "Sev 2.5"]
+
+
+@pytest.mark.usefixtures("reset_finding_fields")
+def test_finding_fields_returns_the_active_fields(compatibility_headers: dict[str, str]) -> None:
+    client = TestClient(app, headers=compatibility_headers)
+    assert FindingFields.model_validate(client.get("/api/operations/finding-fields").json()) == DEFAULT_FINDING_FIELDS
+    set_active_finding_fields(finding_fields=CONTOSO, source="test")
+    assert FindingFields.model_validate(client.get("/api/operations/finding-fields").json()) == CONTOSO
+    assert client.get("/api/operations/finding-options").status_code != 200
+    assert TestClient(app).get("/api/operations/finding-fields").status_code != 200
+
+
+@pytest.mark.usefixtures("reset_finding_fields")
+@pytest.mark.parametrize(
+    ("body", "detail"),
+    [
+        ({"severity": "sev1"}, "Steps to reproduce is required."),
+        ({"severity": "sev9", "field_values": {"steps": "1. Open"}}, "Severity has no option 'sev9'."),
+        ({"severity": "sev1", "field_values": {"steps": "1. Open", "owner": "dana"}}, "Unknown finding field 'owner'."),
+    ],
+)
+def test_finding_create_is_checked_against_the_active_fields(
+    body: dict[str, object], detail: str, compatibility_headers: dict[str, str]
+) -> None:
+    set_active_finding_fields(finding_fields=CONTOSO, source="test")
+    client = TestClient(app, headers=compatibility_headers)
+    operation_id = client.post("/api/operations", json={"name": "Contoso"}).json()["id"]
+    path = f"/api/operations/{operation_id}/findings"
+    rejected = client.post(path, json={"title": "Leak", **body})
+    assert rejected.status_code == 422
+    assert rejected.json()["detail"] == detail
+    assert client.get(path).json()["items"] == []
+    created = client.post(path, json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open"}})
+    assert created.status_code == 201
 
 
 def test_finding_api_round_trips_field_values_and_drops_blanks(compatibility_headers: dict[str, str]) -> None:
@@ -349,6 +401,66 @@ def test_finding_mutations_reject_wrong_operations_and_invalid_fields(
     assert client.get(path).json()["items"] == [{**original, "evidence_count": 0}]
 
 
+@pytest.fixture
+async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
+    """Seed a finding with a ``description`` value, then make CONTOSO, which has no such field, active."""
+    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
+    finding = await sqlite_instance.add_finding_async(
+        finding=Finding(
+            operation_id=operation.id,
+            title="Leak",
+            severity="sev1",
+            field_values={"steps": "1. Open", "description": "Old text"},
+        )
+    )
+    set_active_finding_fields(finding_fields=CONTOSO, source="test")
+    return finding
+
+
+async def test_update_keeps_an_unchanged_retired_value_async(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = retired_value_finding_async
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "Old text"}},
+    )
+    assert response.status_code == 200
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
+
+
+async def test_update_rejects_a_changed_retired_value_async(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = retired_value_finding_async
+    client = TestClient(app, headers=compatibility_headers)
+    path = f"/api/operations/{finding.operation_id}/findings"
+    body = {"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "New text"}}
+    response = client.put(f"{path}/{finding.id}", json=body)
+    assert response.status_code == 422
+    assert response.json()["detail"] == "Unknown finding field 'description'."
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
+    assert client.put(f"{path}/{MISSING_ID}", json=body).status_code == 404
+
+
+async def test_update_removes_an_omitted_retired_value_async(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = retired_value_finding_async
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open"}},
+    )
+    assert response.status_code == 200
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.field_values == {"steps": "1. Open"}
+
+
 @pytest.fixture
 async def evidence_source_async(sqlite_instance: SQLiteMemory) -> tuple[Operation, Finding, AttackResult]:
     return await _store_evidence_source_async(sqlite_instance)
diff --git a/tests/unit/conftest.py b/tests/unit/conftest.py
index 544741a1c2..d69bfdf01d 100644
--- a/tests/unit/conftest.py
+++ b/tests/unit/conftest.py
@@ -7,7 +7,7 @@
 import tempfile
 import time
 import weakref
-from collections.abc import AsyncGenerator, Generator
+from collections.abc import AsyncGenerator, Generator, Iterator
 from contextlib import closing, contextmanager
 from typing import Any
 from unittest.mock import AsyncMock, patch
@@ -22,6 +22,7 @@
 from pyrit.datasets import SeedDatasetProvider
 from pyrit.memory import CentralMemory, SQLiteMemory, migration
 from pyrit.models import SeedDataset
+from pyrit.setup.finding_fields import reset_active_finding_fields
 from test_support.fixtures import use_sqlite_memory
 
 # This limits retries and speeds up execution
@@ -171,3 +172,10 @@ def patch_central_database(sqlite_instance):
     """Fixture to mock CentralMemory.get_memory_instance"""
     with patch.object(CentralMemory, "get_memory_instance", return_value=sqlite_instance) as sqlite_memory:
         yield sqlite_memory
+
+
+@pytest.fixture
+def reset_finding_fields() -> Iterator[None]:
+    """Restore the default finding fields after the test."""
+    yield
+    reset_active_finding_fields()
diff --git a/tests/unit/setup/test_finding_fields.py b/tests/unit/setup/test_finding_fields.py
index be8dc16a04..6781f7269b 100644
--- a/tests/unit/setup/test_finding_fields.py
+++ b/tests/unit/setup/test_finding_fields.py
@@ -1,8 +1,6 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-from collections.abc import Iterator
-
 import pytest
 
 from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
@@ -12,17 +10,13 @@
     set_active_finding_fields,
 )
 
+pytestmark = pytest.mark.usefixtures("reset_finding_fields")
+
 CUSTOM = FindingFields(
     severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
 )
 
 
-@pytest.fixture(autouse=True)
-def reset_finding_fields() -> Iterator[None]:
-    yield
-    reset_active_finding_fields()
-
-
 def test_active_finding_fields_default_to_3066() -> None:
     assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
 
diff --git a/tests/unit/setup/test_finding_fields_initializer.py b/tests/unit/setup/test_finding_fields_initializer.py
index 955ffc7e4a..55da1c7b62 100644
--- a/tests/unit/setup/test_finding_fields_initializer.py
+++ b/tests/unit/setup/test_finding_fields_initializer.py
@@ -2,7 +2,6 @@
 # Licensed under the MIT license.
 
 import importlib.util
-from collections.abc import Iterator
 from pathlib import Path
 
 import pytest
@@ -11,10 +10,12 @@
 from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
 from pyrit.registry import InitializerRegistry
 from pyrit.registry.discovery import discover_in_directory
-from pyrit.setup.finding_fields import get_active_finding_fields, reset_active_finding_fields
+from pyrit.setup.finding_fields import get_active_finding_fields
 from pyrit.setup.initializers import FindingFieldsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
+pytestmark = pytest.mark.usefixtures("reset_finding_fields")
+
 EXAMPLE = FindingFields(
     severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
 )
@@ -41,12 +42,6 @@ def get_finding_fields(self) -> FindingFields:
         return EXAMPLE
 
 
-@pytest.fixture(autouse=True)
-def reset_finding_fields() -> Iterator[None]:
-    yield
-    reset_active_finding_fields()
-
-
 async def test_finding_fields_initializer_sets_the_active_fields() -> None:
     await ExampleFindingFields().initialize_async()
     assert get_active_finding_fields() is EXAMPLE
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index 2525b79883..bbb1f80356 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -5,7 +5,6 @@
 import os
 import pathlib
 import tempfile
-from collections.abc import Iterator
 from unittest import mock
 
 import pytest
@@ -18,11 +17,7 @@
 from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields, MessagePiece
 from pyrit.registry import InitializerRegistry
 from pyrit.setup import IN_MEMORY, initialization, initialize_pyrit_async
-from pyrit.setup.finding_fields import (
-    get_active_finding_fields,
-    reset_active_finding_fields,
-    set_active_finding_fields,
-)
+from pyrit.setup.finding_fields import get_active_finding_fields, set_active_finding_fields
 from pyrit.setup.initialization import reinitialize_pyrit_async
 from pyrit.setup.initializers import FindingFieldsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
@@ -460,12 +455,6 @@ async def initialize_async(self) -> None:
         set_active_finding_fields(finding_fields=CUSTOM, source="pass")
 
 
-@pytest.fixture
-def reset_finding_fields() -> Iterator[None]:
-    yield
-    reset_active_finding_fields()
-
-
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
 async def test_each_setup_pass_resets_finding_fields() -> None:
     with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):

From 4b99c8b95ae07ee18c5336aa7df0d708dbebd9f2 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Tue, 27 Oct 2026 11:17:33 -0400
Subject: [PATCH 06/20] Reject invalid finding fields during live-apply
 preflight

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/setup/configuration_loader.py       | 27 ++++++++++++-
 tests/unit/setup/test_reinitialization.py | 48 +++++++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletion(-)

diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index baf670ca3a..f8ec743ffa 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -91,6 +91,29 @@ class _ConfigurationLayer:
     reset_extensions: bool
 
 
+def _check_finding_fields_initializers(initializers: Sequence["PyRITInitializer"]) -> None:
+    """
+    Check the finding fields the initializers would set, without making them active.
+
+    Args:
+        initializers (Sequence[PyRITInitializer]): The initializers of the replacement setup pass.
+
+    Raises:
+        ValueError: If two or more initializers set the finding fields, or the one that does returns
+            invalid fields.
+    """
+    from pyrit.setup.initializers import FindingFieldsInitializer
+
+    setters = [initializer for initializer in initializers if isinstance(initializer, FindingFieldsInitializer)]
+    if len(setters) > 1:
+        first, second = (type(setter).__name__ for setter in setters[:2])
+        raise ValueError(
+            f"{first} and {second} both set the finding fields. Use one FindingFieldsInitializer per deployment."
+        )
+    if setters:
+        setters[0].get_finding_fields()
+
+
 @dataclass
 class ConfigurationLoader(YamlLoadable):
     """
@@ -706,7 +729,8 @@ async def preflight_reinitialization_async(
             PreparedReinitialization: Immutable inputs ready for the mutation phase.
 
         Raises:
-            ValueError: If an initializer is invalid or a required environment value is missing.
+            ValueError: If an initializer is invalid, a required environment value is missing, or the
+                finding fields are invalid or set by more than one initializer.
         """
         from pyrit.registry import InitializerRegistry
         from pyrit.setup.initializers.targets import TargetInitializer
@@ -744,6 +768,7 @@ async def preflight_reinitialization_async(
                 raise ValueError(
                     f"Initializer '{type(initializer).__name__}' has missing required environment variables."
                 )
+        _check_finding_fields_initializers(initializers)
 
         return PreparedReinitialization(
             environment_values=dict(environment_values),
diff --git a/tests/unit/setup/test_reinitialization.py b/tests/unit/setup/test_reinitialization.py
index d8f6129d57..29623278c2 100644
--- a/tests/unit/setup/test_reinitialization.py
+++ b/tests/unit/setup/test_reinitialization.py
@@ -15,6 +15,7 @@
 from pyrit.common.apply_defaults import get_global_default_values
 from pyrit.common.random_context import configure_random_seed, get_configured_random_seed
 from pyrit.memory import AzureSQLMemory, CentralMemory, SQLiteMemory
+from pyrit.models import DEFAULT_FINDING_FIELDS
 from pyrit.models.catalog import ScenarioSuite
 from pyrit.registry import (
     AttackRegistry,
@@ -26,6 +27,7 @@
 )
 from pyrit.setup.configuration_loader import ConfigurationLoader
 from pyrit.setup.environment_loading import resolve_environment_async
+from pyrit.setup.finding_fields import get_active_finding_fields
 from pyrit.setup.initialization import reset_setup_registries, validate_reinitialization_memory
 from pyrit.setup.initializers.targets import TARGET_CONFIGS
 
@@ -113,6 +115,52 @@ async def test_preflight_uses_isolated_registry_without_changing_live_state() ->
     assert prepared.script_initializer_types == ()
 
 
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_preflight_rejects_two_finding_fields_initializers(tmp_path: Path) -> None:
+    script = tmp_path / "two_finding_fields.py"
+    script.write_text(
+        """
+from pyrit.models import FindingField, FindingFields
+from pyrit.setup.initializers import FindingFieldsInitializer
+
+SEVERITY = FindingField(key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1")])
+
+class ContosoFindingFields(FindingFieldsInitializer):
+    def get_finding_fields(self): return FindingFields(severity=SEVERITY)
+
+class ContosoBackupFields(FindingFieldsInitializer):
+    def get_finding_fields(self): return FindingFields(severity=SEVERITY)
+""",
+        encoding="utf-8",
+    )
+    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
+
+    with pytest.raises(ValueError, match="Use one FindingFieldsInitializer per deployment"):
+        await config.preflight_reinitialization_async(environment_values={})
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_preflight_rejects_invalid_finding_fields(tmp_path: Path) -> None:
+    script = tmp_path / "invalid_finding_fields.py"
+    script.write_text(
+        """
+from pyrit.models import FindingField, FindingFields
+from pyrit.setup.initializers import FindingFieldsInitializer
+
+class ContosoFindingFields(FindingFieldsInitializer):
+    def get_finding_fields(self):
+        return FindingFields(severity=FindingField(key="severity", label="Severity", type="choice", options=[]))
+""",
+        encoding="utf-8",
+    )
+    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
+
+    with pytest.raises(ValueError, match="needs at least one option"):
+        await config.preflight_reinitialization_async(environment_values={})
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
 @pytest.mark.usefixtures("patch_central_database")
 @pytest.mark.parametrize("source", ["script", "configured"])
 async def test_apply_reconstructs_initializers_after_environment_change(tmp_path: Path, source: str) -> None:

From 1f8419f83eadc2398e275d9bfa56c4ac61034ef6 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Wed, 28 Oct 2026 14:36:18 -0400
Subject: [PATCH 07/20] Address the Council review of the finding fields
 backend

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/backend/models/operations.py            |   8 ++
 pyrit/backend/routes/operations.py            |  17 ++-
 pyrit/backend/services/operation_service.py   |  49 ++++++--
 pyrit/memory/memory_interface.py              |   2 +-
 pyrit/memory/memory_models.py                 |   2 +-
 pyrit/models/finding_fields.py                |  74 +++++++++---
 pyrit/setup/configuration_loader.py           |  25 ++--
 pyrit/setup/finding_fields.py                 |   3 +
 tests/unit/backend/test_operations.py         |  36 +++++-
 .../test_finding_field_values_migration.py    |   7 ++
 .../memory/test_operation_service_findings.py | 107 ++++++++++++++++++
 .../test_operations_and_findings_migration.py |   3 +-
 tests/unit/models/test_finding.py             |   2 +-
 tests/unit/models/test_finding_fields.py      |  59 +++++++++-
 tests/unit/setup/test_finding_fields.py       |   8 ++
 tests/unit/setup/test_reinitialization.py     |  43 ++++++-
 16 files changed, 399 insertions(+), 46 deletions(-)
 create mode 100644 tests/unit/memory/test_operation_service_findings.py

diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 6062ce1f32..65f42ba27f 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -70,6 +70,14 @@ class FindingCreateRequest(FindingCreate):
     attack_result_id: UUID | None = Field(None, description="A saved attack result to link as evidence")
 
 
+class FindingUpdateRequest(FindingCreate):
+    """A finding's new editable values, and any retired values to remove."""
+
+    remove_retired_keys: list[str] = Field(
+        default_factory=list, description="Retired values to delete from the finding"
+    )
+
+
 class FindingEvidenceCreateRequest(BaseModel):
     """The saved attack result to link."""
 
diff --git a/pyrit/backend/routes/operations.py b/pyrit/backend/routes/operations.py
index 610bd54158..510ea80e3a 100644
--- a/pyrit/backend/routes/operations.py
+++ b/pyrit/backend/routes/operations.py
@@ -14,6 +14,7 @@
     FindingEvidenceListResponse,
     FindingExportRequest,
     FindingListResponse,
+    FindingUpdateRequest,
     OperationDetail,
     OperationListResponse,
     OperationUpdateRequest,
@@ -28,7 +29,7 @@
     OperationService,
 )
 from pyrit.memory.memory_interface import OperationInUseError
-from pyrit.models import Finding, FindingCreate, FindingFields, FindingValuesError, Operation, OperationCreate
+from pyrit.models import Finding, FindingFields, FindingValuesError, Operation, OperationCreate
 from pyrit.setup.finding_fields import get_active_finding_fields
 
 T = TypeVar("T")
@@ -67,7 +68,7 @@ async def list_operations_async() -> OperationListResponse:
 @router.get("/finding-fields", response_model=FindingFields)
 async def get_finding_fields_async() -> FindingFields:
     """
-    Read the finding fields that this deployment's setup configured.
+    Read the finding fields this deployment uses.
 
     Returns:
         FindingFields: The severity slot and the fields shown after it.
@@ -130,7 +131,7 @@ async def create_operation_finding_async(*, operation_id: UUID, request: Finding
     """
     Record a finding within an operation, optionally with one saved attack result as evidence.
 
-    Retrying with the same ID and content returns the saved finding.
+    Retrying with the same ID and content returns the saved finding, as long as it still fits the active finding fields.
 
     Returns:
         Finding: The saved finding.
@@ -187,9 +188,15 @@ async def export_operation_findings_async(*, operation_id: UUID, request: Findin
 
 
 @router.put("/{operation_id}/findings/{finding_id}", response_model=Finding)
-async def update_operation_finding_async(*, operation_id: UUID, finding_id: UUID, request: FindingCreate) -> Finding:
+async def update_operation_finding_async(
+    *, operation_id: UUID, finding_id: UUID, request: FindingUpdateRequest
+) -> Finding:
     """
-    Replace the editable fields of a finding in its operation.
+    Replace a finding's current field values in its operation.
+
+    A current field left out is cleared. Values of fields that are no longer configured are kept and can't
+    change; list them in ``remove_retired_keys`` to delete them. Values that haven't changed may use options
+    that no longer exist.
 
     Returns:
         Finding: The updated finding.
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index 6c002e9843..d14876071e 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -14,6 +14,7 @@
     FindingEvidenceListResponse,
     FindingListItem,
     FindingListResponse,
+    FindingUpdateRequest,
     OperationDetail,
     OperationListItem,
     OperationUpdateRequest,
@@ -25,6 +26,8 @@
     Finding,
     FindingCreate,
     FindingEvidence,
+    FindingFields,
+    FindingValuesError,
     Operation,
     OperationCreate,
 )
@@ -433,34 +436,66 @@ async def _require_evidence_source_async(*, attack_result_id: UUID) -> None:
         if not any(stat.message_count > 0 for stat in stats.values()):
             raise FindingEvidenceNotFoundError("The attack result has no saved messages.")
 
-    async def update_finding_async(self, *, operation_id: UUID, finding_id: UUID, request: FindingCreate) -> Finding:
+    async def update_finding_async(
+        self, *, operation_id: UUID, finding_id: UUID, request: FindingUpdateRequest
+    ) -> Finding:
         """
-        Replace a finding's editable fields within an existing operation.
+        Replace a finding's current field values within an existing operation.
 
-        Values that have not changed since the last save may use fields or options that no longer exist.
+        A current field left out is cleared. Values of fields that are no longer configured are kept and can't
+        change; list them in ``remove_retired_keys`` to delete them. Values that haven't changed may use options
+        that no longer exist.
 
         Returns:
             Finding: The updated finding.
 
         Raises:
             FindingNotFoundError: If the finding is missing or belongs to another operation.
-            FindingValuesError: If the values do not fit the active finding fields.
+            FindingValuesError: If ``remove_retired_keys`` lists a key that isn't a retired value of the finding
+                or that is also sent, or the values do not fit the active finding fields.
         """
         await self.get_async(operation_id)
         stored = await self._require_finding_async(operation_id=operation_id, finding_id=finding_id)
-        get_active_finding_fields().check_values(
+        fields = get_active_finding_fields()
+        values = self._merge_retired_values(fields=fields, stored=stored, request=request)
+        fields.check_values(
             severity=request.severity,
-            field_values=request.field_values,
+            field_values=values,
             previous_severity=stored.severity,
             previous_values=stored.field_values,
         )
+        replacement = FindingCreate(title=request.title, severity=request.severity, field_values=values)
         try:
             return await CentralMemory.get_memory_instance().update_finding_async(
-                operation_id=operation_id, finding_id=finding_id, request=request
+                operation_id=operation_id, finding_id=finding_id, request=replacement
             )
         except LookupError as exc:
             raise FindingNotFoundError(str(exc)) from exc
 
+    @staticmethod
+    def _merge_retired_values(
+        *, fields: FindingFields, stored: Finding, request: FindingUpdateRequest
+    ) -> dict[str, str]:
+        """
+        Add the stored values of fields that are no longer configured to the sent values.
+
+        Returns:
+            dict[str, str]: The sent values, plus each retired value not listed in ``remove_retired_keys``.
+
+        Raises:
+            FindingValuesError: If ``remove_retired_keys`` lists a key that isn't a retired value of the finding
+                or that is also sent.
+        """
+        known = fields.field_keys
+        retired = {key: value for key, value in stored.field_values.items() if key not in known}
+        for key in request.remove_retired_keys:
+            if key not in retired:
+                raise FindingValuesError(f"{key!r} is not a retired value of this finding.")
+            if key in request.field_values:
+                raise FindingValuesError(f"{key!r} can't be both sent and removed.")
+        kept = {key: value for key, value in retired.items() if key not in request.remove_retired_keys}
+        return {**kept, **request.field_values}
+
     async def delete_finding_async(self, *, operation_id: UUID, finding_id: UUID) -> None:
         """
         Permanently remove a finding within an existing operation.
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index ca6381f859..b1354e7f71 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -1056,7 +1056,7 @@ async def get_findings_async(
             title_query (str | None): Case-insensitive text the title must contain. Wildcard characters match
                 literally. Defaults to None.
             severity_order (Sequence[str]): Severity keys from highest to lowest. Stored values that aren't listed
-                sort after them. Empty orders newest first.
+                sort after them. Defaults to an empty order, which sorts newest first.
 
         Returns:
             list[Finding]: The findings on the page.
diff --git a/pyrit/memory/memory_models.py b/pyrit/memory/memory_models.py
index 33cabd6639..0d540f8642 100644
--- a/pyrit/memory/memory_models.py
+++ b/pyrit/memory/memory_models.py
@@ -300,7 +300,7 @@ class FindingEntry(Base):
         CustomUUID, ForeignKey(f"{OperationEntry.__tablename__}.id"), nullable=False
     )
     title: Mapped[str] = mapped_column(Unicode, nullable=False)
-    # Binary collation makes SQL Server sort and count severities exactly, as SQLite does.
+    # Binary collation keeps SQL Server from merging severities that differ only in case or accents, as SQLite does.
     severity: Mapped[str] = mapped_column(
         Unicode().with_variant(Unicode(collation="Latin1_General_100_BIN2"), "mssql"), nullable=False
     )
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index ea789cf10a..f0d6e1a89e 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -215,6 +215,11 @@ def severity_order(self) -> list[str]:
         """The top-level option keys of the severity slot, from highest to lowest severity."""
         return [option.key for option in self.severity.options]
 
+    @property
+    def field_keys(self) -> frozenset[str]:
+        """The key of every field and level, except ``severity``."""
+        return frozenset(key for field in [self.severity, *self.fields] for key in _keys_of(field)) - {"severity"}
+
     @field_validator("severity")
     @classmethod
     def _validate_severity_slot(cls, value: FindingField) -> FindingField:
@@ -281,8 +286,9 @@ def check_values(
                 new finding.
 
         Raises:
-            FindingValuesError: For the first unknown key, missing required value, or value that is
-                not an option.
+            FindingValuesError: For the first unknown key, changed value of a field that is no longer
+                configured, missing required value, value that is not an option, or Other text that
+                matches an option.
         """
         previous_values = previous_values or {}
         self._check_known_keys(field_values=field_values, previous_values=previous_values)
@@ -302,10 +308,15 @@ def _check_known_keys(self, *, field_values: dict[str, str], previous_values: di
         Raises:
             FindingValuesError: If a key is unknown and its value differs from the stored one.
         """
-        known = {key for field in [self.severity, *self.fields] for key in _keys_of(field)} - {"severity"}
+        known = self.field_keys
         for key, value in field_values.items():
-            if key not in known and previous_values.get(key) != value:
-                raise FindingValuesError(f"Unknown finding field {key!r}.")
+            if key in known or previous_values.get(key) == value:
+                continue
+            if key in previous_values:
+                raise FindingValuesError(
+                    f"Finding field {key!r} is no longer configured, so its saved value can't change."
+                )
+            raise FindingValuesError(f"Unknown finding field {key!r}.")
 
 
 def _parse_options(value: Any) -> Any:
@@ -451,8 +462,8 @@ def _check_choice_values(*, field: FindingField, values: dict[str, str], previou
         previous_values (dict[str, str]): Every value of the stored finding, by key.
 
     Raises:
-        FindingValuesError: If a required dropdown with options has no value, or a value is not an
-            option and is neither unchanged nor allowed as Other text.
+        FindingValuesError: If a required dropdown with options has no value, or a changed value is
+            not an option and is not allowed as Other text.
     """
     options = field.options
     path_unchanged = True
@@ -464,12 +475,19 @@ def _check_choice_values(*, field: FindingField, values: dict[str, str], previou
             value=value,
             options=options,
             required=field.required,
-            accepts_unmatched=path_unchanged or field.allow_other,
+            unchanged=path_unchanged,
+            allow_other=field.allow_other,
         )
 
 
 def _check_level(
-    *, label: str, value: str | None, options: list[FindingFieldOption], required: bool, accepts_unmatched: bool
+    *,
+    label: str,
+    value: str | None,
+    options: list[FindingFieldOption],
+    required: bool,
+    unchanged: bool,
+    allow_other: bool,
 ) -> list[FindingFieldOption]:
     """
     Check one dropdown's value and find the options of the next dropdown.
@@ -479,24 +497,52 @@ def _check_level(
         value (str | None): The dropdown's value, or None if it is missing.
         options (list[FindingFieldOption]): The options the dropdown offers.
         required (bool): Whether the field is required.
-        accepts_unmatched (bool): Whether a value that is not an option passes.
+        unchanged (bool): Whether this value and every value above it are unchanged, so a value
+            that is not an option passes.
+        allow_other (bool): Whether the field accepts Other text.
 
     Returns:
         list[FindingFieldOption]: The children of the chosen option, or an empty list if there is
             no matching option.
 
     Raises:
-        FindingValuesError: If a required dropdown with options has no value, or the value is not
-            an option and ``accepts_unmatched`` is False.
+        FindingValuesError: If a required dropdown with options has no value, or a changed value is
+            not an option and is not allowed as Other text.
     """
     if value is None:
         if required and options:
             raise FindingValuesError(f"{label} is required.")
         return []
     match = next((option for option in options if option.key == value), None)
-    if match is None and not accepts_unmatched:
+    if match is not None:
+        return match.children
+    if not unchanged:
+        _check_other_text(label=label, value=value, options=options, allow_other=allow_other)
+    return []
+
+
+def _check_other_text(*, label: str, value: str, options: list[FindingFieldOption], allow_other: bool) -> None:
+    """
+    Accept a value that is not an option only as Other text that names no option.
+
+    Args:
+        label (str): The dropdown's label.
+        value (str): The dropdown's value.
+        options (list[FindingFieldOption]): The options the dropdown offers.
+        allow_other (bool): Whether the field accepts Other text.
+
+    Raises:
+        FindingValuesError: If the field takes no Other text, or the text matches an option's key or
+            label apart from case and surrounding spaces.
+    """
+    if not allow_other:
         raise FindingValuesError(f"{label} has no option {value!r}.")
-    return [] if match is None else match.children
+    folded = value.strip().casefold()
+    for option in options:
+        if folded in (option.key.strip().casefold(), option.label.strip().casefold()):
+            raise FindingValuesError(
+                f"{label} {value!r} matches the option {option.key!r}. Send {option.key!r} instead."
+            )
 
 
 def _non_blank(value: str | None) -> str | None:
diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index f8ec743ffa..2ceceb1f25 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -24,7 +24,7 @@
 from pyrit.common.utils import verify_and_resolve_path
 from pyrit.common.yaml_helper import safe_load_yaml
 from pyrit.common.yaml_loadable import YamlLoadable
-from pyrit.models import class_name_to_snake_case
+from pyrit.models import FindingFields, class_name_to_snake_case
 from pyrit.setup.environment_loading import validate_env_akv_strict
 from pyrit.setup.initialization import AZURE_SQL, IN_MEMORY, SQLITE, initialize_pyrit_async, reinitialize_pyrit_async
 
@@ -93,14 +93,16 @@ class _ConfigurationLayer:
 
 def _check_finding_fields_initializers(initializers: Sequence["PyRITInitializer"]) -> None:
     """
-    Check the finding fields the initializers would set, without making them active.
+    Check the finding fields that ``FindingFieldsInitializer`` subclasses would set, without making them active.
+
+    Code that calls ``set_active_finding_fields`` directly isn't checked.
 
     Args:
         initializers (Sequence[PyRITInitializer]): The initializers of the replacement setup pass.
 
     Raises:
-        ValueError: If two or more initializers set the finding fields, or the one that does returns
-            invalid fields.
+        ValueError: If two or more ``FindingFieldsInitializer`` subclasses are configured, or the configured one
+            returns invalid fields or something other than ``FindingFields``.
     """
     from pyrit.setup.initializers import FindingFieldsInitializer
 
@@ -110,8 +112,14 @@ def _check_finding_fields_initializers(initializers: Sequence["PyRITInitializer"
         raise ValueError(
             f"{first} and {second} both set the finding fields. Use one FindingFieldsInitializer per deployment."
         )
-    if setters:
-        setters[0].get_finding_fields()
+    if not setters:
+        return
+    initializer = setters[0]
+    result = initializer.get_finding_fields()
+    if not isinstance(result, FindingFields):
+        raise ValueError(
+            f"{type(initializer).__name__}.get_finding_fields() must return FindingFields, not {type(result).__name__}."
+        )
 
 
 @dataclass
@@ -729,8 +737,9 @@ async def preflight_reinitialization_async(
             PreparedReinitialization: Immutable inputs ready for the mutation phase.
 
         Raises:
-            ValueError: If an initializer is invalid, a required environment value is missing, or the
-                finding fields are invalid or set by more than one initializer.
+            ValueError: If an initializer is invalid, a required environment value is missing, more than one
+                ``FindingFieldsInitializer`` subclass is configured, or the configured one returns invalid finding
+                fields. Code that calls ``set_active_finding_fields`` directly isn't checked.
         """
         from pyrit.registry import InitializerRegistry
         from pyrit.setup.initializers.targets import TargetInitializer
diff --git a/pyrit/setup/finding_fields.py b/pyrit/setup/finding_fields.py
index 6cc4607c67..c5b22e007c 100644
--- a/pyrit/setup/finding_fields.py
+++ b/pyrit/setup/finding_fields.py
@@ -27,9 +27,12 @@ def set_active_finding_fields(*, finding_fields: FindingFields, source: str) ->
         source (str): The setter's name, which the error names when two setters run in one pass.
 
     Raises:
+        TypeError: If ``finding_fields`` is not a ``FindingFields``.
         ValueError: If finding fields were already set in this setup pass.
     """
     global _active
+    if not isinstance(finding_fields, FindingFields):
+        raise TypeError(f"{source} must set FindingFields, not {type(finding_fields).__name__}.")
     if _active is not None:
         raise ValueError(
             f"{source} cannot set the finding fields: {_active[1]} already set them in this setup pass. "
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index 3147ad153a..668a40b5e9 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -217,6 +217,16 @@ def test_finding_create_is_checked_against_the_active_fields(
     assert created.status_code == 201
 
 
+def test_finding_create_rejects_other_text_that_matches_an_option(compatibility_headers: dict[str, str]) -> None:
+    client = TestClient(app, headers=compatibility_headers)
+    operation_id = client.post("/api/operations", json={"name": "Case"}).json()["id"]
+    path = f"/api/operations/{operation_id}/findings"
+    rejected = client.post(path, json={"title": "Leak", "severity": "Critical"})
+    assert rejected.status_code == 422
+    assert rejected.json()["detail"] == "Severity 'Critical' matches the option 'critical'. Send 'critical' instead."
+    assert client.get(path).json()["items"] == []
+
+
 def test_finding_api_round_trips_field_values_and_drops_blanks(compatibility_headers: dict[str, str]) -> None:
     client = TestClient(app, headers=compatibility_headers)
     operation_id = client.post("/api/operations", json={"name": "Field values"}).json()["id"]
@@ -440,14 +450,17 @@ async def test_update_rejects_a_changed_retired_value_async(
     body = {"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "New text"}}
     response = client.put(f"{path}/{finding.id}", json=body)
     assert response.status_code == 422
-    assert response.json()["detail"] == "Unknown finding field 'description'."
+    assert (
+        response.json()["detail"]
+        == "Finding field 'description' is no longer configured, so its saved value can't change."
+    )
     stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
     assert stored is not None
     assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
     assert client.put(f"{path}/{MISSING_ID}", json=body).status_code == 404
 
 
-async def test_update_removes_an_omitted_retired_value_async(
+async def test_update_keeps_an_omitted_retired_value_async(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
 ) -> None:
     finding = retired_value_finding_async
@@ -458,6 +471,25 @@ async def test_update_removes_an_omitted_retired_value_async(
     assert response.status_code == 200
     stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
     assert stored is not None
+    assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
+
+
+async def test_update_removes_a_listed_retired_value_async(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = retired_value_finding_async
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={
+            "title": "Leak",
+            "severity": "sev1",
+            "field_values": {"steps": "1. Open"},
+            "remove_retired_keys": ["description"],
+        },
+    )
+    assert response.status_code == 200
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
     assert stored.field_values == {"steps": "1. Open"}
 
 
diff --git a/tests/unit/memory/test_finding_field_values_migration.py b/tests/unit/memory/test_finding_field_values_migration.py
index 0042d39573..6d5433ab9a 100644
--- a/tests/unit/memory/test_finding_field_values_migration.py
+++ b/tests/unit/memory/test_finding_field_values_migration.py
@@ -104,6 +104,13 @@ def test_upgrade_moves_existing_findings_into_field_values() -> None:
                 C: ("low", {"harm_type": "Jailbreak"}),
                 D: ("critical", {"description": 'Quote " and \\ backslash'}),
             }
+            kept = {
+                finding_id: (operation_id, created_at)
+                for finding_id, operation_id, created_at in connection.execute(
+                    sa.text("SELECT id, operation_id, created_at FROM FindingEntries")
+                )
+            }
+            assert kept == dict.fromkeys((A, B, C, D), (OPERATION_ID, STAMP))
             evidence_rows = [
                 tuple(row)
                 for row in connection.execute(
diff --git a/tests/unit/memory/test_operation_service_findings.py b/tests/unit/memory/test_operation_service_findings.py
new file mode 100644
index 0000000000..e33339af51
--- /dev/null
+++ b/tests/unit/memory/test_operation_service_findings.py
@@ -0,0 +1,107 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import re
+
+import pytest
+
+from pyrit.backend.models.operations import FindingUpdateRequest
+from pyrit.backend.services.operation_service import OperationService
+from pyrit.memory import SQLiteMemory
+from pyrit.models import Finding, FindingField, FindingFields, FindingValuesError, Operation
+from pyrit.setup.finding_fields import set_active_finding_fields
+
+pytestmark = pytest.mark.usefixtures("patch_central_database")
+
+CONTOSO = FindingFields(
+    severity=FindingField(
+        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
+    ),
+    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
+)
+STORED_VALUES = {"steps": "1. Open", "description": "Old text"}
+
+
+@pytest.fixture
+async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
+    """Seed a finding with a ``description`` value, then make CONTOSO, which has no such field, active."""
+    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
+    finding = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=operation.id, title="Leak", severity="sev1", field_values=STORED_VALUES)
+    )
+    set_active_finding_fields(finding_fields=CONTOSO, source="test")
+    return finding
+
+
+async def _update_async(
+    *, finding: Finding, field_values: dict[str, str], remove_retired_keys: list[str] | None = None
+) -> Finding:
+    request = FindingUpdateRequest(
+        title="Leak", severity="sev1", field_values=field_values, remove_retired_keys=remove_retired_keys or []
+    )
+    return await OperationService().update_finding_async(
+        operation_id=finding.operation_id, finding_id=finding.id, request=request
+    )
+
+
+async def _stored_values_async(*, sqlite_instance: SQLiteMemory, finding: Finding) -> dict[str, str]:
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    return stored.field_values
+
+
+async def test_update_keeps_an_omitted_retired_value(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
+) -> None:
+    finding = retired_value_finding_async
+    updated = await _update_async(finding=finding, field_values={"steps": "1. Open"})
+    assert updated.field_values == STORED_VALUES
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+
+
+async def test_update_keeps_a_blank_retired_value(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
+) -> None:
+    finding = retired_value_finding_async
+    await _update_async(finding=finding, field_values={"steps": "1. Open", "description": " "})
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+
+
+async def test_update_removes_a_listed_retired_value(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
+) -> None:
+    finding = retired_value_finding_async
+    updated = await _update_async(
+        finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=["description"]
+    )
+    assert updated.field_values == {"steps": "1. Open"}
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == {"steps": "1. Open"}
+
+
+@pytest.mark.parametrize("key", ["steps", "nonexistent"])
+async def test_update_rejects_removing_a_value_that_is_not_retired(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, key: str
+) -> None:
+    finding = retired_value_finding_async
+    with pytest.raises(FindingValuesError, match=re.escape(f"{key!r} is not a retired value of this finding.")):
+        await _update_async(finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=[key])
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+
+
+async def test_update_rejects_sending_and_removing_a_value(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
+) -> None:
+    finding = retired_value_finding_async
+    with pytest.raises(FindingValuesError, match=re.escape("'description' can't be both sent and removed.")):
+        await _update_async(finding=finding, field_values=STORED_VALUES, remove_retired_keys=["description"])
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+
+
+async def test_update_rejects_changing_a_retired_value(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
+) -> None:
+    finding = retired_value_finding_async
+    message = "Finding field 'description' is no longer configured, so its saved value can't change."
+    with pytest.raises(FindingValuesError, match=re.escape(message)):
+        await _update_async(finding=finding, field_values={"steps": "1. Open", "description": "New text"})
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
diff --git a/tests/unit/memory/test_operations_and_findings_migration.py b/tests/unit/memory/test_operations_and_findings_migration.py
index d8153542b8..423157bfd5 100644
--- a/tests/unit/memory/test_operations_and_findings_migration.py
+++ b/tests/unit/memory/test_operations_and_findings_migration.py
@@ -29,7 +29,7 @@
 REVISION = "c8d3e5f7a901"
 TABLES = {"OperationEntries", "FindingEntries", "FindingEvidenceEntries"}
 ACTIVITY_TABLES = ("AttackResultEntries", "ScenarioResultEntries")
-# FindingEntry models the head revision, which no longer has the #3066 finding columns.
+# FindingEntry models the head revision, which no longer has this revision's finding columns.
 FINDINGS = sa.table(
     "FindingEntries",
     *(
@@ -82,6 +82,7 @@ def test_migration_adds_tables_without_changing_existing_ones() -> None:
             assert {name: columns for name, columns in after.items() if name not in ACTIVITY_TABLES} == {
                 name: columns for name, columns in existing.items() if name not in ACTIVITY_TABLES
             }
+            # check_schema_migrations compares the database with the head models.
             command.upgrade(config, "head")
         check_schema_migrations(engine=engine)
     finally:
diff --git a/tests/unit/models/test_finding.py b/tests/unit/models/test_finding.py
index 7a5dbb39d8..0fb17a61f7 100644
--- a/tests/unit/models/test_finding.py
+++ b/tests/unit/models/test_finding.py
@@ -33,7 +33,7 @@ def test_finding_drops_blank_field_values_and_keeps_other_text_exactly() -> None
     [
         {"title": " ", "severity": "low"},
         {"title": "Leak", "severity": " "},
-        {"title": "Leak", "severity": "low", "description": "a #3066 field"},
+        {"title": "Leak", "severity": "low", "description": "x"},
         {"title": "Leak", "severity": "low", "field_values": {"steps": 3}},
     ],
 )
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index e3d3fdade2..83a18eb144 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -86,6 +86,12 @@ def test_severity_slot_is_required_and_ordered() -> None:
     assert CONTOSO.severity_order == ["sev1", "sev2", "sev3"]
 
 
+def test_field_keys_lists_every_field_and_level_key_except_severity() -> None:
+    assert CONTOSO.field_keys == frozenset(
+        {"severity_rationale", "category", "subcategory", "technique", "steps", "owner"}
+    )
+
+
 def test_default_finding_fields_match_3066() -> None:
     severity, (harm, description) = DEFAULT_FINDING_FIELDS.severity, DEFAULT_FINDING_FIELDS.fields
     assert DEFAULT_FINDING_FIELDS.severity_order == ["critical", "important", "moderate", "low", "informational"]
@@ -266,6 +272,14 @@ def test_check_values_accepts(
         pytest.param(
             "sev1", {**VALID, "reviewer": "kim"}, None, None, "Unknown finding field 'reviewer'.", id="unknown key"
         ),
+        pytest.param(
+            "sev1",
+            {**VALID, "reviewer": "kim"},
+            "sev1",
+            VALID,
+            "Unknown finding field 'reviewer'.",
+            id="unknown key the stored finding never had",
+        ),
         pytest.param(
             "sev1",
             {**VALID, "severity": "sev1"},
@@ -279,7 +293,7 @@ def test_check_values_accepts(
             {**VALID, "repro": "new"},
             "sev1",
             {**VALID, "repro": "old"},
-            "Unknown finding field 'repro'.",
+            "Finding field 'repro' is no longer configured, so its saved value can't change.",
             id="changed retired field",
         ),
     ],
@@ -294,6 +308,49 @@ def test_check_values_rejects(
     assert str(error.value) == message
 
 
+@pytest.mark.parametrize(
+    ("severity", "values", "message"),
+    [
+        pytest.param(
+            "Critical",
+            {},
+            "Severity 'Critical' matches the option 'critical'. Send 'critical' instead.",
+            id="severity label",
+        ),
+        pytest.param(
+            "CRITICAL",
+            {},
+            "Severity 'CRITICAL' matches the option 'critical'. Send 'critical' instead.",
+            id="severity key in capitals",
+        ),
+        pytest.param(
+            "low ", {}, "Severity 'low ' matches the option 'low'. Send 'low' instead.", id="severity key with a space"
+        ),
+        pytest.param(
+            "low",
+            {"harm_type": "malware"},
+            "Harm-type 'malware' matches the option 'Malware'. Send 'Malware' instead.",
+            id="harm type key in lowercase",
+        ),
+    ],
+)
+def test_check_values_rejects_other_text_that_matches_an_option(
+    severity: str, values: dict[str, str], message: str
+) -> None:
+    with pytest.raises(FindingValuesError) as error:
+        DEFAULT_FINDING_FIELDS.check_values(severity=severity, field_values=values)
+    assert str(error.value) == message
+
+
+@pytest.mark.parametrize("severity", ["Sev 2.5", "critcal"])
+def test_check_values_accepts_other_text_that_matches_no_option(severity: str) -> None:
+    DEFAULT_FINDING_FIELDS.check_values(severity=severity, field_values={})
+
+
+def test_check_values_accepts_unchanged_other_text_that_matches_an_option() -> None:
+    DEFAULT_FINDING_FIELDS.check_values(severity="Critical", field_values={}, previous_severity="Critical")
+
+
 AREA = _choice(
     levels=[("feature", "Feature")],
     options={("chat", "Chat"): [("history", "History")], ("search", "Search"): []},
diff --git a/tests/unit/setup/test_finding_fields.py b/tests/unit/setup/test_finding_fields.py
index 6781f7269b..eb35a3b7bd 100644
--- a/tests/unit/setup/test_finding_fields.py
+++ b/tests/unit/setup/test_finding_fields.py
@@ -1,6 +1,8 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
+import re
+
 import pytest
 
 from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
@@ -33,6 +35,12 @@ def test_set_active_finding_fields_twice_names_both_sources() -> None:
     assert get_active_finding_fields() is CUSTOM
 
 
+def test_set_active_finding_fields_rejects_a_value_that_is_not_finding_fields() -> None:
+    with pytest.raises(TypeError, match=re.escape("Contoso must set FindingFields, not dict.")):
+        set_active_finding_fields(finding_fields={}, source="Contoso")
+    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
+
 def test_reset_restores_the_default() -> None:
     set_active_finding_fields(finding_fields=CUSTOM, source="First")
     reset_active_finding_fields()
diff --git a/tests/unit/setup/test_reinitialization.py b/tests/unit/setup/test_reinitialization.py
index 29623278c2..77a903e355 100644
--- a/tests/unit/setup/test_reinitialization.py
+++ b/tests/unit/setup/test_reinitialization.py
@@ -4,6 +4,7 @@
 """Repeatable setup uses fresh scripts, replacement values, and the same memory."""
 
 import os
+import re
 import uuid
 from collections.abc import Generator, Iterator
 from contextlib import contextmanager, nullcontext
@@ -15,7 +16,7 @@
 from pyrit.common.apply_defaults import get_global_default_values
 from pyrit.common.random_context import configure_random_seed, get_configured_random_seed
 from pyrit.memory import AzureSQLMemory, CentralMemory, SQLiteMemory
-from pyrit.models import DEFAULT_FINDING_FIELDS
+from pyrit.models import FindingField, FindingFields
 from pyrit.models.catalog import ScenarioSuite
 from pyrit.registry import (
     AttackRegistry,
@@ -27,10 +28,14 @@
 )
 from pyrit.setup.configuration_loader import ConfigurationLoader
 from pyrit.setup.environment_loading import resolve_environment_async
-from pyrit.setup.finding_fields import get_active_finding_fields
+from pyrit.setup.finding_fields import get_active_finding_fields, set_active_finding_fields
 from pyrit.setup.initialization import reset_setup_registries, validate_reinitialization_memory
 from pyrit.setup.initializers.targets import TARGET_CONFIGS
 
+CUSTOM = FindingFields(
+    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+)
+
 
 @contextmanager
 def _isolated_reinitialization_state() -> Generator[None, None, None]:
@@ -134,10 +139,15 @@ def get_finding_fields(self): return FindingFields(severity=SEVERITY)
         encoding="utf-8",
     )
     config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
+    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
 
-    with pytest.raises(ValueError, match="Use one FindingFieldsInitializer per deployment"):
+    message = (
+        "ContosoBackupFields and ContosoFindingFields both set the finding fields. "
+        "Use one FindingFieldsInitializer per deployment."
+    )
+    with pytest.raises(ValueError, match=re.escape(message)):
         await config.preflight_reinitialization_async(environment_values={})
-    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+    assert get_active_finding_fields() is CUSTOM
 
 
 @pytest.mark.usefixtures("reset_finding_fields")
@@ -155,10 +165,33 @@ def get_finding_fields(self):
         encoding="utf-8",
     )
     config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
+    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
 
     with pytest.raises(ValueError, match="needs at least one option"):
         await config.preflight_reinitialization_async(environment_values={})
-    assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+    assert get_active_finding_fields() is CUSTOM
+
+
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_preflight_rejects_finding_fields_of_the_wrong_type(tmp_path: Path) -> None:
+    script = tmp_path / "wrong_type_finding_fields.py"
+    script.write_text(
+        """
+from pyrit.setup.initializers import FindingFieldsInitializer
+
+class ContosoFindingFields(FindingFieldsInitializer):
+    def get_finding_fields(self):
+        return {}
+""",
+        encoding="utf-8",
+    )
+    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
+    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
+
+    message = "ContosoFindingFields.get_finding_fields() must return FindingFields, not dict."
+    with pytest.raises(ValueError, match=re.escape(message)):
+        await config.preflight_reinitialization_async(environment_values={})
+    assert get_active_finding_fields() is CUSTOM
 
 
 @pytest.mark.usefixtures("patch_central_database")

From 5943b6b0311a59cd4d1f45c3ab326912c33132d8 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 09:35:41 -0400
Subject: [PATCH 08/20] Rename FindingsInitializer, export configured fields
 and add retired values

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Operations/RetiredFieldValues.styles.ts   |  52 +++++
 .../Operations/RetiredFieldValues.test.tsx    | 164 ++++++++++++++++
 .../Operations/RetiredFieldValues.tsx         | 103 ++++++++++
 frontend/src/hooks/useFindingFields.test.tsx  |  62 ++++++
 frontend/src/hooks/useFindingFields.ts        |  41 ++++
 frontend/src/services/api.test.ts             |   6 +
 frontend/src/services/api.ts                  |   4 +
 .../src/test-utils/findingFieldsFixtures.ts   | 111 +++++++++++
 frontend/src/types/index.ts                   |  42 +++++
 frontend/src/utils/findingFields.test.ts      | 143 ++++++++++++++
 frontend/src/utils/findingFields.ts           | 178 ++++++++++++++++++
 pyrit/backend/services/finding_export.py      |  42 +++--
 pyrit/models/finding_fields.py                |  98 +++++++++-
 pyrit/setup/configuration_loader.py           |  16 +-
 pyrit/setup/finding_fields.py                 |   2 +-
 pyrit/setup/initializers/__init__.py          |   4 +-
 .../{finding_fields.py => findings.py}        |   4 +-
 tests/unit/backend/test_finding_export.py     |  87 ++++++++-
 .../test_operation_service_findings.py        |   0
 tests/unit/models/test_finding_fields.py      |  73 ++++++-
 ...alizer.py => test_findings_initializer.py} |  20 +-
 tests/unit/setup/test_initialization.py       |  10 +-
 tests/unit/setup/test_reinitialization.py     |  18 +-
 23 files changed, 1210 insertions(+), 70 deletions(-)
 create mode 100644 frontend/src/components/Operations/RetiredFieldValues.styles.ts
 create mode 100644 frontend/src/components/Operations/RetiredFieldValues.test.tsx
 create mode 100644 frontend/src/components/Operations/RetiredFieldValues.tsx
 create mode 100644 frontend/src/hooks/useFindingFields.test.tsx
 create mode 100644 frontend/src/hooks/useFindingFields.ts
 create mode 100644 frontend/src/test-utils/findingFieldsFixtures.ts
 create mode 100644 frontend/src/utils/findingFields.test.ts
 create mode 100644 frontend/src/utils/findingFields.ts
 rename pyrit/setup/initializers/{finding_fields.py => findings.py} (92%)
 rename tests/unit/{memory => backend}/test_operation_service_findings.py (100%)
 rename tests/unit/setup/{test_finding_fields_initializer.py => test_findings_initializer.py} (83%)

diff --git a/frontend/src/components/Operations/RetiredFieldValues.styles.ts b/frontend/src/components/Operations/RetiredFieldValues.styles.ts
new file mode 100644
index 0000000000..397b6ea322
--- /dev/null
+++ b/frontend/src/components/Operations/RetiredFieldValues.styles.ts
@@ -0,0 +1,52 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import { mobileTouchTarget } from '@/styles/touchTargets'
+
+const DASHED_PANEL = {
+  padding: `${tokens.spacingVerticalS} ${tokens.spacingHorizontalM}`,
+  backgroundColor: tokens.colorNeutralBackground2,
+  border: `${tokens.strokeWidthThin} dashed ${tokens.colorNeutralStroke1}`,
+  borderRadius: tokens.borderRadiusMedium,
+}
+
+export const useRetiredFieldValuesStyles = makeStyles({
+  root: { display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalS },
+  group: { ...DASHED_PANEL, display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalXS },
+  heading: {
+    color: tokens.colorNeutralForeground3,
+    fontSize: tokens.fontSizeBase200,
+    fontWeight: tokens.fontWeightSemibold,
+  },
+  list: {
+    margin: 0,
+    padding: 0,
+    listStyleType: 'none',
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalS,
+  },
+  item: {
+    display: 'flex',
+    justifyContent: 'space-between',
+    alignItems: 'flex-start',
+    gap: tokens.spacingHorizontalM,
+  },
+  entry: { display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalXXS, minWidth: 0 },
+  key: {
+    fontFamily: tokens.fontFamilyMonospace,
+    fontSize: tokens.fontSizeBase200,
+    color: tokens.colorNeutralForeground3,
+    overflowWrap: 'anywhere',
+  },
+  titleKey: { fontFamily: tokens.fontFamilyMonospace },
+  value: { margin: 0, whiteSpace: 'pre-wrap', overflowWrap: 'anywhere', userSelect: 'text' },
+  note: {
+    ...DASHED_PANEL,
+    display: 'flex',
+    flexWrap: 'wrap',
+    alignItems: 'center',
+    gap: tokens.spacingHorizontalS,
+    color: tokens.colorNeutralForeground3,
+  },
+  button: { flexShrink: 0, ...mobileTouchTarget },
+})
diff --git a/frontend/src/components/Operations/RetiredFieldValues.test.tsx b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
new file mode 100644
index 0000000000..71f3d45ede
--- /dev/null
+++ b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
@@ -0,0 +1,164 @@
+import React, { useState } from 'react'
+import { render, screen, waitFor, within } from '@testing-library/react'
+import userEvent, { type UserEvent } from '@testing-library/user-event'
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+
+import RetiredFieldValues from './RetiredFieldValues'
+
+const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+)
+
+const RETIRED_VALUES = [
+  { key: 'description', value: 'The assistant agreed to play a character and then\nexplained the restricted steps.' },
+  { key: 'contoso_ticket', value: 'CONTOSO-42' },
+]
+
+function removeButtonName(key: string): string {
+  return `Remove retired value ${key}`
+}
+
+interface RetiredFieldValuesHarnessProps {
+  onRemove: (key: string) => void
+  onUndo: () => void
+}
+
+// Holds the removed keys the way the edit dialog will, so a test can follow a removal through to Undo.
+function RetiredFieldValuesHarness({ onRemove, onUndo }: RetiredFieldValuesHarnessProps) {
+  const [removed, setRemoved] = useState<ReadonlySet<string>>(new Set())
+  return (
+    <RetiredFieldValues values={RETIRED_VALUES} removed={removed}
+      onRemove={(key: string) => {
+        onRemove(key)
+        setRemoved((previous) => new Set([...previous, key]))
+      }}
+      onUndo={() => {
+        onUndo()
+        setRemoved(new Set())
+      }} />
+  )
+}
+
+// jsdom has no default stylesheet, so an accessible name would gain a space around the title's <code> key.
+async function findConfirmation(key: string): Promise<HTMLElement> {
+  const dialog = await screen.findByRole('dialog')
+  expect(within(dialog).getByRole('heading')).toHaveTextContent(`Remove ${key}?`)
+  return dialog
+}
+
+async function confirmRemoval(user: UserEvent, key: string): Promise<void> {
+  await user.click(await screen.findByRole('button', { name: removeButtonName(key) }))
+  const dialog = await findConfirmation(key)
+  await user.click(within(dialog).getByRole('button', { name: 'Remove' }))
+  await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+}
+
+describe('RetiredFieldValues', () => {
+  const defaultProps = {
+    values: RETIRED_VALUES,
+    removed: new Set<string>(),
+    onRemove: jest.fn(),
+    onUndo: jest.fn(),
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('renders nothing without retired values', () => {
+    render(<TestWrapper><RetiredFieldValues {...defaultProps} values={[]} /></TestWrapper>)
+    expect(screen.queryByText('Retired fields · read-only')).not.toBeInTheDocument()
+    expect(screen.queryByRole('group')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button')).not.toBeInTheDocument()
+  })
+
+  it('lists each retired value with its raw key and a Remove button', () => {
+    render(<TestWrapper><RetiredFieldValues {...defaultProps} /></TestWrapper>)
+    const group = screen.getByRole('group', { name: 'Retired fields · read-only' })
+    const items = within(group).getAllByRole('listitem')
+    expect(items).toHaveLength(2)
+    const [description, ticket] = items
+    expect(within(description).getByText('description')).toBeInTheDocument()
+    expect(within(description).getByText(/The assistant agreed/)).toHaveTextContent(
+      'The assistant agreed to play a character and then\nexplained the restricted steps.',
+      { normalizeWhitespace: false },
+    )
+    expect(within(description).getByRole('button', { name: removeButtonName('description') })).toBeEnabled()
+    expect(within(ticket).getByText('contoso_ticket')).toBeInTheDocument()
+    expect(within(ticket).getByText('CONTOSO-42')).toBeInTheDocument()
+    expect(within(ticket).getByRole('button', { name: removeButtonName('contoso_ticket') })).toBeEnabled()
+    expect(screen.queryByRole('button', { name: 'Undo' })).not.toBeInTheDocument()
+  })
+
+  it('asks before removing and keeps the value on Keep it', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><RetiredFieldValues {...defaultProps} /></TestWrapper>)
+    await user.click(screen.getByRole('button', { name: removeButtonName('description') }))
+    const dialog = await findConfirmation('description')
+    expect(dialog).toHaveTextContent(
+      'This deletes its text from the finding when you save. Copy anything you need first. '
+      + 'Cancel on the edit dialog still brings it back.',
+    )
+    expect(within(dialog).getByRole('button', { name: 'Remove' })).toBeInTheDocument()
+    await user.click(within(dialog).getByRole('button', { name: 'Keep it' }))
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    expect(await screen.findByRole('button', { name: removeButtonName('description') })).toBeInTheDocument()
+    expect(defaultProps.onRemove).not.toHaveBeenCalled()
+  })
+
+  it('reports a confirmed removal and offers Undo', async () => {
+    const user = userEvent.setup()
+    const onRemove = jest.fn()
+    const onUndo = jest.fn()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={onRemove} onUndo={onUndo} /></TestWrapper>)
+    await confirmRemoval(user, 'description')
+    expect(onRemove).toHaveBeenCalledTimes(1)
+    expect(onRemove).toHaveBeenCalledWith('description')
+    expect(await screen.findByRole('button', { name: removeButtonName('contoso_ticket') })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: removeButtonName('description') })).not.toBeInTheDocument()
+    expect(screen.getByText('1 retired value is removed when you save.')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Undo' }))
+    expect(onUndo).toHaveBeenCalledTimes(1)
+    expect(screen.getByRole('button', { name: removeButtonName('description') })).toBeInTheDocument()
+    expect(screen.queryByText(/removed when you save/)).not.toBeInTheDocument()
+  })
+
+  it('counts several removals', async () => {
+    const user = userEvent.setup()
+    const onRemove = jest.fn()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={onRemove} onUndo={jest.fn()} /></TestWrapper>)
+    await confirmRemoval(user, 'description')
+    await confirmRemoval(user, 'contoso_ticket')
+    expect(onRemove).toHaveBeenNthCalledWith(1, 'description')
+    expect(onRemove).toHaveBeenNthCalledWith(2, 'contoso_ticket')
+    expect(await screen.findByRole('button', { name: 'Undo' })).toBeInTheDocument()
+    expect(screen.getByText('2 retired values are removed when you save.')).toBeInTheDocument()
+    expect(screen.queryByRole('group', { name: 'Retired fields · read-only' })).not.toBeInTheDocument()
+  })
+
+  it('moves focus to Undo after a removal is confirmed', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={jest.fn()} onUndo={jest.fn()} /></TestWrapper>)
+    await confirmRemoval(user, 'description')
+    expect(await screen.findByRole('button', { name: 'Undo' })).toHaveFocus()
+  })
+
+  it('moves focus to the first Remove button after Undo', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={jest.fn()} onUndo={jest.fn()} /></TestWrapper>)
+    await confirmRemoval(user, 'contoso_ticket')
+    await user.click(await screen.findByRole('button', { name: 'Undo' }))
+    expect(screen.getByRole('button', { name: removeButtonName('description') })).toHaveFocus()
+  })
+
+  it('disables every Remove button and Undo while disabled', () => {
+    const values = [...RETIRED_VALUES, { key: 'contoso_owner', value: 'Contoso red team' }]
+    render(<TestWrapper>
+      <RetiredFieldValues {...defaultProps} values={values} removed={new Set(['contoso_ticket'])} disabled />
+    </TestWrapper>)
+    const removeButtons = screen.getAllByRole('button', { name: /^Remove retired value / })
+    expect(removeButtons).toHaveLength(2)
+    for (const button of removeButtons) expect(button).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Undo' })).toBeDisabled()
+  })
+})
diff --git a/frontend/src/components/Operations/RetiredFieldValues.tsx b/frontend/src/components/Operations/RetiredFieldValues.tsx
new file mode 100644
index 0000000000..66403888b4
--- /dev/null
+++ b/frontend/src/components/Operations/RetiredFieldValues.tsx
@@ -0,0 +1,103 @@
+import { type RefObject, useEffect, useId, useRef, useState, type JSX } from 'react'
+import {
+  Button, Dialog, DialogActions, DialogBody, DialogContent, DialogSurface, DialogTitle, Link, Text,
+} from '@fluentui/react-components'
+
+import { useRetiredFieldValuesStyles } from './RetiredFieldValues.styles'
+
+interface RetiredFieldValuesProps {
+  /** Retired values from the stored finding, in stored order. */
+  values: Array<{ key: string; value: string }>
+  /** Keys marked for removal in this edit. */
+  removed: ReadonlySet<string>
+  disabled?: boolean
+  onRemove: (key: string) => void
+  /** Restores every marked key. */
+  onUndo: () => void
+}
+
+function removalNote(count: number): string {
+  return count === 1
+    ? '1 retired value is removed when you save.'
+    : `${count} retired values are removed when you save.`
+}
+
+/**
+ * Lists stored values whose keys the active finding fields no longer define. They are read-only, but each
+ * can be marked for removal on save, after a confirmation, and Undo restores every marked value.
+ */
+export default function RetiredFieldValues({
+  values, removed, disabled = false, onRemove, onUndo,
+}: RetiredFieldValuesProps): JSX.Element | null {
+  const styles = useRetiredFieldValuesStyles()
+  const headingId = useId()
+  // The key stays set while the dialog closes, so its title doesn't lose the key during the exit animation.
+  const [confirming, setConfirming] = useState({ key: '', open: false })
+  const undoRef = useRef<HTMLButtonElement>(null)
+  const firstRemoveRef = useRef<HTMLButtonElement>(null)
+  const focusAfterChange = useRef<RefObject<HTMLButtonElement | null> | null>(null)
+
+  // Confirming a removal unmounts the row whose button opened the dialog, and Undo unmounts itself, so focus
+  // moves to the control that replaces them once the parent has applied the change.
+  useEffect(() => {
+    focusAfterChange.current?.current?.focus()
+    focusAfterChange.current = null
+  }, [removed])
+
+  if (values.length === 0) return null
+  const kept = values.filter(({ key }) => !removed.has(key))
+  const closeConfirmation = (): void => {
+    setConfirming((current) => ({ ...current, open: false }))
+  }
+
+  return (
+    <div className={styles.root}>
+      {kept.length > 0 && <div role="group" aria-labelledby={headingId} className={styles.group}>
+        <Text id={headingId} className={styles.heading}>Retired fields · read-only</Text>
+        <ul className={styles.list}>
+          {kept.map(({ key, value }, index) => (
+            <li key={key} className={styles.item}>
+              <div className={styles.entry}>
+                <code className={styles.key} translate="no">{key}</code>
+                <Text as="p" className={styles.value}>{value}</Text>
+              </div>
+              <Button ref={index === 0 ? firstRemoveRef : undefined} size="small" className={styles.button}
+                disabled={disabled} aria-label={`Remove retired value ${key}`}
+                onClick={() => { setConfirming({ key, open: true }) }}>Remove</Button>
+            </li>
+          ))}
+        </ul>
+      </div>}
+      {removed.size > 0 && <div className={styles.note}>
+        <Text>{removalNote(removed.size)}</Text>
+        <Link ref={undoRef} as="button" className={styles.button} disabled={disabled} onClick={() => {
+          focusAfterChange.current = firstRemoveRef
+          onUndo()
+        }}>Undo</Link>
+      </div>}
+      <Dialog open={confirming.open} onOpenChange={(_, data) => {
+        if (!data.open) closeConfirmation()
+      }}>
+        <DialogSurface>
+          <DialogBody>
+            <DialogTitle>Remove <code className={styles.titleKey} translate="no">{confirming.key}</code>?</DialogTitle>
+            <DialogContent>
+              <Text>
+                This deletes its text from the finding when you save. Copy anything you need first. Cancel on the
+                edit dialog still brings it back.
+              </Text>
+            </DialogContent>
+            <DialogActions>
+              <Button className={styles.button} onClick={closeConfirmation}>Keep it</Button>
+              <Button appearance="primary" className={styles.button} disabled={disabled} onClick={() => {
+                focusAfterChange.current = undoRef
+                onRemove(confirming.key)
+                closeConfirmation()
+              }}>Remove</Button>
+            </DialogActions>
+          </DialogBody>
+        </DialogSurface>
+      </Dialog>
+    </div>
+  )
+}
diff --git a/frontend/src/hooks/useFindingFields.test.tsx b/frontend/src/hooks/useFindingFields.test.tsx
new file mode 100644
index 0000000000..1d0bbf6b57
--- /dev/null
+++ b/frontend/src/hooks/useFindingFields.test.tsx
@@ -0,0 +1,62 @@
+import { StrictMode } from 'react'
+
+import { act, renderHook, waitFor } from '@testing-library/react'
+
+import { operationsApi } from '@/services/api'
+import { deferred } from '@/test-utils/deferred'
+import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { FindingFields } from '@/types'
+
+import { useFindingFields } from './useFindingFields'
+
+jest.mock('@/services/api', () => ({ operationsApi: { getFindingFields: jest.fn() } }))
+const mockGetFindingFields = jest.mocked(operationsApi.getFindingFields)
+
+describe('useFindingFields', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('loads the finding fields once', async () => {
+    mockGetFindingFields.mockResolvedValue(CONTOSO_FINDING_FIELDS)
+
+    const { result, rerender } = renderHook(() => useFindingFields())
+    expect(result.current.fields).toBeNull()
+
+    await waitFor(() => expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS))
+    rerender()
+    expect(result.current.error).toBe('')
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(1)
+  })
+
+  it('reports a load failure and retries', async () => {
+    mockGetFindingFields
+      .mockRejectedValueOnce(new Error('The Contoso backend is unavailable.'))
+      .mockResolvedValueOnce(DEFAULT_FINDING_FIELDS_FIXTURE)
+
+    const { result } = renderHook(() => useFindingFields())
+    await waitFor(() => expect(result.current.error).toBe('The Contoso backend is unavailable.'))
+    expect(result.current.fields).toBeNull()
+
+    act(() => { result.current.retry() })
+    expect(result.current.error).toBe('')
+
+    await waitFor(() => expect(result.current.fields).toBe(DEFAULT_FINDING_FIELDS_FIXTURE))
+    expect(result.current.error).toBe('')
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(2)
+  })
+
+  it('ignores a response after unmount', async () => {
+    const unmounted = deferred<FindingFields>()
+    const mounted = deferred<FindingFields>()
+    mockGetFindingFields.mockReturnValueOnce(unmounted.promise).mockReturnValueOnce(mounted.promise)
+
+    // StrictMode unmounts and remounts once, so the first request belongs to an unmounted effect.
+    const { result } = renderHook(() => useFindingFields(), { wrapper: StrictMode })
+    await act(async () => { mounted.resolve(CONTOSO_FINDING_FIELDS) })
+    await act(async () => { unmounted.resolve(DEFAULT_FINDING_FIELDS_FIXTURE) })
+
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(2)
+    expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS)
+  })
+})
diff --git a/frontend/src/hooks/useFindingFields.ts b/frontend/src/hooks/useFindingFields.ts
new file mode 100644
index 0000000000..5351bf6990
--- /dev/null
+++ b/frontend/src/hooks/useFindingFields.ts
@@ -0,0 +1,41 @@
+import { useCallback, useEffect, useState } from 'react'
+
+import { operationsApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import type { FindingFields } from '@/types'
+
+interface FindingFieldsState {
+  /** Null until the fields load. */
+  readonly fields: FindingFields | null
+  /** The last load failure, or an empty string. */
+  readonly error: string
+  readonly retry: () => void
+}
+
+/** Loads the active finding fields once, for the finding dialog, cards and counts. */
+export function useFindingFields(): FindingFieldsState {
+  const [fields, setFields] = useState<FindingFields | null>(null)
+  const [error, setError] = useState('')
+  const [attempt, setAttempt] = useState(0)
+
+  useEffect(() => {
+    let ignore = false
+    operationsApi.getFindingFields()
+      .then((loaded: FindingFields) => {
+        if (!ignore) setFields(loaded)
+      })
+      .catch((cause: unknown) => {
+        if (!ignore) setError(toApiError(cause).detail)
+      })
+    return () => {
+      ignore = true
+    }
+  }, [attempt])
+
+  const retry = useCallback(() => {
+    setError('')
+    setAttempt((count: number) => count + 1)
+  }, [])
+
+  return { fields, error, retry }
+}
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index c40ce0d65b..d330138e4b 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -42,6 +42,7 @@ import {
 import { compatibility, COMPATIBILITY_HEADER } from "./compatibility";
 import { toApiError } from "./errors";
 import { makeAnalyticsFacets, makeAnalyticsReport, makeAnalyticsResults } from "@/test-utils/analyticsFixtures";
+import { DEFAULT_FINDING_FIELDS_FIXTURE } from "@/test-utils/findingFieldsFixtures";
 import type { FindingExportRequest } from "@/types";
 import { DEFAULT_ANALYTICS_VIEW } from "@/utils/attackAnalytics";
 
@@ -53,6 +54,11 @@ describe("api service", () => {
       expect(await operationsApi.getFindingOptions()).toEqual(options);
       expect(apiClient.get).toHaveBeenCalledWith("/operations/finding-options");
     });
+    it("gets finding fields", async () => {
+      (apiClient.get as jest.Mock).mockResolvedValueOnce({ data: DEFAULT_FINDING_FIELDS_FIXTURE });
+      expect(await operationsApi.getFindingFields()).toEqual(DEFAULT_FINDING_FIELDS_FIXTURE);
+      expect(apiClient.get).toHaveBeenCalledWith("/operations/finding-fields");
+    });
     it("encodes evidence scope, searches literally, and preserves duplicate feedback", async () => {
       const page = { items: [], has_more: false, next_offset: null };
       (apiClient.get as jest.Mock).mockResolvedValue({ data: page });
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index a8ddd7dc4c..c96b777c73 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -82,6 +82,7 @@ import type {
   Finding,
   FindingCreate,
   FindingCreateRequest,
+  FindingFields,
   FindingListResponse,
   FindingOptionsResponse,
   FindingEvidenceCreateRequest,
@@ -109,6 +110,9 @@ export const operationsApi = {
   getFindingOptions: async (): Promise<FindingOptionsResponse> => {
     return (await apiClient.get('/operations/finding-options')).data
   },
+  getFindingFields: async (): Promise<FindingFields> => {
+    return (await apiClient.get('/operations/finding-fields')).data
+  },
   list: async (): Promise<OperationListResponse> => {
     return (await apiClient.get('/operations')).data
   },
diff --git a/frontend/src/test-utils/findingFieldsFixtures.ts b/frontend/src/test-utils/findingFieldsFixtures.ts
new file mode 100644
index 0000000000..65dd7a7387
--- /dev/null
+++ b/frontend/src/test-utils/findingFieldsFixtures.ts
@@ -0,0 +1,111 @@
+import type { FindingField, FindingFieldOption, FindingFields } from '@/types'
+
+type FieldDefinition = Pick<FindingField, 'key' | 'label' | 'type'> & Partial<FindingField>
+
+/** Fills in the backend's defaults, so each fixture field has the full JSON shape. */
+function field(definition: FieldDefinition): FindingField {
+  return {
+    required: false,
+    options: [],
+    levels: [],
+    default: null,
+    allow_other: false,
+    colors: {},
+    hint: null,
+    section: null,
+    internal: false,
+    ...definition,
+  }
+}
+
+function option(key: string, label: string, children: FindingFieldOption[] = []): FindingFieldOption {
+  return { key, label, children }
+}
+
+/** A Contoso deployment's fields: a severity level, a cascade, Other text, a required multiline and an internal field. */
+export const CONTOSO_FINDING_FIELDS: FindingFields = {
+  severity: field({
+    key: 'severity',
+    label: 'Severity',
+    type: 'choice',
+    required: true,
+    options: [
+      option('sev1', 'Sev 1', [option('customer_impact', 'Customer impact')]),
+      option('sev2', 'Sev 2', [option('internal_impact', 'Internal impact')]),
+    ],
+    levels: [['severity_rationale', 'Severity rationale']],
+    colors: { sev1: 'red', sev2: 'yellow' },
+  }),
+  fields: [
+    field({
+      key: 'category',
+      label: 'Category',
+      type: 'choice',
+      required: true,
+      options: [
+        option('model_security', 'Model security', [
+          option('system_prompt_leak', 'System prompt leak'),
+          option('tool_misuse', 'Tool misuse'),
+        ]),
+        option('content_safety', 'Content safety', [
+          option('hate_speech', 'Hate speech'),
+          option('self_harm', 'Self-harm'),
+        ]),
+      ],
+      levels: [['subcategory', 'Subcategory']],
+      section: 'Classification',
+    }),
+    field({
+      key: 'technique',
+      label: 'Technique',
+      type: 'choice',
+      options: [option('prompt_injection', 'Prompt injection'), option('role_play', 'Role play')],
+      allow_other: true,
+      section: 'Reproduction',
+    }),
+    field({
+      key: 'steps',
+      label: 'Steps to reproduce',
+      type: 'multiline',
+      required: true,
+      hint: 'List each prompt you sent to the Contoso assistant, in order.',
+      section: 'Reproduction',
+    }),
+    field({ key: 'owner', label: 'Owner', type: 'text', section: 'Tracking', internal: true }),
+  ],
+}
+
+/** A copy of the backend's `DEFAULT_FINDING_FIELDS`, with three harm types instead of the whole taxonomy. */
+export const DEFAULT_FINDING_FIELDS_FIXTURE: FindingFields = {
+  severity: field({
+    key: 'severity',
+    label: 'Severity',
+    type: 'choice',
+    required: true,
+    options: [
+      option('critical', 'Critical'),
+      option('important', 'Important'),
+      option('moderate', 'Moderate'),
+      option('low', 'Low'),
+      option('informational', 'Informational'),
+    ],
+    default: 'moderate',
+    allow_other: true,
+    colors: { critical: 'red', important: 'yellow', moderate: 'yellow', low: 'gray' },
+  }),
+  fields: [
+    field({
+      key: 'harm_type',
+      label: 'Harm-type',
+      type: 'choice',
+      options: [
+        option('Hate Speech', 'Hate Speech'),
+        option('Insecure Code', 'Insecure Code'),
+        option('Malware', 'Malware'),
+      ],
+      allow_other: true,
+      hint: 'Optional. Select a category, or choose Other for custom text.',
+    }),
+    field({ key: 'description', label: 'Description', type: 'multiline', hint: 'Optional' }),
+  ],
+}
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 41ae65c7ac..2adf77c6ad 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -2208,10 +2208,52 @@ export interface FindingCreateRequest extends FindingCreate {
   attack_result_id?: string
 }
 
+/** A finding edit. Each key in `remove_retired_keys` drops that retired value from the stored finding. */
+export interface FindingUpdateRequest extends FindingCreate {
+  remove_retired_keys: string[]
+}
+
 export interface FindingOptionsResponse {
   harm_types: string[]
 }
 
+export type FindingFieldType = 'text' | 'multiline' | 'choice'
+
+export type FindingSeverityColor = 'red' | 'orange' | 'yellow' | 'green' | 'blue' | 'gray' | 'dark' | 'neutral'
+
+export interface FindingFieldOption {
+  key: string
+  label: string
+  /** The options of the next dropdown when this option is chosen. */
+  children: FindingFieldOption[]
+}
+
+/** One field of the finding dialog, as the deployment defines it. */
+export interface FindingField {
+  key: string
+  label: string
+  type: FindingFieldType
+  required: boolean
+  options: FindingFieldOption[]
+  /** The `[key, label]` of each dropdown under a cascade's first one. */
+  levels: Array<[string, string]>
+  default: string | null
+  /** Whether a single-level choice also accepts typed text. */
+  allow_other: boolean
+  /** The severity slot's badge color for each top-level option. */
+  colors: Record<string, FindingSeverityColor>
+  hint: string | null
+  section: string | null
+  /** Shown on the dashboard but left out of exports. */
+  internal: boolean
+}
+
+/** The active finding fields: the severity slot and the fields shown after it. */
+export interface FindingFields {
+  severity: FindingField
+  fields: FindingField[]
+}
+
 export interface Finding extends FindingCreate {
   id: string
   operation_id: string
diff --git a/frontend/src/utils/findingFields.test.ts b/frontend/src/utils/findingFields.test.ts
new file mode 100644
index 0000000000..7a5cdefcbc
--- /dev/null
+++ b/frontend/src/utils/findingFields.test.ts
@@ -0,0 +1,143 @@
+import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { FindingField, FindingFieldOption } from '@/types'
+
+import {
+  choiceLevels,
+  describeFindingValues,
+  fieldKeys,
+  firstMissingRequired,
+  FLUENT_BADGE_COLOR,
+  type FindingValueRow,
+  levelOptions,
+  severityBadge,
+  severityCountBadges,
+} from './findingFields'
+
+function contosoField(key: string): FindingField {
+  const match = CONTOSO_FINDING_FIELDS.fields.find((field: FindingField) => field.key === key)
+  if (match === undefined) throw new Error(`The Contoso fixture has no field ${key}`)
+  return match
+}
+
+function optionKeys(options: FindingFieldOption[]): string[] {
+  return options.map((option: FindingFieldOption) => option.key)
+}
+
+describe('findingFields', () => {
+  it('maps every author color to one Fluent badge color', () => {
+    expect(FLUENT_BADGE_COLOR).toEqual({ red: 'danger', orange: 'severe', yellow: 'warning', green: 'success',
+      blue: 'brand', gray: 'informative', dark: 'important', neutral: 'subtle' })
+  })
+
+  it('keeps the #3066 badge colors for the default fields', () => {
+    expect(['critical', 'important', 'moderate', 'low', 'informational']
+      .map((key: string) => severityBadge(DEFAULT_FINDING_FIELDS_FIXTURE, key).color))
+      .toEqual(['danger', 'warning', 'warning', 'informative', 'subtle'])
+  })
+
+  it('shows an unmatched severity as typed on a neutral badge', () => {
+    expect(severityBadge(CONTOSO_FINDING_FIELDS, 'Sev 2.5')).toEqual({ label: 'Sev 2.5', color: 'subtle' })
+    expect(severityBadge(CONTOSO_FINDING_FIELDS, 'sev1')).toEqual({ label: 'Sev 1', color: 'danger' })
+  })
+
+  it('lists a field with its levels and every key except severity', () => {
+    expect(choiceLevels(contosoField('category'))).toEqual([
+      { key: 'category', label: 'Category' }, { key: 'subcategory', label: 'Subcategory' }])
+    expect(choiceLevels(contosoField('steps'))).toEqual([{ key: 'steps', label: 'Steps to reproduce' }])
+    expect([...fieldKeys(CONTOSO_FINDING_FIELDS)]).toEqual(
+      ['severity_rationale', 'category', 'subcategory', 'technique', 'steps', 'owner'])
+  })
+
+  it('describes filled values in configured order and lists retired keys', () => {
+    const { rows, retired } = describeFindingValues(CONTOSO_FINDING_FIELDS, 'sev1', {
+      owner: 'dana', category: 'model_security', subcategory: 'system_prompt_leak',
+      technique: 'Many-shot priming', description: 'Old text',
+    })
+    expect(rows.map((row: FindingValueRow) => `${row.label}: ${row.value}`)).toEqual([
+      'Category: Model security', 'Subcategory: System prompt leak', 'Technique: Many-shot priming', 'Owner: dana'])
+    expect(retired).toEqual([{ key: 'description', value: 'Old text' }])
+  })
+
+  it('shows a cascade child that is not under its stored parent as typed', () => {
+    const { rows } = describeFindingValues(CONTOSO_FINDING_FIELDS, 'sev1', {
+      category: 'model_security', subcategory: 'hate_speech',
+    })
+    expect(rows).toEqual([
+      { key: 'category', label: 'Category', value: 'Model security', multiline: false },
+      { key: 'subcategory', label: 'Subcategory', value: 'hate_speech', multiline: false },
+    ])
+  })
+
+  it('labels a severity level from the given severity and skips blank values', () => {
+    const { rows, retired } = describeFindingValues(CONTOSO_FINDING_FIELDS, 'sev1', {
+      severity_rationale: 'customer_impact', owner: ' ', steps: 'Send the Contoso prompt twice.',
+    })
+    expect(rows).toEqual([
+      { key: 'severity_rationale', label: 'Severity rationale', value: 'Customer impact', multiline: false },
+      { key: 'steps', label: 'Steps to reproduce', value: 'Send the Contoso prompt twice.', multiline: true },
+    ])
+    expect(retired).toEqual([])
+    expect(describeFindingValues(CONTOSO_FINDING_FIELDS, 'sev2', { severity_rationale: 'customer_impact' }).rows)
+      .toEqual([{ key: 'severity_rationale', label: 'Severity rationale', value: 'customer_impact', multiline: false }])
+  })
+
+  it('treats a stored severity key as retired and resolves levels under the given severity', () => {
+    const { rows, retired } = describeFindingValues(CONTOSO_FINDING_FIELDS, 'sev1', {
+      severity: 'sev2', severity_rationale: 'customer_impact',
+    })
+    expect(rows).toEqual([
+      { key: 'severity_rationale', label: 'Severity rationale', value: 'Customer impact', multiline: false },
+    ])
+    expect(retired).toEqual([{ key: 'severity', value: 'sev2' }])
+  })
+
+  it('offers each cascade level the options under the chosen parent', () => {
+    const category = contosoField('category')
+    expect(optionKeys(levelOptions(category, {}, 0))).toEqual(['model_security', 'content_safety'])
+    expect(optionKeys(levelOptions(category, { category: 'model_security' }, 1)))
+      .toEqual(['system_prompt_leak', 'tool_misuse'])
+    expect(optionKeys(levelOptions(category, { category: 'content_safety' }, 1))).toEqual(['hate_speech', 'self_harm'])
+    expect(levelOptions(category, {}, 1)).toEqual([])
+    expect(levelOptions(category, { category: 'Prompt injection' }, 1)).toEqual([])
+  })
+
+  it('names the first missing required value', () => {
+    const missingSteps = {
+      severity_rationale: 'customer_impact', category: 'model_security', subcategory: 'tool_misuse', steps: ' ',
+    }
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, 'sev1', missingSteps)).toBe('Steps to reproduce')
+    const missingSubcategory = {
+      ...missingSteps, category: 'content_safety', subcategory: '', steps: 'Send the Contoso prompt twice.',
+    }
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, 'sev1', missingSubcategory)).toBe('Subcategory')
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, 'sev1', { ...missingSubcategory, subcategory: 'self_harm' }))
+      .toBeNull()
+  })
+
+  it('always requires the severity and each of its levels that offers options', () => {
+    const complete = {
+      severity_rationale: 'customer_impact', category: 'model_security', subcategory: 'tool_misuse',
+      steps: 'Send the Contoso prompt twice.',
+    }
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, ' ', complete)).toBe('Severity')
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, 'sev1', { ...complete, severity_rationale: '' }))
+      .toBe('Severity rationale')
+    expect(firstMissingRequired(CONTOSO_FINDING_FIELDS, 'Sev 2.5', { ...complete, severity_rationale: '' })).toBeNull()
+    expect(firstMissingRequired(DEFAULT_FINDING_FIELDS_FIXTURE, 'moderate', {})).toBeNull()
+  })
+
+  it('groups unmatched severity counts into one Other badge with a tooltip', () => {
+    expect(severityCountBadges(DEFAULT_FINDING_FIELDS_FIXTURE, { low: 1, critical: 2, 'Sev 2.5': 1, sev3: 3 })).toEqual([
+      { key: 'critical', label: 'Critical', color: 'danger', count: 2, tooltip: null },
+      { key: 'low', label: 'Low', color: 'informative', count: 1, tooltip: null },
+      { key: 'other', label: 'Other', color: 'subtle', count: 4, tooltip: 'Sev 2.5: 1, sev3: 3' },
+    ])
+  })
+
+  it('returns no Other badge when every count matches an option', () => {
+    expect(severityCountBadges(CONTOSO_FINDING_FIELDS, { sev2: 1, sev1: 0 })).toEqual([
+      { key: 'sev2', label: 'Sev 2', color: 'warning', count: 1, tooltip: null },
+    ])
+    expect(severityCountBadges(CONTOSO_FINDING_FIELDS, {})).toEqual([])
+  })
+})
diff --git a/frontend/src/utils/findingFields.ts b/frontend/src/utils/findingFields.ts
new file mode 100644
index 0000000000..5b90ef8b61
--- /dev/null
+++ b/frontend/src/utils/findingFields.ts
@@ -0,0 +1,178 @@
+import type { FindingField, FindingFieldOption, FindingFields, FindingSeverityColor } from '@/types'
+
+export type BadgeColor = 'danger' | 'severe' | 'warning' | 'success' | 'brand' | 'informative' | 'important' | 'subtle'
+
+export const FLUENT_BADGE_COLOR: Record<FindingSeverityColor, BadgeColor> = {
+  red: 'danger',
+  orange: 'severe',
+  yellow: 'warning',
+  green: 'success',
+  blue: 'brand',
+  gray: 'informative',
+  dark: 'important',
+  neutral: 'subtle',
+}
+
+const SEVERITY_KEY = 'severity'
+
+export interface FindingValueRow {
+  key: string
+  label: string
+  /** The option label of a matching choice value, otherwise the stored text. */
+  value: string
+  multiline: boolean
+}
+
+export interface SeverityCountBadge {
+  key: string
+  label: string
+  color: BadgeColor
+  count: number
+  /** The `value: count` of each unmatched severity, on the Other badge only. */
+  tooltip: string | null
+}
+
+const OTHER_SEVERITY_BADGE: Pick<SeverityCountBadge, 'key' | 'label' | 'color'> = {
+  key: 'other',
+  label: 'Other',
+  color: FLUENT_BADGE_COLOR.neutral,
+}
+
+function filled(value: string | undefined): string | null {
+  return value !== undefined && value.trim() !== '' ? value : null
+}
+
+function allFields(fields: FindingFields): FindingField[] {
+  return [fields.severity, ...fields.fields]
+}
+
+/** The severity's option label and badge color, or the stored text on a neutral badge when no option matches. */
+export function severityBadge(fields: FindingFields, severity: string): { label: string; color: BadgeColor } {
+  const match = fields.severity.options.find((option: FindingFieldOption) => option.key === severity)
+  if (match === undefined) return { label: severity, color: FLUENT_BADGE_COLOR.neutral }
+  return { label: match.label, color: FLUENT_BADGE_COLOR[fields.severity.colors[severity] ?? 'neutral'] }
+}
+
+/** The field itself, then each of its levels: one entry per dropdown of a choice field. */
+export function choiceLevels(field: FindingField): Array<{ key: string; label: string }> {
+  return [
+    { key: field.key, label: field.label },
+    ...field.levels.map(([key, label]: [string, string]) => ({ key, label })),
+  ]
+}
+
+/**
+ * The options a choice field's dropdown offers under the values chosen above it.
+ * @param values - Values by key. The severity slot's own value goes under `severity`.
+ * @param depth - 0 for the field's own dropdown, 1 for its first level, and so on.
+ * @returns No options when a value above is missing or isn't an option.
+ */
+export function levelOptions(field: FindingField, values: Record<string, string>, depth: number): FindingFieldOption[] {
+  let options = field.options
+  for (const level of choiceLevels(field).slice(0, depth)) {
+    const value = filled(values[level.key])
+    const match = options.find((option: FindingFieldOption) => option.key === value)
+    if (match === undefined) return []
+    options = match.children
+  }
+  return options
+}
+
+/** The key of every field and level, except `severity`, which isn't stored in `field_values`. */
+export function fieldKeys(fields: FindingFields): Set<string> {
+  const keys = new Set<string>()
+  for (const field of allFields(fields)) {
+    for (const level of choiceLevels(field)) keys.add(level.key)
+  }
+  keys.delete(SEVERITY_KEY)
+  return keys
+}
+
+function displayValue(field: FindingField, values: Record<string, string>, depth: number, value: string): string {
+  if (field.type !== 'choice') return value
+  const match = levelOptions(field, values, depth).find((option: FindingFieldOption) => option.key === value)
+  return match?.label ?? value
+}
+
+/**
+ * Lists a finding's filled values in configured order, and its retired values in stored order.
+ * The severity itself isn't a row; it is the parent path of the severity slot's levels.
+ */
+export function describeFindingValues(
+  fields: FindingFields,
+  severity: string,
+  fieldValues: Record<string, string>,
+): { rows: FindingValueRow[]; retired: Array<{ key: string; value: string }> } {
+  const values: Record<string, string> = { ...fieldValues, [SEVERITY_KEY]: severity }
+  const rows: FindingValueRow[] = []
+  for (const field of allFields(fields)) {
+    for (const [depth, level] of choiceLevels(field).entries()) {
+      if (field === fields.severity && depth === 0) continue
+      const value = filled(fieldValues[level.key])
+      if (value === null) continue
+      rows.push({
+        key: level.key,
+        label: level.label,
+        value: displayValue(field, values, depth, value),
+        multiline: field.type === 'multiline',
+      })
+    }
+  }
+  const known = fieldKeys(fields)
+  const retired = Object.entries(fieldValues)
+    .filter(([key]: [string, string]) => !known.has(key))
+    .map(([key, value]: [string, string]) => ({ key, value }))
+  return { rows, retired }
+}
+
+function firstMissingLevel(field: FindingField, values: Record<string, string>): string | null {
+  for (const [depth, level] of choiceLevels(field).entries()) {
+    if (levelOptions(field, values, depth).length === 0) return null
+    if (filled(values[level.key]) === null) return level.label
+  }
+  return null
+}
+
+/**
+ * The label of the first missing required value, as the backend checks them: the severity always,
+ * a required text field when blank, and each level of a required choice that offers options under
+ * the chosen parent.
+ */
+export function firstMissingRequired(
+  fields: FindingFields,
+  severity: string,
+  fieldValues: Record<string, string>,
+): string | null {
+  const values: Record<string, string> = { ...fieldValues, [SEVERITY_KEY]: severity }
+  for (const field of allFields(fields)) {
+    if (field !== fields.severity && !field.required) continue
+    if (field.type === 'choice') {
+      const missing = firstMissingLevel(field, values)
+      if (missing !== null) return missing
+    } else if (filled(values[field.key]) === null) {
+      return field.label
+    }
+  }
+  return null
+}
+
+/** One badge per counted severity option, in option order, then one Other badge for every unmatched severity. */
+export function severityCountBadges(fields: FindingFields, counts: Record<string, number>): SeverityCountBadge[] {
+  const badges: SeverityCountBadge[] = []
+  for (const option of fields.severity.options) {
+    const count = counts[option.key] ?? 0
+    if (count > 0) badges.push({ key: option.key, ...severityBadge(fields, option.key), count, tooltip: null })
+  }
+  const optionKeys = new Set(fields.severity.options.map((option: FindingFieldOption) => option.key))
+  const unmatched = Object.entries(counts)
+    .filter(([severity, count]: [string, number]) => count > 0 && !optionKeys.has(severity))
+    .sort(([left]: [string, number], [right]: [string, number]) => left.localeCompare(right))
+  if (unmatched.length > 0) {
+    badges.push({
+      ...OTHER_SEVERITY_BADGE,
+      count: unmatched.reduce((total: number, [, count]: [string, number]) => total + count, 0),
+      tooltip: unmatched.map(([severity, count]: [string, number]) => `${severity}: ${count}`).join(', '),
+    })
+  }
+  return badges
+}
diff --git a/pyrit/backend/services/finding_export.py b/pyrit/backend/services/finding_export.py
index 3679c1d00a..9c061117e3 100644
--- a/pyrit/backend/services/finding_export.py
+++ b/pyrit/backend/services/finding_export.py
@@ -29,8 +29,7 @@
     FindingExportRequest,
 )
 from pyrit.backend.services.operation_service import OperationService
-from pyrit.models import Finding, FindingSeverity, ScoreStatus
-from pyrit.models.harm_category import HarmCategory
+from pyrit.models import Finding, FindingFields, ScoreStatus
 from pyrit.output.finding_report.markdown import MarkdownFindingReportPrinter
 from pyrit.output.finding_report.report import (
     DETAIL_SEPARATOR,
@@ -44,6 +43,7 @@
     FindingReportField,
     plain_text,
 )
+from pyrit.setup.finding_fields import get_active_finding_fields
 
 _MARKDOWN_MEDIA_TYPE = "text/markdown; charset=utf-8"
 _DOCX_MEDIA_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
@@ -113,14 +113,15 @@ async def _build_report_async(*, operation_id: UUID, request: FindingExportReque
     selected = await service.get_findings_with_evidence_async(
         operation_id=operation_id, finding_ids=request.finding_ids
     )
+    fields = get_active_finding_fields()
     report_findings = []
     for finding, evidence in selected:
-        severity, fields = _project_finding_fields(finding)
+        severity, projected = _project_finding_fields(finding, fields=fields)
         report_findings.append(
             FindingReportEntry(
                 title=finding.title,
                 severity=severity,
-                fields=fields,
+                fields=projected,
                 evidence=tuple(
                     _project_evidence(item=item, operation_id=operation_id, dashboard_origin=request.dashboard_origin)
                     for item in evidence
@@ -130,28 +131,29 @@ async def _build_report_async(*, operation_id: UUID, request: FindingExportReque
     return FindingReport(operation_name=operation.name, findings=tuple(report_findings))
 
 
-def _project_finding_fields(finding: Finding) -> tuple[FindingReportField, tuple[FindingReportField, ...]]:
+def _project_finding_fields(
+    finding: Finding, *, fields: FindingFields
+) -> tuple[FindingReportField, tuple[FindingReportField, ...]]:
     """
-    Label a finding's severity and its populated fields, in report order, and place each in a Word column.
+    Label a finding's severity and its filled fields, in configured order, and place each in a Word column.
 
-    Narrative text goes in the Finding column and classifications in the Assessment column.
+    Multiline text goes in the Finding column; choices and single-line text go in the Assessment column.
+    Internal fields and retired values are left out.
 
     Returns:
-        tuple[FindingReportField, tuple[FindingReportField, ...]]: The severity, then the populated fields.
+        tuple[FindingReportField, tuple[FindingReportField, ...]]: The severity, then the filled fields.
     """
-    severity = (
-        finding.severity_other or "Other"
-        if finding.severity == FindingSeverity.OTHER
-        else finding.severity.value.capitalize()
+    description = fields.describe_values(severity=finding.severity, field_values=finding.field_values)
+    projected = tuple(
+        FindingReportField(
+            label=row.label,
+            value=row.value,
+            column=FindingReportColumn.FINDING if row.multiline else FindingReportColumn.ASSESSMENT,
+        )
+        for row in description.rows
+        if not row.internal
     )
-    harm_type = finding.harm_type_other if finding.harm_type == HarmCategory.OTHER else finding.harm_type
-    fields = [
-        FindingReportField(label="Harm-type", value=str(harm_type), column=FindingReportColumn.ASSESSMENT)
-        if harm_type
-        else None,
-        FindingReportField(label="Description", value=finding.description) if finding.description else None,
-    ]
-    return FindingReportField(label="Severity", value=severity), tuple(field for field in fields if field)
+    return FindingReportField(label=fields.severity.label, value=description.severity_label), projected
 
 
 def _project_evidence(
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index f0d6e1a89e..1f2e2dbbe1 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -64,6 +64,7 @@ class FindingField(BaseModel):
         colors (dict[str, FindingSeverityColor]): The severity slot's badge color for each top-level option.
         hint (str | None): Help text under the field in the finding dialog.
         section (str | None): A heading the finding dialog shows where the section changes.
+        internal (bool): Whether the field and its levels stay out of exports. The dashboard still shows them.
     """
 
     model_config = ConfigDict(extra="forbid", frozen=True)
@@ -81,6 +82,7 @@ class FindingField(BaseModel):
     colors: dict[str, FindingSeverityColor] = {}
     hint: str | None = None
     section: str | None = None
+    internal: bool = False
 
     @field_validator("options", mode="before")
     @classmethod
@@ -202,6 +204,28 @@ def _check_top_level_references(self) -> None:
                 raise ValueError(f"'{key}' is not a top-level option of '{self.key}'.")
 
 
+class FindingValueRow(BaseModel):
+    """One filled value of a finding, labelled for display."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    key: str
+    label: str
+    value: str
+    multiline: bool
+    internal: bool
+
+
+class FindingValueDescription(BaseModel):
+    """A finding's values labelled for display, with the stored values that no field uses."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    severity_label: str
+    rows: list[FindingValueRow]
+    retired: list[tuple[str, str]]
+
+
 class FindingFields(BaseModel):
     """A deployment's finding fields: the severity slot and the fields shown after it."""
 
@@ -230,8 +254,8 @@ def _validate_severity_slot(cls, value: FindingField) -> FindingField:
             FindingField: The slot with ``required`` set to True.
 
         Raises:
-            ValueError: If the slot's key is not ``severity``, it is not a choice field, or it sets
-                ``required=False``.
+            ValueError: If the slot's key is not ``severity``, it is not a choice field, it sets
+                ``required=False``, or it is internal.
         """
         if value.key != "severity":
             raise ValueError(f"The severity slot's key must be 'severity', not '{value.key}'.")
@@ -239,6 +263,8 @@ def _validate_severity_slot(cls, value: FindingField) -> FindingField:
             raise ValueError("The severity slot must be a choice field.")
         if "required" in value.model_fields_set and not value.required:
             raise ValueError("The severity slot is always required; leave required out or set it to True.")
+        if value.internal:
+            raise ValueError("The severity slot can't be internal.")
         return value.model_copy(update={"required": True})
 
     @model_validator(mode="after")
@@ -297,6 +323,32 @@ def check_values(
         for field in [self.severity, *self.fields]:
             _check_field_values(field=field, values=values, previous_values=previous)
 
+    def describe_values(self, *, severity: str, field_values: dict[str, str]) -> FindingValueDescription:
+        """
+        Label a finding's filled values for display.
+
+        Rows follow the configured order: the severity slot's levels, then each field and its levels.
+        A choice value shows the label of the matching option under its stored parent; any other value
+        shows as typed.
+
+        Args:
+            severity (str): The severity slot's value.
+            field_values (dict[str, str]): The values of the other fields and of every level, by key.
+
+        Returns:
+            FindingValueDescription: The severity's label, one row per filled value, and the
+                ``(key, value)`` of each stored value that no field or level uses, in stored order.
+        """
+        values = {**field_values, "severity": severity}
+        rows = [row for field in [self.severity, *self.fields] for row in _value_rows(field=field, values=values)]
+        severity_option = _find_option(options=self.severity.options, value=severity)
+        known = self.field_keys
+        return FindingValueDescription(
+            severity_label=severity_option.label if severity_option is not None else severity,
+            rows=[row for row in rows if row.key != "severity"],
+            retired=[(key, value) for key, value in field_values.items() if key not in known],
+        )
+
     def _check_known_keys(self, *, field_values: dict[str, str], previous_values: dict[str, str]) -> None:
         """
         Reject a key that no field or level uses, unless its value has not changed.
@@ -513,7 +565,7 @@ def _check_level(
         if required and options:
             raise FindingValuesError(f"{label} is required.")
         return []
-    match = next((option for option in options if option.key == value), None)
+    match = _find_option(options=options, value=value)
     if match is not None:
         return match.children
     if not unchanged:
@@ -558,6 +610,46 @@ def _non_blank(value: str | None) -> str | None:
     return value if value and value.strip() else None
 
 
+def _find_option(*, options: list[FindingFieldOption], value: str | None) -> FindingFieldOption | None:
+    """
+    Find the option whose key is a dropdown's value.
+
+    Args:
+        options (list[FindingFieldOption]): The options the dropdown offers.
+        value (str | None): The dropdown's value, or None if it is missing.
+
+    Returns:
+        FindingFieldOption | None: The matching option, or None if no option has that key.
+    """
+    return next((option for option in options if option.key == value), None)
+
+
+def _value_rows(*, field: FindingField, values: dict[str, str]) -> Iterator[FindingValueRow]:
+    """
+    Label the filled values of one field and of its levels.
+
+    Args:
+        field (FindingField): The field.
+        values (dict[str, str]): Every value of the finding, by key.
+
+    Yields:
+        FindingValueRow: A row for each filled value, in level order.
+    """
+    options = field.options
+    for key, label in [(field.key, field.label), *field.levels]:
+        value = _non_blank(values.get(key))
+        match = _find_option(options=options, value=value)
+        options = match.children if match is not None else []
+        if value is not None:
+            yield FindingValueRow(
+                key=key,
+                label=label,
+                value=match.label if match is not None else value,
+                multiline=field.type == FindingFieldType.MULTILINE,
+                internal=field.internal,
+            )
+
+
 DEFAULT_FINDING_FIELDS = FindingFields(
     severity=FindingField(
         key="severity",
diff --git a/pyrit/setup/configuration_loader.py b/pyrit/setup/configuration_loader.py
index 2ceceb1f25..bcc601d798 100644
--- a/pyrit/setup/configuration_loader.py
+++ b/pyrit/setup/configuration_loader.py
@@ -91,9 +91,9 @@ class _ConfigurationLayer:
     reset_extensions: bool
 
 
-def _check_finding_fields_initializers(initializers: Sequence["PyRITInitializer"]) -> None:
+def _check_findings_initializers(initializers: Sequence["PyRITInitializer"]) -> None:
     """
-    Check the finding fields that ``FindingFieldsInitializer`` subclasses would set, without making them active.
+    Check the finding fields that ``FindingsInitializer`` subclasses would set, without making them active.
 
     Code that calls ``set_active_finding_fields`` directly isn't checked.
 
@@ -101,16 +101,16 @@ def _check_finding_fields_initializers(initializers: Sequence["PyRITInitializer"
         initializers (Sequence[PyRITInitializer]): The initializers of the replacement setup pass.
 
     Raises:
-        ValueError: If two or more ``FindingFieldsInitializer`` subclasses are configured, or the configured one
+        ValueError: If two or more ``FindingsInitializer`` subclasses are configured, or the configured one
             returns invalid fields or something other than ``FindingFields``.
     """
-    from pyrit.setup.initializers import FindingFieldsInitializer
+    from pyrit.setup.initializers import FindingsInitializer
 
-    setters = [initializer for initializer in initializers if isinstance(initializer, FindingFieldsInitializer)]
+    setters = [initializer for initializer in initializers if isinstance(initializer, FindingsInitializer)]
     if len(setters) > 1:
         first, second = (type(setter).__name__ for setter in setters[:2])
         raise ValueError(
-            f"{first} and {second} both set the finding fields. Use one FindingFieldsInitializer per deployment."
+            f"{first} and {second} both set the finding fields. Use one FindingsInitializer per deployment."
         )
     if not setters:
         return
@@ -738,7 +738,7 @@ async def preflight_reinitialization_async(
 
         Raises:
             ValueError: If an initializer is invalid, a required environment value is missing, more than one
-                ``FindingFieldsInitializer`` subclass is configured, or the configured one returns invalid finding
+                ``FindingsInitializer`` subclass is configured, or the configured one returns invalid finding
                 fields. Code that calls ``set_active_finding_fields`` directly isn't checked.
         """
         from pyrit.registry import InitializerRegistry
@@ -777,7 +777,7 @@ async def preflight_reinitialization_async(
                 raise ValueError(
                     f"Initializer '{type(initializer).__name__}' has missing required environment variables."
                 )
-        _check_finding_fields_initializers(initializers)
+        _check_findings_initializers(initializers)
 
         return PreparedReinitialization(
             environment_values=dict(environment_values),
diff --git a/pyrit/setup/finding_fields.py b/pyrit/setup/finding_fields.py
index c5b22e007c..e911dcfda7 100644
--- a/pyrit/setup/finding_fields.py
+++ b/pyrit/setup/finding_fields.py
@@ -36,7 +36,7 @@ def set_active_finding_fields(*, finding_fields: FindingFields, source: str) ->
     if _active is not None:
         raise ValueError(
             f"{source} cannot set the finding fields: {_active[1]} already set them in this setup pass. "
-            "Use one FindingFieldsInitializer per deployment."
+            "Use one FindingsInitializer per deployment."
         )
     _active = (finding_fields, source)
 
diff --git a/pyrit/setup/initializers/__init__.py b/pyrit/setup/initializers/__init__.py
index 6bd9964d5f..a069b659ba 100644
--- a/pyrit/setup/initializers/__init__.py
+++ b/pyrit/setup/initializers/__init__.py
@@ -11,7 +11,7 @@
 if TYPE_CHECKING:
     from pyrit.models.parameter import Parameter
     from pyrit.setup.initializers.converters import ConverterInitializer
-    from pyrit.setup.initializers.finding_fields import FindingFieldsInitializer
+    from pyrit.setup.initializers.findings import FindingsInitializer
     from pyrit.setup.initializers.load_default_datasets import LoadDefaultDatasets
     from pyrit.setup.initializers.preload_scenario_metadata import PreloadScenarioMetadata
     from pyrit.setup.initializers.refresh_datasets import RefreshDatasets
@@ -25,7 +25,7 @@
     "Parameter": "pyrit.models.parameter",
     "PyRITInitializer": "pyrit.setup.pyrit_initializer",
     "ConverterInitializer": "pyrit.setup.initializers.converters",
-    "FindingFieldsInitializer": "pyrit.setup.initializers.finding_fields",
+    "FindingsInitializer": "pyrit.setup.initializers.findings",
     "TechniqueInitializer": "pyrit.setup.initializers.techniques",
     "ToolsInitializer": "pyrit.setup.initializers.tools",
     "ScorerInitializer": "pyrit.setup.initializers.scorers",
diff --git a/pyrit/setup/initializers/finding_fields.py b/pyrit/setup/initializers/findings.py
similarity index 92%
rename from pyrit/setup/initializers/finding_fields.py
rename to pyrit/setup/initializers/findings.py
index d4025b0d3d..b7c31adf39 100644
--- a/pyrit/setup/initializers/finding_fields.py
+++ b/pyrit/setup/initializers/findings.py
@@ -1,7 +1,7 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-"""Base initializer for a deployment's finding fields."""
+"""Base initializer for a deployment's findings."""
 
 from abc import abstractmethod
 from typing import Any
@@ -11,7 +11,7 @@
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 
-class FindingFieldsInitializer(PyRITInitializer):
+class FindingsInitializer(PyRITInitializer):
     """Set a deployment's finding fields from ``get_finding_fields``."""
 
     @abstractmethod
diff --git a/tests/unit/backend/test_finding_export.py b/tests/unit/backend/test_finding_export.py
index 1b8ea16598..e846b3ae62 100644
--- a/tests/unit/backend/test_finding_export.py
+++ b/tests/unit/backend/test_finding_export.py
@@ -36,13 +36,14 @@
     ConversationType,
     Finding,
     FindingEvidence,
+    FindingField,
+    FindingFields,
     Message,
     MessagePiece,
     Operation,
     Score,
     ScoreStatus,
 )
-from pyrit.models.harm_category import HarmCategory
 from pyrit.output.finding_report.markdown import MarkdownFindingReportPrinter
 from pyrit.output.finding_report.report import (
     FindingReport,
@@ -51,6 +52,7 @@
     FindingReportEvidence,
     FindingReportField,
 )
+from pyrit.setup.finding_fields import set_active_finding_fields
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
@@ -80,6 +82,31 @@
 )
 NOT_SCORED = FindingReportField(label="Score", value="Not scored")
 NOT_IN_AN_OPERATION = FindingReportField(label="From operation", value="Not in an operation")
+CONTOSO_FIELDS = FindingFields(
+    severity=FindingField(
+        key="severity",
+        label="Impact",
+        type="choice",
+        levels=[("severity_rationale", "Impact rationale")],
+        options={
+            ("sev1", "Sev 1"): [("remote_no_auth", "Remote, no sign-in needed")],
+            ("sev2", "Sev 2"): [("signed_in_user", "Needs a signed-in user")],
+        },
+    ),
+    fields=[
+        FindingField(
+            key="category",
+            label="Category",
+            type="choice",
+            required=True,
+            levels=[("subcategory", "Subcategory")],
+            options={("model_security", "Model security"): [("system_prompt_leak", "System prompt leak")]},
+        ),
+        FindingField(key="steps", label="Steps to reproduce", type="multiline"),
+        FindingField(key="build", label="Build", type="text"),
+        FindingField(key="owner", label="Owner", type="text", internal=True),
+    ],
+)
 
 
 def _client() -> TestClient:
@@ -212,8 +239,7 @@ async def _save_named_findings_async(
             operation=operation,
             title="Critical finding",
             severity="critical",
-            harm_type=HarmCategory.PROFANITY,
-            description="Synthetic description\nsecond line",
+            field_values={"harm_type": "Profanity", "description": "Synthetic description\nsecond line"},
         ),
         "Included finding": await _add_finding_async(memory=memory, operation=operation, title="Included finding"),
         "Excluded finding": await _add_finding_async(memory=memory, operation=operation, title="Excluded finding"),
@@ -743,17 +769,15 @@ async def test_report_projects_optional_and_custom_fields(sqlite_instance: SQLit
         memory=sqlite_instance,
         operation=operation,
         title="Custom finding",
-        severity="other",
-        severity_other="Team severity",
-        harm_type=HarmCategory.OTHER,
-        harm_type_other="Team harm",
+        severity="Team severity",
+        field_values={"harm_type": "Team harm"},
     )
     plain = await _add_finding_async(
         memory=sqlite_instance,
         operation=operation,
         title="Plain finding",
         severity="informational",
-        description="Only text",
+        field_values={"description": "Only text"},
     )
     attack = await _add_attack_async(memory=sqlite_instance, conversation_id="main", objective="  ")
     evidence = await _link_async(memory=sqlite_instance, finding=custom, attack_result_id=attack.attack_result_id)
@@ -784,6 +808,53 @@ async def test_report_projects_optional_and_custom_fields(sqlite_instance: SQLit
     )
 
 
+@pytest.mark.usefixtures("reset_finding_fields")
+async def test_report_places_configured_fields_by_type(sqlite_instance: SQLiteMemory) -> None:
+    set_active_finding_fields(finding_fields=CONTOSO_FIELDS, source="test")
+    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso assistant"))
+    finding = await _add_finding_async(
+        memory=sqlite_instance,
+        operation=operation,
+        title="System prompt leak",
+        severity="Sev 2.5",
+        field_values={
+            "owner": "dana",
+            "description": "Retired text",
+            "steps": "1. Ask for the instructions\n2. Repeat them",
+            "build": "2026.10",
+            "subcategory": "system_prompt_leak",
+            "category": "model_security",
+            "severity_rationale": "remote_no_auth",
+        },
+    )
+
+    report = await _report_async(operation_id=operation.id, finding_ids=[finding.id])
+
+    # Internal fields and retired values stay out; the rationale has no matching parent, so it shows as typed.
+    assert report.findings == (
+        FindingReportEntry(
+            title="System prompt leak",
+            severity=FindingReportField(label="Impact", value="Sev 2.5"),
+            fields=(
+                FindingReportField(
+                    label="Impact rationale", value="remote_no_auth", column=FindingReportColumn.ASSESSMENT
+                ),
+                FindingReportField(label="Category", value="Model security", column=FindingReportColumn.ASSESSMENT),
+                FindingReportField(
+                    label="Subcategory", value="System prompt leak", column=FindingReportColumn.ASSESSMENT
+                ),
+                FindingReportField(
+                    label="Steps to reproduce",
+                    value="1. Ask for the instructions\n2. Repeat them",
+                    column=FindingReportColumn.FINDING,
+                ),
+                FindingReportField(label="Build", value="2026.10", column=FindingReportColumn.ASSESSMENT),
+            ),
+            evidence=(),
+        ),
+    )
+
+
 @pytest.mark.parametrize(
     ("score_value", "scorer", "expected"),
     [
diff --git a/tests/unit/memory/test_operation_service_findings.py b/tests/unit/backend/test_operation_service_findings.py
similarity index 100%
rename from tests/unit/memory/test_operation_service_findings.py
rename to tests/unit/backend/test_operation_service_findings.py
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index 83a18eb144..5301474f00 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -10,7 +10,7 @@
     FindingFields,
     FindingValuesError,
 )
-from pyrit.models.finding_fields import FindingFieldOption
+from pyrit.models.finding_fields import FindingFieldOption, FindingValueRow
 from pyrit.models.harm_category import HarmCategory
 
 CONTOSO = FindingFields(
@@ -59,7 +59,7 @@
             section="Reproduction",
             hint="List the prompts in the order you sent them.",
         ),
-        FindingField(key="owner", label="Owner", type="text", section="Tracking"),
+        FindingField(key="owner", label="Owner", type="text", section="Tracking", internal=True),
     ],
 )
 
@@ -196,6 +196,75 @@ def test_severity_slot_accepts_explicit_required() -> None:
     assert FindingFields.model_validate({"severity": {**SEVERITY, "required": True}}).severity.required is True
 
 
+def test_internal_defaults_to_false_and_is_rejected_on_the_severity_slot() -> None:
+    assert FindingField.model_validate(_choice()).internal is False
+    with pytest.raises(ValidationError, match="The severity slot can't be internal."):
+        FindingFields.model_validate({"severity": {**SEVERITY, "internal": True}})
+
+
+def test_describe_values_lists_filled_values_in_configured_order_and_retired_keys() -> None:
+    description = CONTOSO.describe_values(
+        severity="sev1",
+        field_values={
+            "owner": "dana",
+            "description": "Old text",
+            "category": "model_security",
+            "subcategory": "system_prompt_leak",
+            "technique": "Many-shot priming",
+            "steps": "   ",
+            "severity_rationale": "remote_no_auth",
+            "repro": "Older text",
+        },
+    )
+    assert description.severity_label == "Sev 1"
+    assert [(row.label, row.value) for row in description.rows] == [
+        ("Severity rationale", "Remote, no sign-in needed"),
+        ("Category", "Model security"),
+        ("Subcategory", "System prompt leak"),
+        ("Technique", "Many-shot priming"),
+        ("Owner", "dana"),
+    ]
+    assert description.retired == [("description", "Old text"), ("repro", "Older text")]
+
+
+def test_describe_values_shows_a_cascade_child_not_under_its_stored_parent_as_typed() -> None:
+    description = CONTOSO.describe_values(
+        severity="sev1", field_values={"category": "model_security", "subcategory": "hate_speech"}
+    )
+    assert [(row.label, row.value) for row in description.rows] == [
+        ("Category", "Model security"),
+        ("Subcategory", "hate_speech"),
+    ]
+
+
+def test_describe_values_shows_an_unmatched_severity_as_typed() -> None:
+    description = CONTOSO.describe_values(severity="Sev 2.5", field_values={"severity_rationale": "remote_no_auth"})
+    assert description.severity_label == "Sev 2.5"
+    assert [(row.label, row.value) for row in description.rows] == [("Severity rationale", "remote_no_auth")]
+
+
+def test_describe_values_carries_multiline_and_internal_on_each_row() -> None:
+    description = CONTOSO.describe_values(severity="sev2", field_values={"owner": "dana", "steps": "1. Open\n2. Ask"})
+    assert description.rows == [
+        FindingValueRow(
+            key="steps", label="Steps to reproduce", value="1. Open\n2. Ask", multiline=True, internal=False
+        ),
+        FindingValueRow(key="owner", label="Owner", value="dana", multiline=False, internal=True),
+    ]
+    assert description.retired == []
+
+
+def test_describe_values_labels_the_default_fields() -> None:
+    description = DEFAULT_FINDING_FIELDS.describe_values(
+        severity="critical", field_values={"description": "Synthetic text", "harm_type": "Hate Speech"}
+    )
+    assert description.severity_label == "Critical"
+    assert description.rows == [
+        FindingValueRow(key="harm_type", label="Harm-type", value="Hate Speech", multiline=False, internal=False),
+        FindingValueRow(key="description", label="Description", value="Synthetic text", multiline=True, internal=False),
+    ]
+
+
 VALID = {
     "severity_rationale": "remote_no_auth",
     "category": "model_security",
diff --git a/tests/unit/setup/test_finding_fields_initializer.py b/tests/unit/setup/test_findings_initializer.py
similarity index 83%
rename from tests/unit/setup/test_finding_fields_initializer.py
rename to tests/unit/setup/test_findings_initializer.py
index 55da1c7b62..5bf8cd1509 100644
--- a/tests/unit/setup/test_finding_fields_initializer.py
+++ b/tests/unit/setup/test_findings_initializer.py
@@ -11,7 +11,7 @@
 from pyrit.registry import InitializerRegistry
 from pyrit.registry.discovery import discover_in_directory
 from pyrit.setup.finding_fields import get_active_finding_fields
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 pytestmark = pytest.mark.usefixtures("reset_finding_fields")
@@ -22,10 +22,10 @@
 
 CONTOSO_SCRIPT = '''
 from pyrit.models import FindingField, FindingFields
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 
 
-class ContosoFindingFields(FindingFieldsInitializer):
+class ContosoFindingFields(FindingsInitializer):
     """Contoso finding fields."""
 
     def get_finding_fields(self) -> FindingFields:
@@ -35,14 +35,14 @@ def get_finding_fields(self) -> FindingFields:
 '''
 
 
-class ExampleFindingFields(FindingFieldsInitializer):
+class ExampleFindingFields(FindingsInitializer):
     """Example finding fields."""
 
     def get_finding_fields(self) -> FindingFields:
         return EXAMPLE
 
 
-async def test_finding_fields_initializer_sets_the_active_fields() -> None:
+async def test_findings_initializer_sets_the_active_fields() -> None:
     await ExampleFindingFields().initialize_async()
     assert get_active_finding_fields() is EXAMPLE
 
@@ -57,22 +57,22 @@ async def test_get_info_leaves_the_active_fields_alone() -> None:
     assert info["global_variables"] == []
 
 
-def test_finding_fields_initializer_is_skipped_by_builtin_discovery() -> None:
+def test_findings_initializer_is_skipped_by_builtin_discovery() -> None:
     directory = Path(pyrit.setup.initializers.__file__).parent
     names = [
         cls.__name__
         for _, _, cls in discover_in_directory(directory=directory, base_class=PyRITInitializer, recursive=True)
     ]
-    assert "FindingFieldsInitializer" not in names
+    assert "FindingsInitializer" not in names
 
 
 async def test_discovery_copy_shares_the_active_finding_fields() -> None:
-    path = Path(pyrit.setup.initializers.__file__).parent / "finding_fields.py"
-    spec = importlib.util.spec_from_file_location("discovered_module.finding_fields", path)
+    path = Path(pyrit.setup.initializers.__file__).parent / "findings.py"
+    spec = importlib.util.spec_from_file_location("discovered_module.findings", path)
     copy = importlib.util.module_from_spec(spec)
     spec.loader.exec_module(copy)
 
-    class CopiedFindingFields(copy.FindingFieldsInitializer):
+    class CopiedFindingFields(copy.FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
             return EXAMPLE
 
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index bbb1f80356..2f94efb109 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -19,7 +19,7 @@
 from pyrit.setup import IN_MEMORY, initialization, initialize_pyrit_async
 from pyrit.setup.finding_fields import get_active_finding_fields, set_active_finding_fields
 from pyrit.setup.initialization import reinitialize_pyrit_async
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 CUSTOM = FindingFields(
@@ -482,12 +482,12 @@ async def test_reinitialize_resets_finding_fields() -> None:
 
 
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
-async def test_second_finding_fields_initializer_stops_setup() -> None:
-    class FirstFindingFields(FindingFieldsInitializer):
+async def test_second_findings_initializer_stops_setup() -> None:
+    class FirstFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
             return CUSTOM
 
-    class SecondFindingFields(FindingFieldsInitializer):
+    class SecondFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
             return CUSTOM
 
@@ -502,7 +502,7 @@ def get_finding_fields(self) -> FindingFields:
 
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
 async def test_invalid_finding_fields_stop_setup() -> None:
-    class BrokenFindingFields(FindingFieldsInitializer):
+    class BrokenFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
             return FindingFields(
                 severity=CUSTOM.severity,
diff --git a/tests/unit/setup/test_reinitialization.py b/tests/unit/setup/test_reinitialization.py
index 77a903e355..8950484163 100644
--- a/tests/unit/setup/test_reinitialization.py
+++ b/tests/unit/setup/test_reinitialization.py
@@ -121,19 +121,19 @@ async def test_preflight_uses_isolated_registry_without_changing_live_state() ->
 
 
 @pytest.mark.usefixtures("reset_finding_fields")
-async def test_preflight_rejects_two_finding_fields_initializers(tmp_path: Path) -> None:
+async def test_preflight_rejects_two_findings_initializers(tmp_path: Path) -> None:
     script = tmp_path / "two_finding_fields.py"
     script.write_text(
         """
 from pyrit.models import FindingField, FindingFields
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 
 SEVERITY = FindingField(key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1")])
 
-class ContosoFindingFields(FindingFieldsInitializer):
+class ContosoFindingFields(FindingsInitializer):
     def get_finding_fields(self): return FindingFields(severity=SEVERITY)
 
-class ContosoBackupFields(FindingFieldsInitializer):
+class ContosoBackupFields(FindingsInitializer):
     def get_finding_fields(self): return FindingFields(severity=SEVERITY)
 """,
         encoding="utf-8",
@@ -143,7 +143,7 @@ def get_finding_fields(self): return FindingFields(severity=SEVERITY)
 
     message = (
         "ContosoBackupFields and ContosoFindingFields both set the finding fields. "
-        "Use one FindingFieldsInitializer per deployment."
+        "Use one FindingsInitializer per deployment."
     )
     with pytest.raises(ValueError, match=re.escape(message)):
         await config.preflight_reinitialization_async(environment_values={})
@@ -156,9 +156,9 @@ async def test_preflight_rejects_invalid_finding_fields(tmp_path: Path) -> None:
     script.write_text(
         """
 from pyrit.models import FindingField, FindingFields
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 
-class ContosoFindingFields(FindingFieldsInitializer):
+class ContosoFindingFields(FindingsInitializer):
     def get_finding_fields(self):
         return FindingFields(severity=FindingField(key="severity", label="Severity", type="choice", options=[]))
 """,
@@ -177,9 +177,9 @@ async def test_preflight_rejects_finding_fields_of_the_wrong_type(tmp_path: Path
     script = tmp_path / "wrong_type_finding_fields.py"
     script.write_text(
         """
-from pyrit.setup.initializers import FindingFieldsInitializer
+from pyrit.setup.initializers import FindingsInitializer
 
-class ContosoFindingFields(FindingFieldsInitializer):
+class ContosoFindingFields(FindingsInitializer):
     def get_finding_fields(self):
         return {}
 """,

From f03c0777d5c7fac6dd03f7a7d8376757bbb687b5 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 09:35:52 -0400
Subject: [PATCH 09/20] Add the finding field input with cascades and Other
 text

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Operations/FindingFieldInput.styles.ts    |   9 +
 .../Operations/FindingFieldInput.test.tsx     | 371 ++++++++++++++++++
 .../Operations/FindingFieldInput.tsx          | 226 +++++++++++
 3 files changed, 606 insertions(+)
 create mode 100644 frontend/src/components/Operations/FindingFieldInput.styles.ts
 create mode 100644 frontend/src/components/Operations/FindingFieldInput.test.tsx
 create mode 100644 frontend/src/components/Operations/FindingFieldInput.tsx

diff --git a/frontend/src/components/Operations/FindingFieldInput.styles.ts b/frontend/src/components/Operations/FindingFieldInput.styles.ts
new file mode 100644
index 0000000000..4e89a28223
--- /dev/null
+++ b/frontend/src/components/Operations/FindingFieldInput.styles.ts
@@ -0,0 +1,9 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+const LISTBOX_MAX_HEIGHT = '240px'
+
+export const useFindingFieldInputStyles = makeStyles({
+  levels: { display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalM },
+  picker: { minWidth: 0, width: '100%' },
+  listbox: { maxHeight: LISTBOX_MAX_HEIGHT, overflowY: 'auto' },
+})
diff --git a/frontend/src/components/Operations/FindingFieldInput.test.tsx b/frontend/src/components/Operations/FindingFieldInput.test.tsx
new file mode 100644
index 0000000000..80ea60feaa
--- /dev/null
+++ b/frontend/src/components/Operations/FindingFieldInput.test.tsx
@@ -0,0 +1,371 @@
+import React, { useState } from 'react'
+import { render, screen } from '@testing-library/react'
+import userEvent, { type UserEvent } from '@testing-library/user-event'
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+
+import { CONTOSO_FINDING_FIELDS } from '@/test-utils/findingFieldsFixtures'
+import type { FindingField, FindingFieldOption } from '@/types'
+
+import FindingFieldInput from './FindingFieldInput'
+
+const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+)
+
+const UNMATCHED_HINT = 'Not a current option. It stays unless you change it.'
+
+function contosoField(key: string): FindingField {
+  const field = CONTOSO_FINDING_FIELDS.fields.find((candidate: FindingField) => candidate.key === key)
+  if (field === undefined) throw new Error(`CONTOSO_FINDING_FIELDS has no field ${key}`)
+  return field
+}
+
+function option(key: string, label: string, children: FindingFieldOption[] = []): FindingFieldOption {
+  return { key, label, children }
+}
+
+const CATEGORY = contosoField('category')
+const TECHNIQUE = contosoField('technique')
+const STEPS = contosoField('steps')
+const OWNER = contosoField('owner')
+
+// Both surfaces list a `plugins` component, but only the web chat's plugins include email.
+const SURFACE: FindingField = {
+  ...CATEGORY,
+  key: 'surface',
+  label: 'Surface',
+  levels: [['component', 'Component'], ['capability', 'Capability']],
+  options: [
+    option('web_chat', 'Web chat', [
+      option('plugins', 'Plugins', [option('calendar', 'Calendar'), option('email', 'Email')]),
+    ]),
+    option('mobile_app', 'Mobile app', [option('plugins', 'Plugins', [option('calendar', 'Calendar')])]),
+  ],
+}
+
+// Outage is a leaf option, so it leaves Impact detail nothing to offer.
+const IMPACT: FindingField = {
+  ...CATEGORY,
+  key: 'impact',
+  label: 'Impact',
+  levels: [['impact_detail', 'Impact detail']],
+  options: [
+    option('data_exposure', 'Data exposure', [option('customer_records', 'Customer records')]),
+    option('outage', 'Outage'),
+  ],
+}
+
+const TACTIC: FindingField = { ...TECHNIQUE, key: 'tactic', label: 'Tactic' }
+
+interface FieldHarnessProps {
+  field: FindingField
+  initialValues: Record<string, string>
+  onChange: (changes: Record<string, string>) => void
+  onOtherBlankChange?: (blank: boolean) => void
+}
+
+// Holds the draft the way the finding dialog will, so a test can follow several changes.
+function FieldHarness({ field, initialValues, onChange, onOtherBlankChange }: FieldHarnessProps) {
+  const [values, setValues] = useState(initialValues)
+  return (
+    <FindingFieldInput field={field} values={values} onOtherBlankChange={onOtherBlankChange}
+      onChange={(changes: Record<string, string>) => {
+        onChange(changes)
+        setValues((previous) => ({ ...previous, ...changes }))
+      }} />
+  )
+}
+
+async function openPicker(user: UserEvent, label: string): Promise<void> {
+  await user.click(screen.getByRole('combobox', { name: label }))
+  await screen.findByRole('listbox')
+}
+
+async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
+  await openPicker(user, label)
+  await user.click(screen.getByRole('option', { name: optionName }))
+}
+
+function optionNames(): string[] {
+  return screen.getAllByRole('option').map((element: HTMLElement) => element.textContent ?? '')
+}
+
+describe('FindingFieldInput', () => {
+  const onChange = jest.fn()
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('renders a text or multiline field with its label, hint and required marker', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FindingFieldInput field={STEPS} values={{ steps: '1. Open a chat' }} onChange={onChange} />
+      <FindingFieldInput field={OWNER} values={{}} onChange={onChange} />
+    </TestWrapper>)
+
+    const steps = screen.getByRole('textbox', { name: 'Steps to reproduce' })
+    expect(steps).toBeInstanceOf(HTMLTextAreaElement)
+    expect(steps).toHaveValue('1. Open a chat')
+    expect(steps).toBeRequired()
+    expect(steps).toHaveAccessibleDescription('List each prompt you sent to the Contoso assistant, in order.')
+    expect(screen.getByText('List each prompt you sent to the Contoso assistant, in order.')).toBeInTheDocument()
+
+    const owner = screen.getByRole('textbox', { name: 'Owner' })
+    expect(owner).toBeInstanceOf(HTMLInputElement)
+    expect(owner).toHaveValue('')
+    expect(owner).not.toBeRequired()
+    expect(owner).not.toHaveAccessibleDescription()
+
+    await user.type(steps, '.')
+    expect(onChange).toHaveBeenLastCalledWith({ steps: '1. Open a chat.' })
+    await user.type(owner, 'C')
+    expect(onChange).toHaveBeenLastCalledWith({ owner: 'C' })
+  })
+
+  it('picks a cascade path level by level and disables a level until its parent has a value', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><FieldHarness field={CATEGORY} initialValues={{}} onChange={onChange} /></TestWrapper>)
+
+    expect(screen.getByRole('combobox', { name: 'Category' })).toBeEnabled()
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).toBeDisabled()
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).not.toBeRequired()
+
+    await pick(user, 'Category', 'Model security')
+    expect(onChange).toHaveBeenLastCalledWith({ category: 'model_security' })
+    expect(screen.getByRole('combobox', { name: 'Category' })).toHaveValue('Model security')
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).toBeEnabled()
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).toBeRequired()
+
+    await openPicker(user, 'Subcategory')
+    expect(optionNames()).toEqual(['System prompt leak', 'Tool misuse'])
+    await user.click(screen.getByRole('option', { name: 'Tool misuse' }))
+    expect(onChange).toHaveBeenLastCalledWith({ subcategory: 'tool_misuse' })
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).toHaveValue('Tool misuse')
+  })
+
+  it('clears a child that is not valid under the new parent and keeps one that is', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={CATEGORY} initialValues={{ category: 'model_security', subcategory: 'system_prompt_leak' }}
+        onChange={onChange} />
+      <FieldHarness field={SURFACE} initialValues={{ surface: 'web_chat', component: 'plugins', capability: 'email' }}
+        onChange={onChange} />
+    </TestWrapper>)
+
+    await pick(user, 'Category', 'Content safety')
+    expect(onChange).toHaveBeenLastCalledWith({ category: 'content_safety', subcategory: '' })
+    expect(screen.getByRole('combobox', { name: 'Subcategory' })).toHaveValue('')
+
+    await pick(user, 'Surface', 'Mobile app')
+    expect(onChange).toHaveBeenLastCalledWith({ surface: 'mobile_app', capability: '' })
+    expect(screen.getByRole('combobox', { name: 'Component' })).toHaveValue('Plugins')
+    expect(screen.getByRole('combobox', { name: 'Capability' })).toHaveValue('')
+
+    await pick(user, 'Capability', 'Calendar')
+    await pick(user, 'Surface', 'Web chat')
+    expect(onChange).toHaveBeenLastCalledWith({ surface: 'web_chat' })
+    expect(screen.getByRole('combobox', { name: 'Component' })).toHaveValue('Plugins')
+    expect(screen.getByRole('combobox', { name: 'Capability' })).toHaveValue('Calendar')
+  })
+
+  it('offers Other on a single-level field and reports the typed text as the value', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={TECHNIQUE} initialValues={{}} onChange={onChange} />
+      <FindingFieldInput field={{ ...CATEGORY, allow_other: true }} values={{}} onChange={onChange} />
+    </TestWrapper>)
+
+    await openPicker(user, 'Category')
+    expect(screen.queryByRole('option', { name: 'Other' })).not.toBeInTheDocument()
+    await user.keyboard('{Escape}')
+
+    await openPicker(user, 'Technique')
+    expect(optionNames()).toEqual(['Not set', 'Prompt injection', 'Role play', 'Other'])
+    await user.click(screen.getByRole('option', { name: 'Other' }))
+    expect(onChange).toHaveBeenLastCalledWith({ technique: '' })
+    expect(screen.getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
+
+    const otherText = screen.getByRole('textbox', { name: 'Other Technique' })
+    expect(otherText).toBeRequired()
+    await user.type(otherText, 'Many-shot')
+    expect(onChange).toHaveBeenLastCalledWith({ technique: 'Many-shot' })
+    expect(otherText).toHaveValue('Many-shot')
+    expect(screen.getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
+
+    await pick(user, 'Technique', 'Role play')
+    expect(onChange).toHaveBeenLastCalledWith({ technique: 'role_play' })
+    expect(screen.queryByRole('textbox', { name: 'Other Technique' })).not.toBeInTheDocument()
+  })
+
+  it('opens a stored Other value with its text', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={TECHNIQUE} initialValues={{ technique: 'Model extraction' }} onChange={onChange} />
+    </TestWrapper>)
+
+    expect(screen.getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
+    expect(screen.getByRole('textbox', { name: 'Other Technique' })).toHaveValue('Model extraction')
+    expect(screen.queryByText(UNMATCHED_HINT)).not.toBeInTheDocument()
+
+    await openPicker(user, 'Technique')
+    await user.click(screen.getByRole('option', { name: 'Other', selected: true }))
+    await user.tab()
+    expect(onChange).not.toHaveBeenCalled()
+    expect(screen.getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
+    expect(screen.getByRole('textbox', { name: 'Other Technique' })).toHaveValue('Model extraction')
+  })
+
+  it('shows a stored value that is no longer an option and keeps it until changed', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={CATEGORY} initialValues={{ category: 'model_security', subcategory: 'Training data leak' }}
+        onChange={onChange} />
+      <FindingFieldInput field={CONTOSO_FINDING_FIELDS.severity} values={{ severity: 'Sev 0' }} onChange={onChange} />
+    </TestWrapper>)
+
+    const severity = screen.getByRole('combobox', { name: 'Severity' })
+    expect(severity).toHaveValue('Sev 0')
+    expect(severity).toHaveAccessibleDescription(UNMATCHED_HINT)
+
+    const subcategory = screen.getByRole('combobox', { name: 'Subcategory' })
+    expect(subcategory).toHaveValue('Training data leak')
+    expect(subcategory).toHaveAccessibleDescription(UNMATCHED_HINT)
+    await openPicker(user, 'Subcategory')
+    expect(optionNames()).toEqual(['Training data leak', 'System prompt leak', 'Tool misuse'])
+    await user.click(screen.getByRole('option', { name: 'Training data leak', selected: true }))
+    await user.tab()
+    expect(onChange).not.toHaveBeenCalled()
+    expect(subcategory).toHaveValue('Training data leak')
+
+    await pick(user, 'Subcategory', 'Tool misuse')
+    expect(onChange).toHaveBeenLastCalledWith({ subcategory: 'tool_misuse' })
+    expect(subcategory).toHaveValue('Tool misuse')
+    expect(subcategory).not.toHaveAccessibleDescription()
+    await openPicker(user, 'Subcategory')
+    expect(optionNames()).toEqual(['System prompt leak', 'Tool misuse'])
+  })
+
+  it('offers Not set only on optional fields', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={TECHNIQUE} initialValues={{ technique: 'role_play' }} onChange={onChange} />
+      <FindingFieldInput field={CATEGORY} values={{ category: 'model_security' }} onChange={onChange} />
+      <FindingFieldInput field={{ ...SURFACE, required: false }} values={{ surface: 'web_chat' }} onChange={onChange} />
+    </TestWrapper>)
+
+    await openPicker(user, 'Category')
+    expect(screen.queryByRole('option', { name: 'Not set' })).not.toBeInTheDocument()
+    await user.keyboard('{Escape}')
+
+    await openPicker(user, 'Surface')
+    expect(screen.getByRole('option', { name: 'Not set' })).toBeInTheDocument()
+    await user.keyboard('{Escape}')
+    await openPicker(user, 'Component')
+    expect(screen.queryByRole('option', { name: 'Not set' })).not.toBeInTheDocument()
+    await user.keyboard('{Escape}')
+
+    await pick(user, 'Technique', 'Not set')
+    expect(onChange).toHaveBeenLastCalledWith({ technique: '' })
+    expect(screen.getByRole('combobox', { name: 'Technique' })).toHaveValue('')
+  })
+
+  it('filters options by the typed text', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={CATEGORY} initialValues={{}} onChange={onChange} />
+      <FieldHarness field={TECHNIQUE} initialValues={{}} onChange={onChange} />
+    </TestWrapper>)
+
+    const category = screen.getByRole('combobox', { name: 'Category' })
+    await user.type(category, 'safety')
+    expect(optionNames()).toEqual(['Content safety'])
+    await user.clear(category)
+    await user.type(category, 'zzz')
+    expect(screen.getByRole('option', { name: 'No matching options' })).toHaveAttribute('aria-disabled', 'true')
+    await user.keyboard('{Escape}')
+
+    await user.type(screen.getByRole('combobox', { name: 'Technique' }), 'zzz')
+    expect(optionNames()).toEqual(['Not set', 'No matching options', 'Other'])
+    expect(onChange).not.toHaveBeenCalled()
+
+    await user.click(screen.getByRole('option', { name: 'Other' }))
+    expect(onChange).toHaveBeenLastCalledWith({ technique: '' })
+    expect(screen.getByRole('textbox', { name: 'Other Technique' })).toHaveValue('')
+  })
+
+  it('reports whether the Other text is blank', async () => {
+    const user = userEvent.setup()
+    const onOtherBlankChange = jest.fn()
+    const onStoredOtherBlankChange = jest.fn()
+    render(<TestWrapper>
+      <FieldHarness field={TECHNIQUE} initialValues={{}} onChange={onChange} onOtherBlankChange={onOtherBlankChange} />
+      <FieldHarness field={TACTIC} initialValues={{ tactic: 'Model extraction' }} onChange={onChange}
+        onOtherBlankChange={onStoredOtherBlankChange} />
+    </TestWrapper>)
+    expect(onOtherBlankChange).not.toHaveBeenCalled()
+    expect(onStoredOtherBlankChange).not.toHaveBeenCalled()
+
+    await pick(user, 'Technique', 'Other')
+    expect(onOtherBlankChange).toHaveBeenLastCalledWith(true)
+    const otherText = screen.getByRole('textbox', { name: 'Other Technique' })
+    await user.type(otherText, 'Many-shot')
+    expect(onOtherBlankChange).toHaveBeenLastCalledWith(false)
+    await user.clear(otherText)
+    expect(onOtherBlankChange).toHaveBeenLastCalledWith(true)
+    await pick(user, 'Technique', 'Role play')
+    expect(onOtherBlankChange).toHaveBeenLastCalledWith(false)
+
+    await user.clear(screen.getByRole('textbox', { name: 'Other Tactic' }))
+    expect(onStoredOtherBlankChange).toHaveBeenCalledTimes(1)
+    expect(onStoredOtherBlankChange).toHaveBeenLastCalledWith(true)
+  })
+
+  it('disables a lower level with nothing to offer and leaves it unmarked', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={IMPACT} initialValues={{ impact: 'Service degradation' }} onChange={onChange} />
+    </TestWrapper>)
+    const detail = screen.getByRole('combobox', { name: 'Impact detail' })
+    expect(screen.getByRole('combobox', { name: 'Impact' })).toHaveValue('Service degradation')
+    expect(detail).toBeDisabled()
+    expect(detail).not.toBeRequired()
+
+    await pick(user, 'Impact', 'Outage')
+    expect(onChange).toHaveBeenLastCalledWith({ impact: 'outage' })
+    expect(detail).toBeDisabled()
+    expect(detail).not.toBeRequired()
+
+    await pick(user, 'Impact', 'Data exposure')
+    expect(detail).toBeEnabled()
+    expect(detail).toBeRequired()
+  })
+
+  it('disables every control while disabled', () => {
+    render(<TestWrapper>
+      <FindingFieldInput field={STEPS} values={{}} disabled onChange={onChange} />
+      <FindingFieldInput field={OWNER} values={{}} disabled onChange={onChange} />
+      <FindingFieldInput field={CATEGORY} values={{ category: 'model_security' }} disabled onChange={onChange} />
+      <FindingFieldInput field={TECHNIQUE} values={{ technique: 'Model extraction' }} disabled onChange={onChange} />
+    </TestWrapper>)
+    const comboboxes = screen.getAllByRole('combobox')
+    const textboxes = screen.getAllByRole('textbox')
+    expect(comboboxes).toHaveLength(3)
+    expect(textboxes).toHaveLength(3)
+    for (const control of [...comboboxes, ...textboxes]) expect(control).toBeDisabled()
+  })
+
+  it('clears every lower level when an optional cascade is set to Not set', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={{ ...SURFACE, required: false }}
+        initialValues={{ surface: 'web_chat', component: 'plugins', capability: 'email' }} onChange={onChange} />
+    </TestWrapper>)
+
+    await pick(user, 'Surface', 'Not set')
+    expect(onChange).toHaveBeenLastCalledWith({ surface: '', component: '', capability: '' })
+    expect(screen.getByRole('combobox', { name: 'Surface' })).toHaveValue('')
+    expect(screen.getByRole('combobox', { name: 'Component' })).toBeDisabled()
+    expect(screen.getByRole('combobox', { name: 'Capability' })).toBeDisabled()
+  })
+})
diff --git a/frontend/src/components/Operations/FindingFieldInput.tsx b/frontend/src/components/Operations/FindingFieldInput.tsx
new file mode 100644
index 0000000000..b047763dee
--- /dev/null
+++ b/frontend/src/components/Operations/FindingFieldInput.tsx
@@ -0,0 +1,226 @@
+import { useState, type JSX } from 'react'
+import { Combobox, Field, Input, Option, Textarea } from '@fluentui/react-components'
+
+import type { FindingField, FindingFieldOption } from '@/types'
+import { choiceLevels, levelOptions } from '@/utils/findingFields'
+
+import { useFindingFieldInputStyles } from './FindingFieldInput.styles'
+
+// Option keys are never blank (the backend rejects them), so a whitespace-only value can't be one. '' is Not set.
+const OTHER_VALUE = ' '
+const OTHER_TEXT = 'Other'
+const NOT_SET_TEXT = 'Not set'
+const NO_MATCH_TEXT = 'No matching options'
+const UNMATCHED_HINT = 'Not a current option. It stays unless you change it.'
+
+interface FindingFieldInputProps {
+  field: FindingField
+  /** The whole draft by key. The severity slot's value goes under `severity`. */
+  values: Record<string, string>
+  disabled?: boolean
+  /** Reports the keys to set. '' clears a value. */
+  onChange: (changes: Record<string, string>) => void
+  /** Reports whether the Other text box is showing with blank text. */
+  onOtherBlankChange?: (blank: boolean) => void
+}
+
+interface FieldControlProps {
+  field: FindingField
+  values: Record<string, string>
+  disabled: boolean
+  onChange: (changes: Record<string, string>) => void
+}
+
+interface ChoiceFieldInputProps extends FieldControlProps {
+  onOtherBlankChange?: (blank: boolean) => void
+}
+
+interface PickerOption {
+  value: string
+  text: string
+}
+
+interface LevelState {
+  options: PickerOption[]
+  selected: string
+  hint?: string
+  /** Required only where the path offers options, as the backend checks a required cascade. */
+  required: boolean
+  unavailable: boolean
+}
+
+function storedValue(values: Record<string, string>, key: string): string {
+  const value = values[key] ?? ''
+  return value.trim() === '' ? '' : value
+}
+
+function isOption(options: FindingFieldOption[], value: string): boolean {
+  return options.some((option: FindingFieldOption) => option.key === value)
+}
+
+function levelHint(field: FindingField, depth: number, unmatched: boolean): string | undefined {
+  if (unmatched) return UNMATCHED_HINT
+  return depth === 0 ? field.hint ?? undefined : undefined
+}
+
+/**
+ * What one dropdown of a choice field offers and shows. A stored value that isn't an option under its path is
+ * listed as typed and stays selected, unless the field is showing Other text.
+ */
+function levelState(field: FindingField, values: Record<string, string>, depth: number, otherChosen: boolean): LevelState {
+  const levels = choiceLevels(field)
+  const fieldOptions = levelOptions(field, values, depth)
+  const options = fieldOptions.map((option: FindingFieldOption) => ({ value: option.key, text: option.label }))
+  const value = storedValue(values, levels[depth].key)
+  const unmatched = !otherChosen && value !== '' && !isOption(fieldOptions, value)
+  const parentBlank = depth > 0 && storedValue(values, levels[depth - 1].key) === ''
+  return {
+    options: unmatched ? [{ value, text: value }, ...options] : options,
+    selected: otherChosen ? OTHER_VALUE : value,
+    hint: levelHint(field, depth, unmatched),
+    required: field.required && fieldOptions.length > 0,
+    unavailable: depth > 0 && (parentBlank || (options.length === 0 && !unmatched)),
+  }
+}
+
+/** The chosen value, plus a clear for each lower level whose value isn't an option under the new path. */
+function cascadeChanges(
+  field: FindingField,
+  values: Record<string, string>,
+  depth: number,
+  value: string,
+): Record<string, string> {
+  const levels = choiceLevels(field)
+  const changes: Record<string, string> = { [levels[depth].key]: value }
+  const next = { ...values, ...changes }
+  for (const [lower, level] of levels.entries()) {
+    if (lower <= depth) continue
+    const current = storedValue(next, level.key)
+    if (current === '' || isOption(levelOptions(field, next, lower), current)) continue
+    changes[level.key] = ''
+    next[level.key] = ''
+  }
+  return changes
+}
+
+function selectedText(options: PickerOption[], selected: string): string {
+  if (selected === OTHER_VALUE) return OTHER_TEXT
+  return options.find((option: PickerOption) => option.value === selected)?.text ?? ''
+}
+
+interface ChoiceLevelPickerProps {
+  label: string
+  hint?: string
+  required: boolean
+  disabled: boolean
+  /** The options the typed text filters. Not set and Other always show. */
+  options: PickerOption[]
+  selected: string
+  offerNotSet: boolean
+  offerOther: boolean
+  onSelect: (optionValue: string) => void
+}
+
+function ChoiceLevelPicker({
+  label, hint, required, disabled, options, selected, offerNotSet, offerOther, onSelect,
+}: ChoiceLevelPickerProps): JSX.Element {
+  const styles = useFindingFieldInputStyles()
+  const [open, setOpen] = useState(false)
+  const [search, setSearch] = useState('')
+  const matches = options.filter((option: PickerOption) => option.text.toLowerCase().includes(search.toLowerCase()))
+
+  return (
+    <Field label={label} hint={hint} required={required}>
+      <Combobox className={styles.picker} inlinePopup open={open} disabled={disabled}
+        placeholder={offerNotSet ? NOT_SET_TEXT : undefined}
+        value={open ? search : selectedText(options, selected)} selectedOptions={[selected]}
+        onOpenChange={(_, data) => { setOpen(data.open); setSearch('') }}
+        onChange={(event) => { setSearch(event.target.value); setOpen(true) }}
+        onOptionSelect={(_, data) => {
+          // Typed text that no longer matches the selection clears Fluent's selection without a value. Clicking the
+          // selected option, or blurring on its text, selects it again, so only a different option is a change.
+          if (data.optionValue === undefined) return
+          setOpen(false)
+          setSearch('')
+          if (data.optionValue !== selected) onSelect(data.optionValue)
+        }}
+        listbox={{ className: styles.listbox }}>
+        {offerNotSet && <Option value="">{NOT_SET_TEXT}</Option>}
+        {matches.map((option: PickerOption) => <Option key={option.value} value={option.value}>{option.text}</Option>)}
+        {matches.length === 0 && <Option disabled>{NO_MATCH_TEXT}</Option>}
+        {offerOther && <Option value={OTHER_VALUE}>{OTHER_TEXT}</Option>}
+      </Combobox>
+    </Field>
+  )
+}
+
+function ChoiceFieldInput({
+  field, values, disabled, onChange, onOtherBlankChange,
+}: ChoiceFieldInputProps): JSX.Element {
+  const styles = useFindingFieldInputStyles()
+  const levels = choiceLevels(field)
+  const allowOther = field.allow_other && levels.length === 1
+  const [otherChosen, setOtherChosen] = useState(() => {
+    const value = storedValue(values, field.key)
+    return allowOther && value !== '' && !isOption(field.options, value)
+  })
+
+  const select = (depth: number, optionValue: string): void => {
+    if (allowOther) {
+      setOtherChosen(optionValue === OTHER_VALUE)
+      onOtherBlankChange?.(optionValue === OTHER_VALUE)
+    }
+    onChange(cascadeChanges(field, values, depth, optionValue === OTHER_VALUE ? '' : optionValue))
+  }
+
+  return (
+    <div className={styles.levels}>
+      {levels.map((level: { key: string; label: string }, depth: number) => {
+        const state = levelState(field, values, depth, depth === 0 && otherChosen)
+        return (
+          <ChoiceLevelPicker key={level.key} label={level.label} hint={state.hint} required={state.required}
+            disabled={disabled || state.unavailable} options={state.options} selected={state.selected}
+            offerNotSet={depth === 0 && !field.required} offerOther={allowOther}
+            onSelect={(optionValue: string) => { select(depth, optionValue) }} />
+        )
+      })}
+      {otherChosen && <Field label={`${OTHER_TEXT} ${field.label}`} required>
+        <Input value={values[field.key] ?? ''} disabled={disabled} name={field.key} autoComplete="off"
+          onChange={(_, data) => {
+            onOtherBlankChange?.(data.value.trim() === '')
+            onChange({ [field.key]: data.value })
+          }} />
+      </Field>}
+    </div>
+  )
+}
+
+function TextFieldInput({ field, values, disabled, onChange }: FieldControlProps): JSX.Element {
+  const value = values[field.key] ?? ''
+  const report = (text: string): void => { onChange({ [field.key]: text }) }
+  return (
+    <Field label={field.label} hint={field.hint ?? undefined} required={field.required}>
+      {field.type === 'multiline'
+        ? <Textarea value={value} disabled={disabled} resize="vertical" name={field.key} autoComplete="off"
+          onChange={(_, data) => { report(data.value) }} />
+        : <Input value={value} disabled={disabled} name={field.key} autoComplete="off"
+          onChange={(_, data) => { report(data.value) }} />}
+    </Field>
+  )
+}
+
+/**
+ * The input for one finding field: a text box for a `text` or `multiline` field, and one searchable dropdown per
+ * level for a `choice` field. Changing a cascade level clears each lower level that its new path doesn't offer.
+ * A single-level choice with `allow_other` also takes typed Other text, and a stored value that isn't an option
+ * stays selected until the user picks another.
+ */
+export default function FindingFieldInput({
+  field, values, disabled = false, onChange, onOtherBlankChange,
+}: FindingFieldInputProps): JSX.Element {
+  if (field.type === 'choice') {
+    return <ChoiceFieldInput field={field} values={values} disabled={disabled} onChange={onChange}
+      onOtherBlankChange={onOtherBlankChange} />
+  }
+  return <TextFieldInput field={field} values={values} disabled={disabled} onChange={onChange} />
+}

From 8491d95b72f9d90201a82bc94248602530a96ad4 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 09:35:53 -0400
Subject: [PATCH 10/20] Render CoPyRIT findings from the configured finding
 fields

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Chat/FindingEvidenceDialog.test.tsx       |  62 ++-
 .../components/Chat/FindingEvidenceDialog.tsx |  17 +-
 .../Operations/FindingCardValues.tsx          |  45 ++
 .../Operations/FindingDialog.styles.ts        |   3 +-
 .../Operations/FindingDialog.test.tsx         | 434 ++++++++++++------
 .../components/Operations/FindingDialog.tsx   | 198 ++++----
 .../Operations/FindingExportDialog.test.tsx   |  42 +-
 .../Operations/FindingExportDialog.tsx        |  22 +-
 .../Operations/FindingSeverityBadge.tsx       |  17 +-
 .../Operations/OperationDetailPage.test.tsx   | 150 +++++-
 .../Operations/OperationDetailPage.tsx        |  51 +-
 .../Operations/Operations.styles.ts           |  18 +
 .../Operations/OperationsPage.test.tsx        |  37 +-
 .../components/Operations/OperationsPage.tsx  |  86 ++--
 frontend/src/hooks/useFindingFields.test.tsx  |  19 +
 frontend/src/hooks/useFindingFields.ts        |  15 +-
 frontend/src/services/api.test.ts             |  13 +-
 frontend/src/services/api.ts                  |   8 +-
 frontend/src/types/index.ts                   |  17 +-
 frontend/src/utils/findingSeverity.test.ts    |  20 -
 frontend/src/utils/findingSeverity.ts         |  16 -
 21 files changed, 857 insertions(+), 433 deletions(-)
 create mode 100644 frontend/src/components/Operations/FindingCardValues.tsx
 delete mode 100644 frontend/src/utils/findingSeverity.test.ts
 delete mode 100644 frontend/src/utils/findingSeverity.ts

diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
index b30efff3dd..945b441070 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
@@ -5,6 +5,7 @@ import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter } from 'react-router'
 
 import { attacksApi, operationsApi } from '@/services/api'
+import { DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { FindingListItem } from '@/types'
 import FindingEvidenceDialog from './FindingEvidenceDialog'
 
@@ -12,12 +13,12 @@ jest.mock('@/services/api', () => ({
   attacksApi: { getAttack: jest.fn() },
   operationsApi: {
     get: jest.fn(), list: jest.fn(), listFindings: jest.fn(), attachFindingEvidence: jest.fn(), createFinding: jest.fn(),
-    getFindingOptions: jest.fn(),
+    getFindingFields: jest.fn(),
   },
 }))
 
 const FINDING: FindingListItem = {
-  id: 'finding', operation_id: 'saved', title: 'Proof', severity: 'low', description: '',
+  id: 'finding', operation_id: 'saved', title: 'Proof', severity: 'low', field_values: {},
   created_at: '2026-10-08T12:00:00Z', evidence_count: 0,
 }
 const EMPTY = { items: [], has_more: false, next_offset: null }
@@ -53,7 +54,7 @@ beforeEach(() => {
   ;(operationsApi.listFindings as jest.Mock).mockResolvedValue({ ...EMPTY, items: [FINDING] })
   ;(operationsApi.attachFindingEvidence as jest.Mock).mockResolvedValue({ item: { id: 'stable' }, created: true })
   jest.mocked(operationsApi.createFinding).mockResolvedValue(FINDING)
-  jest.mocked(operationsApi.getFindingOptions).mockResolvedValue({ harm_types: ['Malware', 'Other'] })
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(DEFAULT_FINDING_FIELDS_FIXTURE)
 })
 
 it('defaults to the attack\'s own Operation and attaches the viewed attack', async () => {
@@ -168,31 +169,52 @@ it('offers creation inside the empty picker and retains the Operation link', asy
   expect(within(screen.getByRole('dialog')).getByRole('button', { name: 'New finding' })).toBeEnabled()
 })
 
+it('keeps New finding unavailable until the finding fields load, and retries them', async () => {
+  const user = userEvent.setup()
+  jest.mocked(operationsApi.getFindingFields).mockRejectedValueOnce(new Error('Fields offline'))
+  renderDialog()
+  await waitFor(() => { expect(screen.getByRole('button', { name: 'Link to finding' })).toBeEnabled() })
+  await user.click(screen.getByRole('button', { name: 'Link to finding' }))
+  expect(await screen.findByText(/Could not load finding fields: Fields offline/)).toBeInTheDocument()
+  expect(await screen.findByRole('radio', { name: /Proof/ })).toBeInTheDocument()
+  expect(screen.getByRole('button', { name: 'New finding' })).toBeDisabled()
+  await user.click(screen.getByRole('button', { name: 'Retry finding fields' }))
+  await waitFor(() => { expect(screen.getByRole('button', { name: 'New finding' })).toBeEnabled() })
+  expect(screen.getByRole('radio', { name: /Proof/ })).toHaveAccessibleName(/Low/)
+  expect(screen.queryByText(/Could not load finding fields/)).not.toBeInTheDocument()
+})
+
 async function openCreation(user: ReturnType<typeof userEvent.setup>): Promise<void> {
   await waitFor(() => { expect(screen.getByRole('button', { name: 'Link to finding' })).toBeEnabled() })
   await user.click(screen.getByRole('button', { name: 'Link to finding' }))
-  await user.click(await screen.findByRole('button', { name: 'New finding' }))
+  const newFinding = await screen.findByRole('button', { name: 'New finding' })
+  await waitFor(() => { expect(newFinding).toBeEnabled() })
+  await user.click(newFinding)
   await screen.findByRole('heading', { name: 'New finding' })
 }
 
+async function pick(user: ReturnType<typeof userEvent.setup>, label: string, optionName: string): Promise<void> {
+  await user.click(screen.getByRole('combobox', { name: label }))
+  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
+}
+
 it('creates the finding with the viewed attack as evidence in one request and closes both dialogs', async () => {
   const user = userEvent.setup()
   renderDialog()
   await openCreation(user)
-  expect(screen.getByRole('combobox', { name: 'Severity' })).toHaveValue('moderate')
+  expect(screen.getByRole('combobox', { name: 'Severity' })).toHaveValue('Moderate')
   expect(screen.getByRole('button', { name: 'Save finding' })).toBeDisabled()
   await user.type(screen.getByRole('textbox', { name: 'Title' }), '  ')
   expect(screen.getByRole('button', { name: 'Save finding' })).toBeDisabled()
   await user.type(screen.getByRole('textbox', { name: 'Title' }), 'New assessment')
-  await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'important')
+  await pick(user, 'Severity', 'Important')
   await user.type(screen.getByRole('textbox', { name: 'Description' }), 'Optional notes')
   expect(screen.queryByRole('textbox', { name: 'Evidence attack ID' })).not.toBeInTheDocument()
   await user.click(screen.getByRole('button', { name: 'Save finding' }))
   expect(await screen.findByText(/Finding created and attack attached/)).toBeInTheDocument()
   expect(operationsApi.createFinding).toHaveBeenCalledWith('saved', {
-    id: expect.any(String), title: '  New assessment', severity: 'important', description: 'Optional notes',
-    severity_other: null, harm_type: null, harm_type_other: null,
-    attack_result_id: 'viewed',
+    id: expect.any(String), title: '  New assessment', severity: 'important',
+    field_values: { description: 'Optional notes' }, attack_result_id: 'viewed',
   })
   expect(operationsApi.attachFindingEvidence).not.toHaveBeenCalled()
   await waitFor(() => { expect(screen.queryByRole('dialog')).not.toBeInTheDocument() })
@@ -202,25 +224,27 @@ it('creates the finding with the viewed attack as evidence in one request and cl
 it('creates and attaches custom classifications from the same shared form and shows them in the picker', async () => {
   const user = userEvent.setup()
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [{
-    ...FINDING, severity: 'other', severity_other: 'Team severity', harm_type: 'Other', harm_type_other: 'Team harm',
+    ...FINDING, severity: 'Team severity', field_values: { harm_type: 'Team harm' },
   }] })
   renderDialog()
   await waitFor(() => expect(screen.getByRole('button', { name: 'Link to finding' })).toBeEnabled())
   await user.click(screen.getByRole('button', { name: 'Link to finding' }))
-  expect(await screen.findByText('Team severity')).toBeInTheDocument()
-  expect(screen.getByText('Harm-type: Team harm')).toBeInTheDocument()
+  const entry = await screen.findByRole('radio', { name: /Proof/ })
+  expect(entry).toHaveAccessibleName(/Team severity/)
+  expect(screen.getByText('Team severity')).toBeInTheDocument()
+  expect(screen.queryByText(/Harm-type/)).not.toBeInTheDocument()
+  expect(screen.queryByText(/Team harm/)).not.toBeInTheDocument()
   await user.click(screen.getByRole('button', { name: 'New finding' }))
   await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Custom')
-  await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'other')
-  await user.type(screen.getByRole('textbox', { name: 'Other severity' }), 'Team severity')
-  await user.click(screen.getByRole('combobox', { name: 'Harm-type' }))
-  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: 'Other', exact: true }))
-  await user.type(screen.getByRole('textbox', { name: 'Other harm-type' }), 'Team harm')
+  await pick(user, 'Severity', 'Other')
+  await user.type(screen.getByRole('textbox', { name: 'Other Severity' }), 'Team severity')
+  await pick(user, 'Harm-type', 'Other')
+  await user.type(screen.getByRole('textbox', { name: 'Other Harm-type' }), 'Team harm')
   await user.click(screen.getByRole('button', { name: 'Save finding' }))
   expect(await screen.findByText(/Finding created and attack attached/)).toBeInTheDocument()
   expect(operationsApi.createFinding).toHaveBeenCalledWith('saved', {
-    id: expect.any(String), title: 'Custom', description: '', severity: 'other', severity_other: 'Team severity',
-    harm_type: 'Other', harm_type_other: 'Team harm', attack_result_id: 'viewed',
+    id: expect.any(String), title: 'Custom', severity: 'Team severity', field_values: { harm_type: 'Team harm' },
+    attack_result_id: 'viewed',
   })
 })
 
diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
index a9ab5adcd3..11c3118454 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
@@ -10,6 +10,7 @@ import { Link } from 'react-router'
 import { attacksApi, operationsApi } from '@/services/api'
 import FindingDialog, { type FindingSaveAttempt } from '@/components/Operations/FindingDialog'
 import FindingSeverityBadge from '@/components/Operations/FindingSeverityBadge'
+import { useFindingFields } from '@/hooks/useFindingFields'
 import { toApiError } from '@/services/errors'
 import type { FindingCreate, FindingListItem, FindingListResponse, Operation } from '@/types'
 
@@ -37,6 +38,8 @@ export default function FindingEvidenceDialog({
   attackResultId, disabled, defaultOperationId = null, open, onOpenChange, returnFocusRef,
 }: FindingEvidenceDialogProps) {
   const styles = useFindingEvidenceDialogStyles()
+  // `open` stays true while the embedded finding dialog replaces the picker, so this covers both.
+  const { fields, error: fieldsError, retry: retryFields } = useFindingFields(open)
   const viewKey = attackResultId
   const [defaultLookup, setDefaultLookup] = useState<{ key: string; operation: Operation | null } | null>(null)
   const [chosen, setChosen] = useState<{ key: string; operation: Operation } | null>(null)
@@ -165,7 +168,8 @@ export default function FindingEvidenceDialog({
   return (
     <>
       {notice?.key === viewKey && <Text size={200} role="status">{notice.text}</Text>}
-      {creating && <FindingDialog
+      {creating && fields !== null && <FindingDialog
+        fields={fields}
         context={<>
           <Text>Operation: {creationSource?.operation.name}. Save and attach the viewed attack.</Text>
           {!draftEligible && <MessageBar intent="error"><MessageBarBody>
@@ -196,7 +200,7 @@ export default function FindingEvidenceDialog({
                 </Dropdown>
               </Field>
               <Button ref={newFindingRef} className={styles.button} icon={<AddRegular />}
-                disabled={submitting || disabled || !operation}
+                disabled={submitting || disabled || !operation || fields === null}
                 onClick={() => {
                   if (operation) {
                     setCreationSource({ operation, attackResultId })
@@ -204,6 +208,10 @@ export default function FindingEvidenceDialog({
                   }
                 }}>New finding</Button>
             </div>
+            {fieldsError && <MessageBar intent="error"><MessageBarBody>
+              Could not load finding fields: {fieldsError}{' '}
+              <Button className={styles.button} aria-label="Retry finding fields" onClick={retryFields}>Retry</Button>
+            </MessageBarBody></MessageBar>}
             <Field label="Search findings by title">
               <Input value={title} disabled={submitting} onChange={(_, data) => {
                 setTitle(data.value); setOffset(0); setSelection(null); setNotice(null); setAttachError('')
@@ -228,10 +236,7 @@ export default function FindingEvidenceDialog({
                   children: (
                     <span title={`Finding ID: ${item.id}`}>
                       <span className={styles.findingHeading}><span className={styles.findingTitle}>{item.title}</span>
-                        <FindingSeverityBadge finding={item} /></span>
-                      {item.harm_type && <span className={styles.context}>Harm-type: {
-                        item.harm_type === 'Other' ? item.harm_type_other : item.harm_type
-                      }</span>}
+                        {fields !== null && <FindingSeverityBadge fields={fields} severity={item.severity} />}</span>
                       <span className={styles.context}>{new Date(item.created_at).toLocaleString()}</span>
                     </span>
                   ),
diff --git a/frontend/src/components/Operations/FindingCardValues.tsx b/frontend/src/components/Operations/FindingCardValues.tsx
new file mode 100644
index 0000000000..73a4905ad2
--- /dev/null
+++ b/frontend/src/components/Operations/FindingCardValues.tsx
@@ -0,0 +1,45 @@
+import { useId } from 'react'
+import { mergeClasses, Text } from '@fluentui/react-components'
+
+import type { FindingFields, FindingListItem } from '@/types'
+import { describeFindingValues, type FindingValueRow } from '@/utils/findingFields'
+
+import { useOperationsStyles } from './Operations.styles'
+
+interface FindingCardValuesProps {
+  fields: FindingFields
+  finding: Pick<FindingListItem, 'severity' | 'field_values'>
+}
+
+/**
+ * A finding card's filled values in configured order: a single-line value as one `Label: value` line, and a
+ * multi-line value under its label. Values of fields that are no longer configured follow under their raw keys.
+ */
+export default function FindingCardValues({ fields, finding }: FindingCardValuesProps) {
+  const styles = useOperationsStyles()
+  const retiredHeadingId = useId()
+  const { rows, retired } = describeFindingValues(fields, finding.severity, finding.field_values)
+  if (rows.length === 0 && retired.length === 0) return null
+
+  return (
+    <div className={styles.values}>
+      {rows.map((row: FindingValueRow) => row.multiline ? (
+        <div key={row.key}>
+          <Text block weight="semibold">{row.label}</Text>
+          <p className={mergeClasses(styles.description, styles.valueText)}>{row.value}</p>
+        </div>
+      ) : <Text key={row.key} block>{`${row.label}: ${row.value}`}</Text>)}
+      {retired.length > 0 && <div role="group" aria-labelledby={retiredHeadingId} className={styles.retired}>
+        <Text id={retiredHeadingId} size={200} weight="semibold" className={styles.muted}>Retired fields</Text>
+        <ul className={styles.retiredList}>
+          {retired.map(({ key, value }: { key: string; value: string }) => (
+            <li key={key}>
+              <code className={styles.retiredKey} translate="no">{key}</code>
+              <p className={styles.retiredValue}>{value}</p>
+            </li>
+          ))}
+        </ul>
+      </div>}
+    </div>
+  )
+}
diff --git a/frontend/src/components/Operations/FindingDialog.styles.ts b/frontend/src/components/Operations/FindingDialog.styles.ts
index 5dc303c2d8..8ca35ce167 100644
--- a/frontend/src/components/Operations/FindingDialog.styles.ts
+++ b/frontend/src/components/Operations/FindingDialog.styles.ts
@@ -4,8 +4,7 @@ import { mobileTouchTarget } from '@/styles/touchTargets'
 
 export const useFindingDialogStyles = makeStyles({
   form: { display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalM },
+  section: { margin: 0, marginTop: tokens.spacingVerticalS },
   actions: { display: 'flex', justifyContent: 'flex-end', gap: tokens.spacingHorizontalS },
   button: { ...mobileTouchTarget },
-  harmPicker: { minWidth: 0, width: '100%' },
-  harmListbox: { maxHeight: '240px', overflowY: 'auto' },
 })
diff --git a/frontend/src/components/Operations/FindingDialog.test.tsx b/frontend/src/components/Operations/FindingDialog.test.tsx
index 0915b4eaad..e4a31bc537 100644
--- a/frontend/src/components/Operations/FindingDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingDialog.test.tsx
@@ -1,197 +1,341 @@
-import { fireEvent, render, screen, waitFor, within } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
+import React, { useState } from 'react'
+import { act, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent, { type UserEvent } from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 
-import FindingDialog from './FindingDialog'
-import { operationsApi } from '@/services/api'
+import { deferred } from '@/test-utils/deferred'
+import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { FindingCreate, FindingFields } from '@/types'
 
-jest.mock('@/services/api', () => ({ operationsApi: { getFindingOptions: jest.fn() } }))
+import FindingDialog, { type FindingDraft } from './FindingDialog'
+
+const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+)
 
 const ATTEMPT = { id: expect.any(String), attackResultId: '' }
 
-beforeEach(() => {
-  jest.clearAllMocks()
-  jest.mocked(operationsApi.getFindingOptions).mockResolvedValue({ harm_types: ['Hate Speech', 'Malware', 'Other'] })
-})
+const CONTOSO_STEPS = '1. Ask the Contoso assistant to repeat its instructions.'
+const CONTOSO_EDIT: FindingCreate = {
+  title: 'Contoso assistant repeats its system prompt',
+  severity: 'sev1',
+  field_values: {
+    severity_rationale: 'customer_impact',
+    category: 'model_security',
+    subcategory: 'system_prompt_leak',
+    steps: CONTOSO_STEPS,
+    description: 'Recorded before Contoso configured its own fields.',
+  },
+}
+const CONTOSO_CURRENT_VALUES = {
+  severity_rationale: 'customer_impact',
+  category: 'model_security',
+  subcategory: 'system_prompt_leak',
+  steps: CONTOSO_STEPS,
+}
+
+interface DialogOptions {
+  fields?: FindingFields
+  initialValues?: FindingCreate
+  editing?: boolean
+  evidenceField?: boolean
+  onSave?: (draft: FindingDraft, attempt: { id: string; attackResultId: string }) => Promise<void>
+  onClose?: () => void
+}
+
+function renderDialog({
+  fields = DEFAULT_FINDING_FIELDS_FIXTURE, onSave = jest.fn().mockResolvedValue(undefined), onClose = jest.fn(),
+  ...props
+}: DialogOptions = {}): void {
+  render(<TestWrapper><FindingDialog fields={fields} onSave={onSave} onClose={onClose} {...props} /></TestWrapper>)
+}
+
+// Holds the dialog the way the Operation page does, so Cancel can close it and Edit can reopen it.
+function EditHarness({ onSave }: { onSave: (draft: FindingDraft) => Promise<void> }) {
+  const [open, setOpen] = useState(false)
+  return <>
+    <button onClick={() => { setOpen(true) }}>Edit Contoso finding</button>
+    {open && <FindingDialog fields={CONTOSO_FINDING_FIELDS} editing initialValues={CONTOSO_EDIT}
+      onSave={onSave} onClose={() => { setOpen(false) }} />}
+  </>
+}
+
+async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
+  await user.click(screen.getByRole('combobox', { name: label }))
+  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
+}
+
+function saveButton(): HTMLElement {
+  return screen.getByRole('button', { name: 'Save finding' })
+}
+
+// The confirmation's title wraps the key in <code>, so it is found by its Keep it button instead of its name.
+async function findRemovalConfirmation(): Promise<HTMLElement> {
+  const dialogs = await screen.findAllByRole('dialog')
+  const confirmation = dialogs.find((dialog: HTMLElement) => within(dialog).queryByRole('button', { name: 'Keep it' }))
+  if (confirmation === undefined) throw new Error('No removal confirmation is open')
+  return confirmation
+}
+
+async function confirmRemoval(user: UserEvent, key: string): Promise<void> {
+  await user.click(await screen.findByRole('button', { name: `Remove retired value ${key}` }))
+  const confirmation = await findRemovalConfirmation()
+  await user.click(within(confirmation).getByRole('button', { name: 'Remove' }))
+  await waitFor(() => expect(screen.queryByRole('button', { name: 'Keep it' })).not.toBeInTheDocument())
+}
 
 describe('FindingDialog', () => {
-  it('uses the same defaults and severity choices and submits only finding fields', async () => {
-    const user = userEvent.setup()
-    const onSave = jest.fn().mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    expect(screen.getByRole('combobox', { name: 'Severity' })).toHaveValue('moderate')
-    expect(within(screen.getByRole('combobox', { name: 'Severity' })).getAllByRole('option').map(option => option.textContent)).toEqual([
-      'Critical', 'Important', 'Moderate', 'Low', 'Informational', 'Other',
-    ])
-    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Human assessment')
-    await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'critical')
-    await user.type(screen.getByRole('textbox', { name: 'Description' }), 'Notes')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    await waitFor(() => { expect(onSave).toHaveBeenCalledWith({
-      title: 'Human assessment', severity: 'critical', description: 'Notes',
-      severity_other: null, harm_type: null, harm_type_other: null,
-    }, ATTEMPT) })
+  beforeEach(() => {
+    jest.clearAllMocks()
   })
 
-  it('arms the unsaved changes guard for a severity only edit', async () => {
+  it('keeps the #3066 form for the default fields', async () => {
     const user = userEvent.setup()
-    const events: Event[] = []
-    const listener = (event: Event): void => { events.push(event) }
-    window.addEventListener('beforeunload', listener)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={jest.fn()} onClose={jest.fn()} /></FluentProvider>)
+    const onSave = jest.fn().mockResolvedValue(undefined)
+    renderDialog({ onSave })
 
-    // No field the guard watches has a value yet, so nothing is armed. The
-    // prevented flag is read after the dispatch, when every listener has run.
-    fireEvent(window, new Event('beforeunload', { cancelable: true }))
-    expect(events[0].defaultPrevented).toBe(false)
+    const severity = screen.getByRole('combobox', { name: 'Severity' })
+    expect(severity).toHaveValue('Moderate')
+    expect(severity).toBeRequired()
+    await user.click(severity)
+    expect(within(await screen.findByRole('listbox')).getAllByRole('option').map(option => option.textContent))
+      .toEqual(['Critical', 'Important', 'Moderate', 'Low', 'Informational', 'Other'])
+    await user.click(screen.getByRole('option', { name: 'Moderate' }))
 
-    await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'critical')
-    fireEvent(window, new Event('beforeunload', { cancelable: true }))
-    expect(events[1].defaultPrevented).toBe(true)
+    const harmType = screen.getByRole('combobox', { name: 'Harm-type' })
+    expect(harmType).not.toBeRequired()
+    await user.type(harmType, 'mal')
+    expect(within(await screen.findByRole('listbox')).getAllByRole('option').map(option => option.textContent))
+      .toEqual(['Not set', 'Malware', 'Other'])
+    await user.click(screen.getByRole('option', { name: 'Not set' }))
+    expect(harmType).toHaveValue('')
 
-    window.removeEventListener('beforeunload', listener)
-  })
+    const description = screen.getByRole('textbox', { name: 'Description' })
+    expect(description).not.toBeRequired()
+    expect(description).toHaveAccessibleDescription('Optional')
+    expect(screen.queryByRole('heading', { level: 3 })).not.toBeInTheDocument()
 
-  it('retains an edited draft on error and permits a corrected retry', async () => {
-    const user = userEvent.setup()
-    const onSave = jest.fn().mockRejectedValueOnce(new Error('Storage offline')).mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog editing
-      initialValues={{ title: 'Existing', severity: 'low', description: 'Details' }}
-      onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    expect(screen.getByRole('heading', { name: 'Edit finding' })).toBeInTheDocument()
-    await user.type(screen.getByRole('textbox', { name: 'Title' }), ' edited')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(await screen.findByText('Storage offline')).toBeInTheDocument()
-    expect(screen.getByRole('textbox', { name: 'Title' })).toHaveValue('Existing edited')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    await waitFor(() => { expect(screen.queryByText('Storage offline')).not.toBeInTheDocument() })
-    expect(onSave).toHaveBeenCalledTimes(2)
+    expect(saveButton()).toBeDisabled()
+    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Human assessment')
+    await user.type(description, 'Notes')
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: 'Human assessment', severity: 'moderate', field_values: { description: 'Notes' },
+    }, ATTEMPT))
   })
 
-  it('requires custom Other text, preserves it on error, and clears it when returning to presets', async () => {
-    const user = userEvent.setup()
-    const onSave = jest.fn().mockRejectedValueOnce(new Error('Offline')).mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Custom')
-    await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'other')
-    expect(screen.getByRole('button', { name: 'Save finding' })).toBeDisabled()
-    await user.type(screen.getByRole('textbox', { name: 'Other severity' }), '  Team severity  ')
-    await user.click(screen.getByRole('combobox', { name: 'Harm-type' }))
-    await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: 'Other', exact: true }))
-    expect(screen.getByRole('button', { name: 'Save finding' })).toBeDisabled()
-    await user.type(screen.getByRole('textbox', { name: 'Other harm-type' }), '  Team harm  ')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(await screen.findByText('Offline')).toBeInTheDocument()
-    expect(screen.getByRole('textbox', { name: 'Other severity' })).toHaveValue('  Team severity  ')
-    expect(screen.getByRole('textbox', { name: 'Other harm-type' })).toHaveValue('  Team harm  ')
-    expect(onSave).toHaveBeenCalledWith({
-      title: 'Custom', description: '', severity: 'other', severity_other: '  Team severity  ',
-      harm_type: 'Other', harm_type_other: '  Team harm  ',
-    }, ATTEMPT)
-    await user.selectOptions(screen.getByRole('combobox', { name: 'Severity' }), 'low')
-    await user.click(screen.getByRole('combobox', { name: 'Harm-type' }))
-    await user.click(await screen.findByRole('option', { name: 'Not set', exact: true }))
-    expect(screen.queryByRole('textbox', { name: 'Other severity' })).not.toBeInTheDocument()
-    expect(screen.queryByRole('textbox', { name: 'Other harm-type' })).not.toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(onSave).toHaveBeenLastCalledWith({
-      title: 'Custom', description: '', severity: 'low', severity_other: null, harm_type: null, harm_type_other: null,
-    }, ATTEMPT)
+  it('renders sections, hints and required markers from the fields', () => {
+    renderDialog({ fields: CONTOSO_FINDING_FIELDS })
+
+    expect(screen.getAllByRole('heading', { level: 3 }).map(heading => heading.textContent))
+      .toEqual(['Classification', 'Reproduction', 'Tracking'])
+    const steps = screen.getByRole('textbox', { name: 'Steps to reproduce' })
+    expect(steps).toHaveAccessibleDescription('List each prompt you sent to the Contoso assistant, in order.')
+    expect(steps).toBeRequired()
+    expect(screen.getByRole('combobox', { name: 'Severity' })).toBeRequired()
+    expect(screen.getByRole('combobox', { name: 'Severity' })).toHaveValue('')
+    expect(screen.getByRole('combobox', { name: 'Category' })).toBeRequired()
+    expect(screen.getByRole('combobox', { name: 'Technique' })).not.toBeRequired()
+    expect(screen.getByRole('textbox', { name: 'Owner' })).not.toBeRequired()
+
+    const reproduction = screen.getByRole('heading', { level: 3, name: 'Reproduction' })
+    const technique = screen.getByRole('combobox', { name: 'Technique' })
+    const category = screen.getByRole('combobox', { name: 'Category' })
+    expect(reproduction.compareDocumentPosition(technique) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+    expect(reproduction.compareDocumentPosition(category) & Node.DOCUMENT_POSITION_PRECEDING).toBeTruthy()
   })
 
-  it('searches canonical harm choices without treating typed search text as a custom category', async () => {
+  it('disables save until every required value is filled', async () => {
     const user = userEvent.setup()
     const onSave = jest.fn().mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Search')
-    await user.type(screen.getByRole('combobox', { name: 'Harm-type' }), 'mal')
-    expect(await screen.findByRole('option', { name: 'Malware' })).toBeInTheDocument()
-    expect(screen.queryByRole('option', { name: 'Hate Speech' })).not.toBeInTheDocument()
-    await user.click(screen.getByRole('option', { name: 'Malware' }))
-    expect(screen.getByRole('combobox', { name: 'Harm-type' })).toHaveValue('Malware')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ harm_type: 'Malware', harm_type_other: null }), ATTEMPT)
+    renderDialog({ fields: CONTOSO_FINDING_FIELDS, onSave })
+
+    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Contoso prompt leak')
+    expect(saveButton()).toBeDisabled()
+    await pick(user, 'Severity', 'Sev 1')
+    expect(saveButton()).toBeDisabled()
+    await pick(user, 'Severity rationale', 'Customer impact')
+    expect(saveButton()).toBeDisabled()
+    await pick(user, 'Category', 'Model security')
+    expect(saveButton()).toBeDisabled()
+    await pick(user, 'Subcategory', 'System prompt leak')
+    expect(saveButton()).toBeDisabled()
+    await user.type(screen.getByRole('textbox', { name: 'Steps to reproduce' }), CONTOSO_STEPS)
+    expect(saveButton()).toBeEnabled()
+    await user.clear(screen.getByRole('textbox', { name: 'Title' }))
+    expect(saveButton()).toBeDisabled()
+    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Contoso prompt leak')
+
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: 'Contoso prompt leak', severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES,
+    }, ATTEMPT))
   })
 
-  it('keeps Other selectable when a category search has no match', async () => {
+  it('disables save while a chosen Other has blank text', async () => {
     const user = userEvent.setup()
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={jest.fn()} onClose={jest.fn()} /></FluentProvider>)
-    const picker = screen.getByRole('combobox', { name: 'Harm-type' })
-    await waitFor(() => expect(picker).toBeEnabled())
-    await user.type(picker, 'organization-specific-risk')
-    const listbox = await screen.findByRole('listbox')
-    expect(within(listbox).getByRole('option', { name: 'Other', exact: true })).toBeEnabled()
-    await user.click(within(listbox).getByRole('option', { name: 'Other', exact: true }))
-    expect(screen.getByRole('textbox', { name: 'Other harm-type' })).toBeInTheDocument()
+    const onSave = jest.fn().mockResolvedValue(undefined)
+    renderDialog({ onSave })
+    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Custom classifications')
+
+    await pick(user, 'Harm-type', 'Other')
+    expect(saveButton()).toBeDisabled()
+    fireEvent.submit(saveButton().closest('form') as HTMLFormElement)
+    expect(onSave).not.toHaveBeenCalled()
+    await user.type(screen.getByRole('textbox', { name: 'Other Harm-type' }), 'Team harm')
+    expect(saveButton()).toBeEnabled()
+
+    await pick(user, 'Severity', 'Other')
+    expect(saveButton()).toBeDisabled()
+    await user.type(screen.getByRole('textbox', { name: 'Other Severity' }), 'Team severity')
+    expect(saveButton()).toBeEnabled()
+    await user.clear(screen.getByRole('textbox', { name: 'Other Harm-type' }))
+    expect(saveButton()).toBeDisabled()
+    await user.type(screen.getByRole('textbox', { name: 'Other Harm-type' }), 'Team harm')
+
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: 'Custom classifications', severity: 'Team severity', field_values: { harm_type: 'Team harm' },
+    }, ATTEMPT))
   })
 
-  it('reports category loading failures, retains an edit draft, and retries without clearing fields', async () => {
+  it('edits don\'t resend retired values', async () => {
     const user = userEvent.setup()
-    jest.mocked(operationsApi.getFindingOptions).mockRejectedValueOnce(new Error('Categories offline'))
     const onSave = jest.fn().mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog editing
-      initialValues={{
-        title: 'Existing', description: '', severity: 'other', severity_other: 'Team severity',
-        harm_type: 'Other', harm_type_other: 'Team harm',
-      }} onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    expect(await screen.findByText(/Could not load harm categories: Categories offline/)).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Save finding' })).toBeDisabled()
-    expect(screen.getByRole('textbox', { name: 'Other harm-type' })).toHaveValue('Team harm')
-    await user.click(screen.getByRole('button', { name: 'Retry harm categories' }))
-    await waitFor(() => expect(screen.getByRole('button', { name: 'Save finding' })).toBeEnabled())
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ harm_type_other: 'Team harm', severity_other: 'Team severity' }), ATTEMPT)
+    renderDialog({ fields: CONTOSO_FINDING_FIELDS, editing: true, initialValues: CONTOSO_EDIT, onSave })
+
+    expect(screen.getByRole('heading', { name: 'Edit finding' })).toBeInTheDocument()
+    expect(screen.getByRole('combobox', { name: 'Severity' })).toHaveValue('Sev 1')
+    expect(screen.getByRole('textbox', { name: 'Steps to reproduce' })).toHaveValue(CONTOSO_STEPS)
+    const retired = screen.getByRole('group', { name: 'Retired fields · read-only' })
+    expect(within(retired).getByText('description')).toBeInTheDocument()
+    expect(within(retired).getByText('Recorded before Contoso configured its own fields.')).toBeInTheDocument()
+
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES, removeRetiredKeys: [],
+    }, ATTEMPT))
   })
 
-  it('preserves custom harm text when the current Other option is selected again', async () => {
+  it('a removed retired value is sent in remove_retired_keys, and Cancel restores it', async () => {
     const user = userEvent.setup()
-    render(<FluentProvider theme={webLightTheme}><FindingDialog editing
-      initialValues={{ title: 'Existing', description: '', severity: 'low', harm_type: 'Other', harm_type_other: 'Keep custom harm' }}
-      onSave={jest.fn()} onClose={jest.fn()} /></FluentProvider>)
-    await waitFor(() => expect(screen.getByRole('combobox', { name: 'Harm-type' })).toBeEnabled())
-    await user.click(screen.getByRole('combobox', { name: 'Harm-type' }))
-    await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: 'Other', exact: true }))
-    expect(screen.getByRole('textbox', { name: 'Other harm-type' })).toHaveValue('Keep custom harm')
+    const onSave = jest.fn().mockResolvedValue(undefined)
+    render(<TestWrapper><EditHarness onSave={onSave} /></TestWrapper>)
+    // This bare page has no other Tabster user, so it can stay aria-hidden after the dialog closes; keep the opener.
+    const edit = screen.getByRole('button', { name: 'Edit Contoso finding' })
+    await user.click(edit)
+
+    await confirmRemoval(user, 'description')
+    expect(await screen.findByText('1 retired value is removed when you save.')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Remove retired value description' })).not.toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    expect(onSave).not.toHaveBeenCalled()
+
+    await user.click(edit)
+    expect(await screen.findByRole('button', { name: 'Remove retired value description' })).toBeInTheDocument()
+    expect(screen.queryByText(/removed when you save/)).not.toBeInTheDocument()
+    await confirmRemoval(user, 'description')
+    await user.click(await screen.findByRole('button', { name: 'Save finding' }))
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES,
+      removeRetiredKeys: ['description'],
+    }, ATTEMPT))
   })
 
-  it('blocks blank custom values even when the form is submitted programmatically', async () => {
+  it('moves focus to Undo after a removal, and Escape closes only the confirmation', async () => {
     const user = userEvent.setup()
-    const onSave = jest.fn()
-    render(<FluentProvider theme={webLightTheme}><FindingDialog
-      initialValues={{ title: 'Title', description: '', severity: 'other', severity_other: '  ' }}
-      onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
-    await waitFor(() => expect(screen.getByRole('combobox', { name: 'Harm-type' })).toBeEnabled())
-    await user.click(screen.getByRole('textbox', { name: 'Other severity' }))
-    fireEvent.submit(screen.getByRole('button', { name: 'Save finding' }).closest('form')!)
-    expect(onSave).not.toHaveBeenCalled()
+    const onClose = jest.fn()
+    renderDialog({ fields: CONTOSO_FINDING_FIELDS, editing: true, initialValues: CONTOSO_EDIT, onClose })
+
+    await user.click(screen.getByRole('button', { name: 'Remove retired value description' }))
+    await findRemovalConfirmation()
+    await user.keyboard('{Escape}')
+    await waitFor(() => expect(screen.queryByRole('button', { name: 'Keep it' })).not.toBeInTheDocument())
+    expect(onClose).not.toHaveBeenCalled()
+    expect(await screen.findByRole('heading', { name: 'Edit finding' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Remove retired value description' })).toBeInTheDocument()
+
+    await confirmRemoval(user, 'description')
+    expect(await screen.findByRole('button', { name: 'Undo' })).toHaveFocus()
+    expect(onClose).not.toHaveBeenCalled()
   })
 
-  it('keeps one finding ID while a retry sends the same input, and starts a new one after an edit', async () => {
+  it('prevents duplicate submissions and reuses the attempt ID after a failure', async () => {
     const user = userEvent.setup()
-    const onSave = jest.fn().mockRejectedValue(new Error('Response lost'))
-    render(<FluentProvider theme={webLightTheme}><FindingDialog onSave={onSave} onClose={jest.fn()} /></FluentProvider>)
+    const pending = deferred<void>()
+    const onSave = jest.fn()
+      .mockReturnValueOnce(pending.promise)
+      .mockRejectedValueOnce(new Error('Response lost'))
+      .mockResolvedValue(undefined)
+    renderDialog({ onSave })
     await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Once')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    await user.click(await screen.findByRole('button', { name: 'Save finding' }))
-    await user.type(screen.getByRole('textbox', { name: 'Title' }), ' edited')
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
+    await user.click(saveButton())
+
+    const saving = screen.getByRole('button', { name: 'Saving…' })
+    expect(saving).toHaveAttribute('aria-disabled', 'true')
+    await user.click(saving)
+    fireEvent.submit(saving.closest('form') as HTMLFormElement)
+    expect(onSave).toHaveBeenCalledTimes(1)
+
+    await act(async () => { pending.reject(new Error('Response lost')) })
+    expect(await screen.findByText('Response lost')).toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: 'Title' })).toHaveValue('Once')
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledTimes(2))
+    await user.type(await screen.findByRole('textbox', { name: 'Title' }), ' edited')
+    await user.click(saveButton())
     await waitFor(() => expect(onSave).toHaveBeenCalledTimes(3))
+
     const [first, retry, edited] = onSave.mock.calls.map(([, attempt]) => attempt.id)
     expect(retry).toBe(first)
     expect(edited).not.toBe(first)
   })
 
+  it('shows a rejected Other text in the error message bar and keeps the draft', async () => {
+    const user = userEvent.setup()
+    const detail = 'Severity \'Critical\' matches the option \'critical\'. Send \'critical\' instead.'
+    const onSave = jest.fn().mockRejectedValueOnce({ isAxiosError: true, response: { status: 422, data: { detail } } })
+    renderDialog({ onSave })
+    await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Typed severity')
+    await pick(user, 'Severity', 'Other')
+    await user.type(screen.getByRole('textbox', { name: 'Other Severity' }), 'Critical')
+    await user.click(saveButton())
+
+    expect(await screen.findByText(detail)).toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: 'Other Severity' })).toHaveValue('Critical')
+    expect(saveButton()).toBeEnabled()
+  })
+
+  it('arms the unsaved changes guard once the draft differs from how it opened', async () => {
+    const user = userEvent.setup()
+    const events: Event[] = []
+    const listener = (event: Event): void => { events.push(event) }
+    window.addEventListener('beforeunload', listener)
+    renderDialog()
+
+    // The prevented flag is read after the dispatch, when every listener has run.
+    fireEvent(window, new Event('beforeunload', { cancelable: true }))
+    expect(events[0].defaultPrevented).toBe(false)
+    await pick(user, 'Severity', 'Critical')
+    fireEvent(window, new Event('beforeunload', { cancelable: true }))
+    expect(events[1].defaultPrevented).toBe(true)
+    await pick(user, 'Severity', 'Moderate')
+    fireEvent(window, new Event('beforeunload', { cancelable: true }))
+    expect(events[2].defaultPrevented).toBe(false)
+
+    window.removeEventListener('beforeunload', listener)
+  })
+
   it('offers an optional evidence attack only when asked and sends it trimmed', async () => {
     const user = userEvent.setup()
     const onSave = jest.fn().mockResolvedValue(undefined)
-    render(<FluentProvider theme={webLightTheme}><FindingDialog evidenceField onSave={onSave} onClose={jest.fn()} />
-    </FluentProvider>)
+    renderDialog({ evidenceField: true, onSave })
     await user.type(screen.getByRole('textbox', { name: 'Title' }), 'With evidence')
     await user.type(screen.getByRole('textbox', { name: 'Evidence attack ID' }), '  attack-1 ')
-    await waitFor(() => expect(screen.getByRole('button', { name: 'Save finding' })).toBeEnabled())
-    await user.click(screen.getByRole('button', { name: 'Save finding' }))
-    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ title: 'With evidence' }), {
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ title: 'With evidence' }), {
       id: expect.any(String), attackResultId: 'attack-1',
-    })
+    }))
   })
 })
diff --git a/frontend/src/components/Operations/FindingDialog.tsx b/frontend/src/components/Operations/FindingDialog.tsx
index 04e7e47bcb..1d234b733f 100644
--- a/frontend/src/components/Operations/FindingDialog.tsx
+++ b/frontend/src/components/Operations/FindingDialog.tsx
@@ -1,21 +1,22 @@
-import { useEffect, useRef, useState } from 'react'
+import { Fragment, useEffect, useRef, useState } from 'react'
 
 import {
-  Button, Combobox, Dialog, DialogBody, DialogContent, DialogSurface, DialogTitle,
-  Field, Input, MessageBar, MessageBarBody, Option, Select, Text, Textarea,
+  Button, Dialog, DialogBody, DialogContent, DialogSurface, DialogTitle,
+  Field, Input, MessageBar, MessageBarBody, Text,
 } from '@fluentui/react-components'
 
-import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { FindingCreate, FindingSeverity } from '@/types'
+import type { FindingCreate, FindingField, FindingFields } from '@/types'
 import { generateClientId } from '@/utils/clientId'
-import { FINDING_SEVERITY_LABELS } from '@/utils/findingSeverity'
+import { fieldKeys, firstMissingRequired } from '@/utils/findingFields'
 
 import { useFindingDialogStyles } from './FindingDialog.styles'
+import FindingFieldInput from './FindingFieldInput'
+import RetiredFieldValues from './RetiredFieldValues'
 
-const EMPTY_DRAFT: FindingCreate = {
-  title: '', description: '', severity: 'moderate', severity_other: null, harm_type: null, harm_type_other: null,
-}
+// FindingFieldInput reads and reports the severity slot's own value under this key.
+const SEVERITY_KEY = 'severity'
+const NO_KEYS: ReadonlySet<string> = new Set()
 
 /** One save attempt. The id repeats while the input does, so a retry returns a finding a lost response saved. */
 export interface FindingSaveAttempt {
@@ -23,52 +24,103 @@ export interface FindingSaveAttempt {
   attackResultId: string
 }
 
+/** The finding Save sends. Only an edit lists the retired values to delete. */
+export interface FindingDraft extends FindingCreate {
+  removeRetiredKeys?: string[]
+}
+
 interface FindingDialogProps {
+  fields: FindingFields
   initialValues?: FindingCreate
   editing?: boolean
   context?: React.ReactNode
   /** Shows an optional attack ID to link as evidence. */
   evidenceField?: boolean
   saveDisabled?: boolean
-  onSave: (draft: FindingCreate, attempt: FindingSaveAttempt) => Promise<void>
+  onSave: (draft: FindingDraft, attempt: FindingSaveAttempt) => Promise<void>
   onClose: () => void
 }
 
+interface RetiredValue {
+  key: string
+  value: string
+}
+
+/** A new finding starts from the field defaults. An edit starts from its values, with retired ones set apart. */
+function openingState(
+  fields: FindingFields, initialValues: FindingCreate | undefined,
+): { draft: FindingCreate; retired: RetiredValue[] } {
+  if (initialValues === undefined) {
+    const defaults: Record<string, string> = {}
+    for (const field of fields.fields) {
+      if (field.default !== null) defaults[field.key] = field.default
+    }
+    return { draft: { title: '', severity: fields.severity.default ?? '', field_values: defaults }, retired: [] }
+  }
+  const known = fieldKeys(fields)
+  const current: Record<string, string> = {}
+  const retired: RetiredValue[] = []
+  for (const [key, value] of Object.entries(initialValues.field_values)) {
+    if (known.has(key)) current[key] = value
+    else retired.push({ key, value })
+  }
+  return { draft: { title: initialValues.title, severity: initialValues.severity, field_values: current }, retired }
+}
+
+/** The draft as the backend stores it, which drops blank values. */
+function filledFinding(draft: FindingCreate): FindingCreate {
+  const filled = Object.entries(draft.field_values).filter(([, value]: [string, string]) => value.trim() !== '')
+  return { title: draft.title, severity: draft.severity, field_values: Object.fromEntries(filled) }
+}
+
+function sameFinding(left: FindingCreate, right: FindingCreate): boolean {
+  const leftValues = Object.entries(filledFinding(left).field_values)
+  const rightValues = filledFinding(right).field_values
+  return left.title === right.title && left.severity === right.severity
+    && leftValues.length === Object.keys(rightValues).length
+    && leftValues.every(([key, value]: [string, string]) => rightValues[key] === value)
+}
+
+/** Each field's section heading, shown where the section differs from the field before it. */
+function sectionHeading(slots: FindingField[], index: number): string | null {
+  const section = slots[index].section
+  return section !== null && section !== slots[index - 1]?.section ? section : null
+}
+
 export default function FindingDialog({
-  initialValues = EMPTY_DRAFT, editing = false, context, evidenceField = false, saveDisabled = false, onSave, onClose,
+  fields, initialValues, editing = false, context, evidenceField = false, saveDisabled = false, onSave, onClose,
 }: FindingDialogProps) {
   const styles = useFindingDialogStyles()
-  const [draft, setDraft] = useState<FindingCreate>({ ...EMPTY_DRAFT, ...initialValues })
+  const [opening] = useState(() => openingState(fields, initialValues))
+  const [draft, setDraft] = useState<FindingCreate>(opening.draft)
+  const [removed, setRemoved] = useState<ReadonlySet<string>>(NO_KEYS)
+  // Whether each field shows Other with blank text, which leaves its value '' just like Not set.
+  const [blankOther, setBlankOther] = useState<Record<string, boolean>>({})
   const [attackResultId, setAttackResultId] = useState('')
   const [error, setError] = useState('')
   const [saving, setSaving] = useState(false)
   const submitting = useRef(false)
   const attempt = useRef<{ signature: string; id: string } | null>(null)
-  const [harmTypes, setHarmTypes] = useState<string[] | null>(null)
-  const [optionsError, setOptionsError] = useState('')
-  const [optionsRevision, setOptionsRevision] = useState(0)
-  const [harmOpen, setHarmOpen] = useState(false)
-  const [harmSearch, setHarmSearch] = useState('')
-  const classificationsValid = (draft.severity !== 'other' || Boolean(draft.severity_other?.trim()))
-    && (draft.harm_type !== 'Other' || Boolean(draft.harm_type_other?.trim()))
-  const canSave = !saveDisabled && Boolean(draft.title.trim()) && classificationsValid && harmTypes !== null
-    && !optionsError
+  const slots = [fields.severity, ...fields.fields]
+  const values = { ...draft.field_values, [SEVERITY_KEY]: draft.severity }
+  const canSave = !saveDisabled && Boolean(draft.title.trim())
+    && firstMissingRequired(fields, draft.severity, draft.field_values) === null
+    && !Object.values(blankOther).some(Boolean)
+  const changed = !sameFinding(draft, opening.draft) || removed.size > 0 || attackResultId !== ''
 
   useEffect(() => {
-    let ignore = false
-    operationsApi.getFindingOptions()
-      .then(options => { if (!ignore) { setHarmTypes(options.harm_types); setOptionsError('') } })
-      .catch((cause: unknown) => { if (!ignore) setOptionsError(toApiError(cause).detail) })
-    return () => { ignore = true }
-  }, [optionsRevision])
-
-  useEffect(() => {
-    if (!draft.title && !draft.description && !draft.severity_other && !draft.harm_type && !draft.harm_type_other
-      && draft.severity === initialValues.severity && !attackResultId) return
+    if (!changed) return
     const protectDraft = (event: BeforeUnloadEvent): void => { event.preventDefault() }
     window.addEventListener('beforeunload', protectDraft)
     return () => { window.removeEventListener('beforeunload', protectDraft) }
-  }, [draft.title, draft.description, draft.severity_other, draft.harm_type, draft.harm_type_other, draft.severity, initialValues.severity, attackResultId])
+  }, [changed])
+
+  const applyChanges = (changes: Record<string, string>): void => {
+    setDraft((current: FindingCreate) => {
+      const { [SEVERITY_KEY]: severity = current.severity, ...fieldChanges } = changes
+      return { ...current, severity, field_values: { ...current.field_values, ...fieldChanges } }
+    })
+  }
 
   const save = async (): Promise<void> => {
     if (submitting.current || !canSave) return
@@ -76,10 +128,14 @@ export default function FindingDialog({
     setSaving(true)
     setError('')
     const trimmedAttackResultId = attackResultId.trim()
-    const signature = JSON.stringify([draft, trimmedAttackResultId])
+    // The backend keeps retired values on its own, so an edit sends only the keys to delete.
+    const finding: FindingDraft = editing
+      ? { ...filledFinding(draft), removeRetiredKeys: [...removed] }
+      : filledFinding(draft)
+    const signature = JSON.stringify([finding, trimmedAttackResultId])
     if (attempt.current?.signature !== signature) attempt.current = { signature, id: generateClientId() }
     try {
-      await onSave(draft, { id: attempt.current.id, attackResultId: trimmedAttackResultId })
+      await onSave(finding, { id: attempt.current.id, attackResultId: trimmedAttackResultId })
     } catch (cause: unknown) {
       setError(toApiError(cause).detail)
     } finally {
@@ -100,63 +156,23 @@ export default function FindingDialog({
               <Input value={draft.title} disabled={saving} name="title" autoComplete="off"
                 onChange={(_, data) => { setDraft(value => ({ ...value, title: data.value })) }} />
             </Field>
-            <Field label="Severity" required>
-              <Select value={draft.severity} disabled={saving} name="severity" onChange={event => {
-                const severity = event.target.value
-                if (severity in FINDING_SEVERITY_LABELS) setDraft(value => ({
-                  ...value, severity: severity as FindingSeverity, severity_other: severity === 'other' ? '' : null,
-                }))
-              }}>
-                {Object.entries(FINDING_SEVERITY_LABELS).map(([value, label]) => <option key={value} value={value}>{label}</option>)}
-              </Select>
-            </Field>
-            {draft.severity === 'other' && <Field label="Other severity" required>
-              <Input value={draft.severity_other ?? ''} disabled={saving} name="severity_other" autoComplete="off"
-                onChange={(_, data) => { setDraft(value => ({ ...value, severity_other: data.value })) }} />
-            </Field>}
-            {optionsError && <MessageBar intent="error" aria-live="polite"><MessageBarBody>
-              Could not load harm categories: {optionsError}{' '}
-              <Button className={styles.button} aria-label="Retry harm categories" onClick={() => {
-                setOptionsError('')
-                setHarmTypes(null)
-                setOptionsRevision(value => value + 1)
-              }}>Retry</Button>
-            </MessageBarBody></MessageBar>}
-            <Field label="Harm-type" hint={harmTypes === null && !optionsError
-              ? 'Loading harm categories…' : 'Optional. Select a category, or choose Other for custom text.'}>
-              <Combobox className={styles.harmPicker} inlinePopup open={harmOpen}
-                disabled={saving || harmTypes === null || Boolean(optionsError)}
-                placeholder="Not set" value={harmOpen ? harmSearch : draft.harm_type ?? ''}
-                selectedOptions={[draft.harm_type ?? '']}
-                onOpenChange={(_, data) => { setHarmOpen(data.open); setHarmSearch('') }}
-                onChange={event => { setHarmSearch(event.target.value); setHarmOpen(true) }}
-                onOptionSelect={(_, data) => {
-                  const harmType = data.optionValue
-                  if (harmType !== '' && !harmTypes?.includes(harmType ?? '')) return
-                  setDraft(value => ({
-                    ...value, harm_type: harmType || null,
-                    harm_type_other: harmType === 'Other' ? (value.harm_type === 'Other' ? value.harm_type_other : '') : null,
-                  }))
-                  setHarmOpen(false)
-                  setHarmSearch('')
-                }}
-                listbox={{ className: styles.harmListbox }}>
-                <Option value="">Not set</Option>
-                {harmTypes?.filter(category => category === 'Other'
-                  || category.toLowerCase().includes(harmSearch.toLowerCase()))
-                  .map(category => <Option key={category} value={category}>{category}</Option>)}
-                {harmTypes && !harmTypes.some(category => category.toLowerCase().includes(harmSearch.toLowerCase()))
-                  && <Option disabled>No matching categories. Choose Other to enter custom text.</Option>}
-              </Combobox>
-            </Field>
-            {draft.harm_type === 'Other' && <Field label="Other harm-type" required>
-              <Input value={draft.harm_type_other ?? ''} disabled={saving} name="harm_type_other" autoComplete="off"
-                onChange={(_, data) => { setDraft(value => ({ ...value, harm_type_other: data.value })) }} />
-            </Field>}
-            <Field label="Description" hint="Optional">
-              <Textarea value={draft.description} disabled={saving} resize="vertical" name="description" autoComplete="off"
-                onChange={(_, data) => { setDraft(value => ({ ...value, description: data.value })) }} />
-            </Field>
+            {slots.map((field: FindingField, index: number) => {
+              const heading = sectionHeading(slots, index)
+              return (
+                <Fragment key={field.key}>
+                  {heading !== null && <Text as="h3" size={400} weight="semibold" className={styles.section}>
+                    {heading}
+                  </Text>}
+                  <FindingFieldInput field={field} values={values} disabled={saving} onChange={applyChanges}
+                    onOtherBlankChange={(blank: boolean) => {
+                      setBlankOther(current => ({ ...current, [field.key]: blank }))
+                    }} />
+                </Fragment>
+              )
+            })}
+            <RetiredFieldValues values={opening.retired} removed={removed} disabled={saving}
+              onRemove={(key: string) => { setRemoved(previous => new Set([...previous, key])) }}
+              onUndo={() => { setRemoved(new Set()) }} />
             {evidenceField && <Field label="Evidence attack ID"
               hint="Optional. Links a saved attack as evidence; the attack is not changed. Its ID is in the attack's address.">
               <Input value={attackResultId} disabled={saving} name="attack_result_id" autoComplete="off"
diff --git a/frontend/src/components/Operations/FindingExportDialog.test.tsx b/frontend/src/components/Operations/FindingExportDialog.test.tsx
index 7950b62cf1..88a8925d0b 100644
--- a/frontend/src/components/Operations/FindingExportDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingExportDialog.test.tsx
@@ -4,6 +4,7 @@ import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 
 import { operationsApi } from '@/services/api'
 import { deferred } from '@/test-utils/deferred'
+import { DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { FindingListItem, FindingListResponse, Operation } from '@/types'
 import { downloadFile } from '@/utils/downloadFile'
 import FindingExportDialog from './FindingExportDialog'
@@ -21,7 +22,7 @@ const OTHER_OPERATION: Operation = {
 function syntheticFinding(index: number, overrides: Partial<FindingListItem> = {}): FindingListItem {
   return {
     id: `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`, operation_id: OPERATION.id,
-    title: `Synthetic finding ${index}`, description: '', severity: 'moderate',
+    title: `Synthetic finding ${index}`, severity: 'moderate', field_values: {},
     created_at: '2026-10-21T12:00:00Z', evidence_count: 0, ...overrides,
   }
 }
@@ -33,9 +34,7 @@ function onePage(items: FindingListItem[]): FindingListResponse {
 const FIRST_PAGE: FindingListResponse = {
   items: Array.from({ length: 100 }, (_, index) => syntheticFinding(index + 1)), has_more: true, next_offset: 100,
 }
-const LAST_PAGE_FINDING = syntheticFinding(101, {
-  title: 'Final-page finding', severity: 'other', severity_other: 'Team-specific severity',
-})
+const LAST_PAGE_FINDING = syntheticFinding(101, { title: 'Final-page finding', severity: 'Team-specific severity' })
 const LAST_PAGE = onePage([LAST_PAGE_FINDING])
 const ALPHA = syntheticFinding(1, { title: 'Alpha', severity: 'critical' })
 const BETA = syntheticFinding(2, { title: 'Beta', severity: 'low' })
@@ -49,7 +48,7 @@ const REVIEW_AGAIN = 'Review the list and download again.'
 function renderDialog(operation: Operation = OPERATION): ReturnType<typeof render> {
   return render(
     <FluentProvider theme={webLightTheme}>
-      <FindingExportDialog key={operation.id} operation={operation} />
+      <FindingExportDialog key={operation.id} operation={operation} fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
     </FluentProvider>,
   )
 }
@@ -502,7 +501,8 @@ describe('FindingExportDialog', () => {
 
     view.rerender(
       <FluentProvider theme={webLightTheme}>
-        <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION} />
+        <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION}
+          fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
       </FluentProvider>,
     )
     expect(jest.mocked(operationsApi.exportFindings).mock.calls[0][2]?.aborted).toBe(true)
@@ -523,7 +523,8 @@ describe('FindingExportDialog', () => {
 
     view.rerender(
       <FluentProvider theme={webLightTheme}>
-        <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION} />
+        <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION}
+          fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
       </FluentProvider>,
     )
     const dialog = await openDialog(user)
@@ -534,4 +535,31 @@ describe('FindingExportDialog', () => {
     expect(within(dialog).queryByRole('checkbox', { name: ALPHA.title })).not.toBeInTheDocument()
     expect(within(dialog).getByRole('checkbox', { name: other.title })).toBeChecked()
   })
+
+  it('warns when selected findings have retired values', async () => {
+    const user = userEvent.setup()
+    const legacyAlpha = { ...ALPHA, field_values: { harm_type: 'Malware', contoso_ticket: 'CONTOSO-42' } }
+    const legacyBeta = { ...BETA, field_values: { description: 'Kept from the earlier form.', retired_owner: 'Contoso' } }
+    const singular = 'Retired fields aren\'t included in the export. 1 selected finding has retired values.'
+    const plural = 'Retired fields aren\'t included in the export. 2 selected findings have retired values.'
+    jest.mocked(operationsApi.listFindings).mockResolvedValue(onePage([legacyAlpha, legacyBeta, GAMMA]))
+    renderDialog()
+    const dialog = await openDialog(user)
+    const selectAll = await within(dialog).findByRole('checkbox', { name: 'Select all' })
+    await user.click(selectAll)
+    expect(within(dialog).queryByText(/Retired fields/)).not.toBeInTheDocument()
+
+    await user.click(within(dialog).getByRole('checkbox', { name: legacyAlpha.title }))
+    expect(within(dialog).getByText(singular)).toBeInTheDocument()
+    await user.click(within(dialog).getByRole('checkbox', { name: GAMMA.title }))
+    expect(within(dialog).getByText(singular)).toBeInTheDocument()
+    await user.click(within(dialog).getByRole('checkbox', { name: legacyBeta.title }))
+    expect(within(dialog).getByText(plural)).toBeInTheDocument()
+    expect(within(dialog).queryByText(singular)).not.toBeInTheDocument()
+
+    await user.click(within(dialog).getByRole('checkbox', { name: legacyAlpha.title }))
+    await user.click(within(dialog).getByRole('checkbox', { name: legacyBeta.title }))
+    expect(within(dialog).queryByText(/Retired fields/)).not.toBeInTheDocument()
+    expect(within(dialog).getByRole('checkbox', { name: GAMMA.title })).toBeChecked()
+  })
 })
diff --git a/frontend/src/components/Operations/FindingExportDialog.tsx b/frontend/src/components/Operations/FindingExportDialog.tsx
index a47b8bd3d6..07869d8ced 100644
--- a/frontend/src/components/Operations/FindingExportDialog.tsx
+++ b/frontend/src/components/Operations/FindingExportDialog.tsx
@@ -8,9 +8,10 @@ import { ArrowDownloadRegular } from '@fluentui/react-icons'
 
 import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { FindingExportFormat, FindingListItem, Operation } from '@/types'
+import type { FindingExportFormat, FindingFields, FindingListItem, Operation } from '@/types'
 import { downloadFile } from '@/utils/downloadFile'
 import { findingExportFilename } from '@/utils/findingExportFilename'
+import { fieldKeys } from '@/utils/findingFields'
 
 import { useFindingExportDialogStyles } from './FindingExportDialog.styles'
 import FindingSeverityBadge from './FindingSeverityBadge'
@@ -40,11 +41,18 @@ function removedNotice(titles: readonly string[]): string {
   return `${names} ${verb} removed from your selection. Review the list and download again.`
 }
 
+function retiredNotice(count: number): string {
+  const subject = count === 1 ? '1 selected finding has' : `${count} selected findings have`
+  return `Retired fields aren't included in the export. ${subject} retired values.`
+}
+
 interface FindingExportDialogProps {
   operation: Operation
+  /** The active finding fields, which decide the severity badges and which stored values are retired. */
+  fields: FindingFields
 }
 
-export default function FindingExportDialog({ operation }: FindingExportDialogProps) {
+export default function FindingExportDialog({ operation, fields }: FindingExportDialogProps) {
   const styles = useFindingExportDialogStyles()
   const [open, setOpen] = useState(false)
   const [loadRevision, setLoadRevision] = useState(0)
@@ -66,6 +74,9 @@ export default function FindingExportDialog({ operation }: FindingExportDialogPr
   const selectedIds = findings.filter(finding => selected.has(finding.id)).map(finding => finding.id)
   const allSelected = selectedIds.length === findings.length
   const selectAllChecked = allSelected ? true : selectedIds.length === 0 ? false : 'mixed'
+  const knownKeys = fieldKeys(fields)
+  const selectedWithRetired = findings.filter(finding => selected.has(finding.id)
+    && Object.keys(finding.field_values).some(key => !knownKeys.has(key))).length
   // A natively disabled button drops keyboard focus out of the dialog, so while an export runs, and while the list
   // reloads or shows nothing selected after a deleted finding, Download stays focusable but unavailable.
   const downloadKeepsFocus = exporting || (selectedIds.length === 0 && (recovering || removedTitles.length > 0))
@@ -206,7 +217,7 @@ export default function FindingExportDialog({ operation }: FindingExportDialogPr
                 <Checkbox className={styles.checkbox} label={{ children: finding.title, className: styles.label }}
                   aria-describedby={createdId} checked={selected.has(finding.id)} disabled={exporting}
                   onChange={(_, data) => { toggle(finding.id, data.checked === true) }} />
-                <FindingSeverityBadge finding={finding} />
+                <FindingSeverityBadge fields={fields} severity={finding.severity} />
                 <Text size={200} className={styles.created}>
                   <time id={createdId} dateTime={finding.created_at}>
                     {new Date(finding.created_at).toLocaleString()}
@@ -236,6 +247,11 @@ export default function FindingExportDialog({ operation }: FindingExportDialogPr
               Findings, attack objectives and score rationales can contain sensitive content. Nothing is redacted
               automatically.
             </MessageBarBody></MessageBar>
+            {selectedWithRetired > 0 && (
+              <MessageBar className={styles.messageBar} intent="warning" aria-live="polite"><MessageBarBody>
+                {retiredNotice(selectedWithRetired)}
+              </MessageBarBody></MessageBar>
+            )}
             {exportError && <MessageBar className={styles.messageBar} intent="error" aria-live="polite"><MessageBarBody>
               Could not export findings: {exportError}
             </MessageBarBody></MessageBar>}
diff --git a/frontend/src/components/Operations/FindingSeverityBadge.tsx b/frontend/src/components/Operations/FindingSeverityBadge.tsx
index 3ecef0abe1..48cce56966 100644
--- a/frontend/src/components/Operations/FindingSeverityBadge.tsx
+++ b/frontend/src/components/Operations/FindingSeverityBadge.tsx
@@ -1,18 +1,17 @@
 import { Badge } from '@fluentui/react-components'
 
-import type { FindingCreate } from '@/types'
-import { findingSeverityColor, findingSeverityLabel } from '@/utils/findingSeverity'
+import type { FindingFields } from '@/types'
+import { severityBadge } from '@/utils/findingFields'
 import { useFindingSeverityBadgeStyles } from './FindingSeverityBadge.styles'
 
 interface FindingSeverityBadgeProps {
-  finding: Pick<FindingCreate, 'severity' | 'severity_other'>
+  fields: FindingFields
+  severity: string
 }
 
-export default function FindingSeverityBadge({ finding }: FindingSeverityBadgeProps) {
+/** The severity's option label and color, or its stored text on a neutral badge when it matches no option. */
+export default function FindingSeverityBadge({ fields, severity }: FindingSeverityBadgeProps) {
   const styles = useFindingSeverityBadgeStyles()
-  return (
-    <Badge className={styles.badge} appearance="tint" color={findingSeverityColor(finding.severity)}>
-      {findingSeverityLabel(finding)}
-    </Badge>
-  )
+  const { label, color } = severityBadge(fields, severity)
+  return <Badge className={styles.badge} appearance="tint" color={color}>{label}</Badge>
 }
diff --git a/frontend/src/components/Operations/OperationDetailPage.test.tsx b/frontend/src/components/Operations/OperationDetailPage.test.tsx
index 908bde9acc..d7e35e47a0 100644
--- a/frontend/src/components/Operations/OperationDetailPage.test.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.test.tsx
@@ -1,10 +1,12 @@
 import { act, render, screen, waitFor, within } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
+import userEvent, { type UserEvent } from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter, Route, Routes } from 'react-router'
 
 import { attacksApi, operationsApi, scenariosApi } from '@/services/api'
-import type { Finding, FindingListItem, Operation, OperationDetail } from '@/types'
+import { deferred } from '@/test-utils/deferred'
+import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { Finding, FindingFields, FindingListItem, Operation, OperationDetail } from '@/types'
 import OperationDetailPage from './OperationDetailPage'
 
 jest.mock('@/services/api', () => ({
@@ -12,7 +14,7 @@ jest.mock('@/services/api', () => ({
     get: jest.fn(), update: jest.fn(), delete: jest.fn(), listFindings: jest.fn(), createFinding: jest.fn(),
     updateFinding: jest.fn(), deleteFinding: jest.fn(),
     listFindingEvidence: jest.fn(), detachFindingEvidence: jest.fn(),
-    getFindingOptions: jest.fn(), exportFindings: jest.fn(),
+    getFindingFields: jest.fn(), exportFindings: jest.fn(),
   },
   attacksApi: { listAttacks: jest.fn() },
   scenariosApi: { listRuns: jest.fn() },
@@ -22,7 +24,7 @@ const SAVED: Operation = { id: 'op-1', name: 'Red team / α%', created_at: '2026
 const OPERATION: OperationDetail = { ...SAVED, usage: { findings: 0, attacks: 0, scenario_runs: 0 } }
 const FINDING: FindingListItem = {
   id: 'finding-1', operation_id: 'op-1', title: 'Human assessment',
-  description: '', severity: 'informational', created_at: '2026-10-06T20:00:00Z', evidence_count: 0,
+  severity: 'informational', field_values: {}, created_at: '2026-10-06T20:00:00Z', evidence_count: 0,
 }
 const EMPTY = { items: [], has_more: false, next_offset: null }
 const NOT_FOUND = { isAxiosError: true, response: { status: 404, data: { detail: 'missing' } } }
@@ -42,9 +44,14 @@ function renderPage(route = '/operations/op-1', onOperationChanged?: () => void)
   )
 }
 
+async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
+  await user.click(screen.getByRole('combobox', { name: label }))
+  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
+}
+
 beforeEach(() => {
   jest.clearAllMocks()
-  jest.mocked(operationsApi.getFindingOptions).mockResolvedValue({ harm_types: ['Malware', 'Other'] })
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(DEFAULT_FINDING_FIELDS_FIXTURE)
   jest.mocked(operationsApi.get).mockResolvedValue(OPERATION)
   jest.mocked(operationsApi.listFindings).mockResolvedValue(EMPTY)
   jest.mocked(operationsApi.createFinding).mockResolvedValue(FINDING)
@@ -231,14 +238,13 @@ it('shows the operation and records a finding within it', async () => {
   const dialog = screen.getByRole('dialog')
   expect(within(dialog).queryByRole('combobox', { name: 'Operation' })).not.toBeInTheDocument()
   await user.type(within(dialog).getByRole('textbox', { name: 'Title' }), FINDING.title)
-  await user.selectOptions(within(dialog).getByRole('combobox', { name: 'Severity' }), 'informational')
+  await pick(user, 'Severity', 'Informational')
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ items: [FINDING], has_more: false, next_offset: null })
   await user.click(within(dialog).getByRole('button', { name: 'Save finding' }))
   expect(await screen.findByRole('heading', { level: 2, name: FINDING.title })).toBeInTheDocument()
   expect(screen.getByText('Informational')).toBeInTheDocument()
   expect(operationsApi.createFinding).toHaveBeenCalledWith('op-1', {
-    id: expect.any(String), title: FINDING.title, severity: 'informational', description: '',
-    severity_other: null, harm_type: null, harm_type_other: null,
+    id: expect.any(String), title: FINDING.title, severity: 'informational', field_values: {},
   })
 })
 
@@ -292,14 +298,14 @@ it.each([
   await user.click(await screen.findByRole('button', { name: 'New finding' }))
   let dialog = screen.getByRole('dialog')
   await user.type(within(dialog).getByRole('textbox', { name: 'Title' }), 'Draft title')
-  await user.selectOptions(within(dialog).getByRole('combobox', { name: 'Severity' }), 'critical')
+  await pick(user, 'Severity', 'Critical')
   await user.type(within(dialog).getByRole('textbox', { name: 'Description' }), 'Draft notes')
   await dismiss(user, dialog)
   await waitFor(() => { expect(screen.queryByRole('dialog', { hidden: true })).not.toBeInTheDocument() })
   await user.click(await screen.findByRole('button', { name: 'New finding' }))
   dialog = screen.getByRole('dialog')
   expect(within(dialog).getByRole('textbox', { name: 'Title' })).toHaveValue('')
-  expect(within(dialog).getByRole('combobox', { name: 'Severity' })).toHaveValue('moderate')
+  expect(within(dialog).getByRole('combobox', { name: 'Severity' })).toHaveValue('Moderate')
   expect(within(dialog).getByRole('textbox', { name: 'Description' })).toHaveValue('')
 })
 
@@ -334,24 +340,23 @@ it('disables saving a blank title and prevents duplicate submissions', async ()
 it('prefills edit fields and saves only editable values', async () => {
   const user = userEvent.setup()
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [FINDING] })
-  const edited = { ...FINDING, title: 'Edited assessment', severity: 'critical' as const, description: 'Notes' }
+  const edited = { ...FINDING, title: 'Edited assessment', severity: 'critical', field_values: { description: 'Notes' } }
   jest.mocked(operationsApi.updateFinding).mockResolvedValue(edited)
   renderPage('/operations/op-1?offset=20')
   await user.click(await screen.findByRole('button', { name: `Edit finding: ${FINDING.title}` }))
   const dialog = screen.getByRole('dialog')
   expect(within(dialog).getByRole('textbox', { name: 'Title' })).toHaveValue(FINDING.title)
-  expect(within(dialog).getByRole('combobox', { name: 'Severity' })).toHaveValue(FINDING.severity)
+  expect(within(dialog).getByRole('combobox', { name: 'Severity' })).toHaveValue('Informational')
   await user.clear(within(dialog).getByRole('textbox', { name: 'Title' }))
   await user.type(within(dialog).getByRole('textbox', { name: 'Title' }), edited.title)
-  await user.selectOptions(within(dialog).getByRole('combobox', { name: 'Severity' }), edited.severity)
-  await user.type(within(dialog).getByRole('textbox', { name: 'Description' }), edited.description)
+  await pick(user, 'Severity', 'Critical')
+  await user.type(within(dialog).getByRole('textbox', { name: 'Description' }), 'Notes')
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [edited] })
   await user.click(within(dialog).getByRole('button', { name: 'Save finding' }))
   await waitFor(() => { expect(screen.queryByRole('dialog')).not.toBeInTheDocument() })
   await waitFor(() => { expect(screen.getByRole('heading', { name: edited.title })).toBeInTheDocument() })
   expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
-    title: edited.title, severity: edited.severity, description: edited.description,
-    severity_other: null, harm_type: null, harm_type_other: null,
+    title: edited.title, severity: 'critical', field_values: { description: 'Notes' }, remove_retired_keys: [],
   })
 
   expect(operationsApi.createFinding).not.toHaveBeenCalled()
@@ -361,7 +366,7 @@ it('prefills edit fields and saves only editable values', async () => {
 it('displays and preserves both custom classifications when editing a finding', async () => {
   const user = userEvent.setup()
   const classified: FindingListItem = {
-    ...FINDING, severity: 'other', severity_other: 'Team severity', harm_type: 'Other', harm_type_other: 'Team harm',
+    ...FINDING, severity: 'Team severity', field_values: { harm_type: 'Team harm' },
   }
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [classified] })
   jest.mocked(operationsApi.updateFinding).mockResolvedValue(classified)
@@ -369,13 +374,12 @@ it('displays and preserves both custom classifications when editing a finding',
   expect(await screen.findByText('Team severity')).toBeInTheDocument()
   expect(screen.getByText('Harm-type: Team harm')).toBeInTheDocument()
   await user.click(screen.getByRole('button', { name: `Edit finding: ${FINDING.title}` }))
-  expect(screen.getByRole('textbox', { name: 'Other severity' })).toHaveValue('Team severity')
-  expect(screen.getByRole('textbox', { name: 'Other harm-type' })).toHaveValue('Team harm')
+  expect(screen.getByRole('textbox', { name: 'Other Severity' })).toHaveValue('Team severity')
+  expect(screen.getByRole('textbox', { name: 'Other Harm-type' })).toHaveValue('Team harm')
   await user.click(screen.getByRole('button', { name: 'Save finding' }))
   await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
   expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
-    title: FINDING.title, description: '', severity: 'other', severity_other: 'Team severity',
-    harm_type: 'Other', harm_type_other: 'Team harm',
+    title: FINDING.title, severity: 'Team severity', field_values: { harm_type: 'Team harm' }, remove_retired_keys: [],
   })
 })
 
@@ -395,17 +399,115 @@ it.each(['Cancel', 'Escape'])('discards edits with %s and restores the edit butt
   expect(within(screen.getByRole('dialog')).getByRole('textbox', { name: 'Title' })).toHaveValue(FINDING.title)
 })
 
-it('retains an edited draft on update failure', async () => {
+it('retains an edited draft on update failure and shows why the backend rejected it', async () => {
   const user = userEvent.setup()
+  const detail = 'Severity \'Critical\' matches the option \'critical\'. Send \'critical\' instead.'
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [FINDING] })
-  jest.mocked(operationsApi.updateFinding).mockRejectedValue(new Error('Update failed'))
+  jest.mocked(operationsApi.updateFinding).mockRejectedValue({
+    isAxiosError: true, response: { status: 422, data: { detail } },
+  })
   renderPage()
   await user.click(await screen.findByRole('button', { name: `Edit finding: ${FINDING.title}` }))
   const dialog = screen.getByRole('dialog')
   await user.type(within(dialog).getByRole('textbox', { name: 'Title' }), ' changed')
+  await pick(user, 'Severity', 'Other')
+  await user.type(within(dialog).getByRole('textbox', { name: 'Other Severity' }), 'Critical')
   await user.click(within(dialog).getByRole('button', { name: 'Save finding' }))
-  expect(await within(dialog).findByText('Update failed')).toBeInTheDocument()
+  expect(await within(dialog).findByText(detail)).toBeInTheDocument()
   expect(within(dialog).getByRole('textbox', { name: 'Title' })).toHaveValue(`${FINDING.title} changed`)
+  expect(within(dialog).getByRole('textbox', { name: 'Other Severity' })).toHaveValue('Critical')
+  expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
+    title: `${FINDING.title} changed`, severity: 'Critical', field_values: {}, remove_retired_keys: [],
+  })
+})
+
+it('shows configured rows and retired values on a finding card', async () => {
+  const user = userEvent.setup()
+  const steps = '1. Ask the Contoso assistant to repeat its instructions.\n2. Ask again in French.'
+  const contosoFinding: FindingListItem = {
+    ...FINDING, title: 'Contoso assistant repeats its system prompt', severity: 'sev1',
+    field_values: {
+      severity_rationale: 'customer_impact', category: 'model_security', subcategory: 'system_prompt_leak',
+      technique: 'Contoso persona swap', steps, owner: 'Contoso red team',
+      description: 'Recorded before Contoso configured its own fields.', contoso_ticket: 'CONTOSO-42',
+    },
+  }
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(CONTOSO_FINDING_FIELDS)
+  jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [contosoFinding] })
+  renderPage()
+
+  const card = (await screen.findByRole('heading', { level: 2, name: contosoFinding.title })).closest('li') as HTMLElement
+  expect(within(card).getByText('Sev 1')).toBeInTheDocument()
+  const rows = ['Severity rationale: Customer impact', 'Category: Model security', 'Subcategory: System prompt leak',
+    'Technique: Contoso persona swap', 'Owner: Contoso red team'].map(row => within(card).getByText(row))
+  for (const [index, row] of rows.slice(1).entries()) {
+    expect(rows[index].compareDocumentPosition(row) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+  }
+  expect(within(card).getByText('Steps to reproduce')).toBeInTheDocument()
+  expect(within(card).getByText(/Ask again in French/)).toHaveTextContent(steps, { normalizeWhitespace: false })
+  expect(within(card).queryByText(/^Steps to reproduce:/)).not.toBeInTheDocument()
+
+  const retired = within(card).getByRole('group', { name: 'Retired fields' })
+  expect(within(retired).getByText('description')).toBeInTheDocument()
+  expect(within(retired).getByText('Recorded before Contoso configured its own fields.')).toBeInTheDocument()
+  expect(within(retired).getByText('contoso_ticket')).toBeInTheDocument()
+  expect(within(retired).getByText('CONTOSO-42')).toBeInTheDocument()
+  expect(within(retired).queryByRole('button')).not.toBeInTheDocument()
+  expect(rows[4].compareDocumentPosition(retired) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+
+  await user.click(within(card).getByRole('button', { name: `Edit finding: ${contosoFinding.title}` }))
+  expect(within(screen.getByRole('dialog')).getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
+})
+
+it('sends the retired values removed in the edit dialog, and none for a new finding', async () => {
+  const user = userEvent.setup()
+  const legacy: FindingListItem = {
+    ...FINDING, field_values: { harm_type: 'Malware', contoso_ticket: 'CONTOSO-42', retired_owner: 'Contoso' },
+  }
+  jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [legacy] })
+  renderPage()
+  await user.click(await screen.findByRole('button', { name: `Edit finding: ${FINDING.title}` }))
+  await user.click(screen.getByRole('button', { name: 'Remove retired value contoso_ticket' }))
+  const confirmation = (await screen.findAllByRole('dialog'))
+    .find(dialog => within(dialog).queryByRole('button', { name: 'Keep it' })) as HTMLElement
+  await user.click(within(confirmation).getByRole('button', { name: 'Remove' }))
+  await user.click(await screen.findByRole('button', { name: 'Save finding' }))
+  await waitFor(() => expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
+    title: FINDING.title, severity: 'informational', field_values: { harm_type: 'Malware' },
+    remove_retired_keys: ['contoso_ticket'],
+  }))
+
+  await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+  await user.click(await screen.findByRole('button', { name: 'New finding' }))
+  await user.type(within(screen.getByRole('dialog')).getByRole('textbox', { name: 'Title' }), 'Fresh')
+  await user.click(screen.getByRole('button', { name: 'Save finding' }))
+  await waitFor(() => expect(operationsApi.createFinding).toHaveBeenCalledWith('op-1', {
+    id: expect.any(String), title: 'Fresh', severity: 'moderate', field_values: {},
+  }))
+})
+
+it('disables New finding until the fields load and offers Retry on failure', async () => {
+  const user = userEvent.setup()
+  const fields = deferred<FindingFields>()
+  jest.mocked(operationsApi.getFindingFields).mockReturnValueOnce(fields.promise)
+  jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [FINDING] })
+  renderPage()
+
+  const newFinding = await screen.findByRole('button', { name: 'New finding' })
+  expect(newFinding).toBeDisabled()
+  expect(screen.getByText('Loading findings…')).toBeInTheDocument()
+  expect(screen.queryByRole('heading', { level: 2, name: FINDING.title })).not.toBeInTheDocument()
+
+  await act(async () => { fields.reject(new Error('Fields offline')) })
+  expect(await screen.findByText(/Could not load finding fields: Fields offline/)).toBeInTheDocument()
+  expect(newFinding).toBeDisabled()
+  expect(screen.queryByRole('heading', { level: 2, name: FINDING.title })).not.toBeInTheDocument()
+
+  await user.click(screen.getByRole('button', { name: 'Retry finding fields' }))
+  expect(await screen.findByRole('heading', { level: 2, name: FINDING.title })).toBeInTheDocument()
+  expect(screen.queryByText(/Could not load finding fields/)).not.toBeInTheDocument()
+  expect(newFinding).toBeEnabled()
+  expect(operationsApi.getFindingFields).toHaveBeenCalledTimes(2)
 })
 
 it('requires delete confirmation and refreshes the first page after deleting its last finding', async () => {
diff --git a/frontend/src/components/Operations/OperationDetailPage.tsx b/frontend/src/components/Operations/OperationDetailPage.tsx
index d327beabb8..50e8ea8a75 100644
--- a/frontend/src/components/Operations/OperationDetailPage.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.tsx
@@ -7,10 +7,12 @@ import {
 import { AddRegular, ArrowLeftRegular } from '@fluentui/react-icons'
 
 import { DEFAULT_HISTORY_FILTERS, filtersToSearchParams } from '@/components/History/historyFilters'
+import { useFindingFields } from '@/hooks/useFindingFields'
 import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { Finding, FindingCreate, FindingListItem, FindingListResponse, OperationDetail } from '@/types'
-import FindingDialog, { type FindingSaveAttempt } from './FindingDialog'
+import type { Finding, FindingFields, FindingListItem, FindingListResponse, OperationDetail } from '@/types'
+import FindingCardValues from './FindingCardValues'
+import FindingDialog, { type FindingDraft, type FindingSaveAttempt } from './FindingDialog'
 import FindingEvidenceList from './FindingEvidenceList'
 import FindingExportDialog from './FindingExportDialog'
 import FindingSeverityBadge from './FindingSeverityBadge'
@@ -38,6 +40,7 @@ export default function OperationDetailPage({ onOperationChanged }: OperationDet
 function OperationDetailContent({ operationId, onOperationChanged }: { operationId: string } & OperationDetailPageProps) {
   const styles = useOperationsStyles()
   const navigate = useNavigate()
+  const { fields, error: fieldsError, retry: retryFields } = useFindingFields()
   const [params, setParams] = useSearchParams()
   const rawOffset = Number(params.get('offset') ?? 0)
   const offset = Number.isSafeInteger(rawOffset) && rawOffset >= 0 ? rawOffset : 0
@@ -98,11 +101,12 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
     setParams(nextOffset > 0 ? { offset: String(nextOffset) } : {})
   }
 
-  const save = async (draft: FindingCreate, attempt: FindingSaveAttempt): Promise<void> => {
+  const save = async (draft: FindingDraft, attempt: FindingSaveAttempt): Promise<void> => {
+    const { removeRetiredKeys = [], ...finding } = draft
     const saved = editing
-      ? await operationsApi.updateFinding(operationId, editing.id, draft)
+      ? await operationsApi.updateFinding(operationId, editing.id, { ...finding, remove_retired_keys: removeRetiredKeys })
       : await operationsApi.createFinding(operationId, {
-        ...draft, id: attempt.id, ...(attempt.attackResultId ? { attack_result_id: attempt.attackResultId } : {}),
+        ...finding, id: attempt.id, ...(attempt.attackResultId ? { attack_result_id: attempt.attackResultId } : {}),
       })
     setNotice(`Finding ${editing ? 'updated' : 'saved'}: ${saved.title}`)
     setOpen(false)
@@ -159,15 +163,14 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
     )
   }
 
-  const renderFinding = (finding: FindingListItem): React.ReactNode => (
+  const renderFinding = (finding: FindingListItem, findingFields: FindingFields): React.ReactNode => (
     <li key={finding.id} className={styles.item}>
       <h2 className={styles.title}>{finding.title}</h2>
       <div className={styles.metadata}>
-        <FindingSeverityBadge finding={finding} />
+        <FindingSeverityBadge fields={findingFields} severity={finding.severity} />
         <time dateTime={finding.created_at}>{new Date(finding.created_at).toLocaleString()}</time>
       </div>
-      {finding.harm_type && <Text>Harm-type: {finding.harm_type === 'Other' ? finding.harm_type_other : finding.harm_type}</Text>}
-      {finding.description && <p className={styles.description}>{finding.description}</p>}
+      <FindingCardValues fields={findingFields} finding={finding} />
       <FindingEvidenceList operationId={operationId} findingId={finding.id} count={finding.evidence_count}
         onDetached={() => { setEvidenceRevision(value => value + 1) }} actions={<>
           <Button className={styles.button} aria-label={`Edit finding: ${finding.title}`} onClick={event => {
@@ -203,18 +206,19 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
               onOperationChanged?.()
               void navigate('/operations')
             }} />
-          <FindingExportDialog key={current.operation.id} operation={current.operation} />
-          <Button ref={newFindingRef} appearance="primary" className={styles.button} icon={<AddRegular />} onClick={event => {
-            returnFocusRef.current = event.currentTarget
-            setEditing(null)
-            setOpen(true)
-          }}>New finding</Button>
+          {fields !== null && <FindingExportDialog key={current.operation.id} operation={current.operation}
+            fields={fields} />}
+          <Button ref={newFindingRef} appearance="primary" className={styles.button} icon={<AddRegular />}
+            disabled={fields === null} onClick={event => {
+              returnFocusRef.current = event.currentTarget
+              setEditing(null)
+              setOpen(true)
+            }}>New finding</Button>
         </div>
-        {open && <FindingDialog editing={editing !== null} evidenceField={editing === null}
+        {open && fields !== null && <FindingDialog fields={fields} editing={editing !== null}
+          evidenceField={editing === null}
           initialValues={editing ? {
-            title: editing.title, description: editing.description, severity: editing.severity,
-            severity_other: editing.severity_other ?? null, harm_type: editing.harm_type ?? null,
-            harm_type_other: editing.harm_type_other ?? null,
+            title: editing.title, severity: editing.severity, field_values: editing.field_values,
           } : undefined}
           onSave={save} onClose={() => { setOpen(false); setEditing(null) }} />}
       </header>
@@ -243,7 +247,12 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
       {notice && <MessageBar className={styles.notice} intent="success" aria-live="polite">
         <MessageBarBody>{notice}</MessageBarBody>
       </MessageBar>}
-      {settledKey !== requestKey ? <Spinner label="Loading findings…" /> : error ? (
+      {fieldsError ? (
+        <MessageBar intent="error"><MessageBarBody>
+          Could not load finding fields: {fieldsError}{' '}
+          <Button className={styles.button} aria-label="Retry finding fields" onClick={retryFields}>Retry</Button>
+        </MessageBarBody></MessageBar>
+      ) : fields === null || settledKey !== requestKey ? <Spinner label="Loading findings…" /> : error ? (
         <MessageBar intent="error"><MessageBarBody>
           Could not load findings: {error}{' '}
           <Button className={styles.button} onClick={() => { setRevision(value => value + 1) }}>Retry</Button>
@@ -251,7 +260,7 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
       ) : (
         <>
           {page.items.length === 0 ? <Text>No findings in this operation yet. Create one to record an assessment.</Text>
-            : <ul className={styles.list}>{page.items.map(renderFinding)}</ul>}
+            : <ul className={styles.list}>{page.items.map(finding => renderFinding(finding, fields))}</ul>}
           <div className={styles.header}>
             <Button className={styles.button} disabled={offset === 0} onClick={() => { navigatePage(0) }}>First</Button>
             <Text>Page {Math.floor(offset / PAGE_SIZE) + 1}</Text>
diff --git a/frontend/src/components/Operations/Operations.styles.ts b/frontend/src/components/Operations/Operations.styles.ts
index f839f9a0f0..8c42a1bf5e 100644
--- a/frontend/src/components/Operations/Operations.styles.ts
+++ b/frontend/src/components/Operations/Operations.styles.ts
@@ -58,6 +58,24 @@ export const useOperationsStyles = makeStyles({
     marginTop: tokens.spacingVerticalS,
   },
   description: { whiteSpace: 'pre-wrap', maxWidth: '75ch', marginBottom: 0 },
+  values: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalXS,
+    marginTop: tokens.spacingVerticalS,
+  },
+  valueText: { marginTop: tokens.spacingVerticalXXS },
+  retired: { display: 'flex', flexDirection: 'column', gap: tokens.spacingVerticalXXS },
+  retiredList: {
+    margin: 0,
+    padding: 0,
+    listStyleType: 'none',
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalXS,
+  },
+  retiredKey: { fontFamily: tokens.fontFamilyMonospace, fontSize: tokens.fontSizeBase200 },
+  retiredValue: { margin: 0, whiteSpace: 'pre-wrap', maxWidth: '75ch' },
   notice: { flexShrink: 0 },
   table: {
     minWidth: '100%',
diff --git a/frontend/src/components/Operations/OperationsPage.test.tsx b/frontend/src/components/Operations/OperationsPage.test.tsx
index 6ac4d7d030..a83e3eae13 100644
--- a/frontend/src/components/Operations/OperationsPage.test.tsx
+++ b/frontend/src/components/Operations/OperationsPage.test.tsx
@@ -1,14 +1,16 @@
-import { render, screen, waitFor, within } from '@testing-library/react'
+import { act, render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter, Route, Routes, useLocation } from 'react-router'
 
 import { operationsApi } from '@/services/api'
-import type { Operation, OperationListItem } from '@/types'
+import { deferred } from '@/test-utils/deferred'
+import { DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { FindingFields, Operation, OperationListItem } from '@/types'
 import OperationsPage from './OperationsPage'
 
 jest.mock('@/services/api', () => ({
-  operationsApi: { list: jest.fn(), create: jest.fn() },
+  operationsApi: { list: jest.fn(), create: jest.fn(), getFindingFields: jest.fn() },
 }))
 
 const OPERATION: OperationListItem = {
@@ -42,6 +44,7 @@ function conflict(existing: Operation): unknown {
 beforeEach(() => {
   jest.clearAllMocks()
   jest.mocked(operationsApi.list).mockResolvedValue({ items: [OPERATION] })
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(DEFAULT_FINDING_FIELDS_FIXTURE)
 })
 
 it('lists operations as links to their pages', async () => {
@@ -51,21 +54,41 @@ it('lists operations as links to their pages', async () => {
   expect(screen.getByTestId('location')).toHaveTextContent('/operations/op-1')
 })
 
-it('summarizes finding counts by severity in severity order', async () => {
+it('summarizes finding counts in the configured order with one Other badge', async () => {
   jest.mocked(operationsApi.list).mockResolvedValue({
     items: [
-      { ...OPERATION, finding_counts: { low: 1, critical: 2 } },
+      { ...OPERATION, finding_counts: { low: 1, 'Team severity': 1, critical: 2, sev3: 2 } },
       { ...OPERATION, id: 'op-2', name: 'Operation B' },
     ],
   })
   renderPage()
   const rowA = (await screen.findByRole('link', { name: /Operation A/ })).closest('tr') as HTMLElement
-  const badges = within(rowA).getAllByText(/^\d+ /)
-  expect(badges.map(badge => badge.textContent)).toEqual(['2 Critical', '1 Low'])
+  const badges = await within(rowA).findAllByText(/^\d+ /)
+  expect(badges.map(badge => badge.textContent)).toEqual(['2 Critical', '1 Low', '3 Other'])
+  expect(badges[0]).not.toHaveAccessibleDescription()
+  expect(badges[2]).toHaveAccessibleDescription('sev3: 2, Team severity: 1')
   const rowB = screen.getByRole('link', { name: /Operation B/ }).closest('tr') as HTMLElement
   expect(within(rowB).getByText('No findings')).toBeInTheDocument()
 })
 
+it('waits for the finding fields before showing counts and offers Retry on failure', async () => {
+  const user = userEvent.setup()
+  const fields = deferred<FindingFields>()
+  jest.mocked(operationsApi.getFindingFields).mockReturnValueOnce(fields.promise)
+  jest.mocked(operationsApi.list).mockResolvedValue({ items: [{ ...OPERATION, finding_counts: { critical: 2 } }] })
+  renderPage()
+  const row = (await screen.findByRole('link', { name: /Operation A/ })).closest('tr') as HTMLElement
+  expect(within(row).getByRole('progressbar', { name: 'Loading finding counts' })).toBeInTheDocument()
+  expect(within(row).queryByText('2 Critical')).not.toBeInTheDocument()
+
+  await act(async () => { fields.reject(new Error('Fields offline')) })
+  expect(await screen.findByText(/Could not load finding fields: Fields offline/)).toBeInTheDocument()
+  expect(within(row).queryByText('2 Critical')).not.toBeInTheDocument()
+  await user.click(screen.getByRole('button', { name: 'Retry finding fields' }))
+  expect(await within(row).findByText('2 Critical')).toBeInTheDocument()
+  expect(screen.queryByText(/Could not load finding fields/)).not.toBeInTheDocument()
+})
+
 it('shows an empty state when no operations exist', async () => {
   jest.mocked(operationsApi.list).mockResolvedValue({ items: [] })
   renderPage()
diff --git a/frontend/src/components/Operations/OperationsPage.tsx b/frontend/src/components/Operations/OperationsPage.tsx
index 3377b2f1e3..7afefd0e67 100644
--- a/frontend/src/components/Operations/OperationsPage.tsx
+++ b/frontend/src/components/Operations/OperationsPage.tsx
@@ -2,21 +2,49 @@ import { useEffect, useState } from 'react'
 import { Link, useNavigate } from 'react-router'
 import {
   Badge, Button, MessageBar, MessageBarBody, Spinner, Table, TableBody, TableCell, TableHeader,
-  TableHeaderCell, TableRow, Text,
+  TableHeaderCell, TableRow, Text, Tooltip,
 } from '@fluentui/react-components'
 
+import { useFindingFields } from '@/hooks/useFindingFields'
 import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { FindingSeverity, OperationListItem } from '@/types'
-import { FINDING_SEVERITY_LABELS, findingSeverityColor } from '@/utils/findingSeverity'
+import type { FindingFields, OperationListItem } from '@/types'
+import { severityCountBadges, type SeverityCountBadge } from '@/utils/findingFields'
 import { useOperationsStyles } from './Operations.styles'
 import OperationCreateDialog from './OperationCreateDialog'
 
-const SEVERITY_ORDER = Object.keys(FINDING_SEVERITY_LABELS) as FindingSeverity[]
+interface FindingCountsProps {
+  fields: FindingFields
+  counts: Record<string, number>
+}
+
+/** One badge per counted severity option, then one Other badge whose tooltip lists the unmatched severities. */
+function FindingCounts({ fields, counts }: FindingCountsProps) {
+  const styles = useOperationsStyles()
+  const badges = severityCountBadges(fields, counts)
+  if (badges.length === 0) return <Text size={200} className={styles.muted}>No findings</Text>
+  return (
+    <div className={styles.badgeGroup}>
+      {badges.map((badge: SeverityCountBadge) => {
+        const text = `${badge.count} ${badge.label}`
+        // The Other badge's key can match an option key, so option badges and it use separate key spaces.
+        if (badge.tooltip === null) {
+          return <Badge key={`option-${badge.key}`} appearance="tint" color={badge.color}>{text}</Badge>
+        }
+        return (
+          <Tooltip key="unmatched" relationship="description" content={badge.tooltip}>
+            <Badge appearance="tint" color={badge.color} tabIndex={0}>{text}</Badge>
+          </Tooltip>
+        )
+      })}
+    </div>
+  )
+}
 
 export default function OperationsPage() {
   const styles = useOperationsStyles()
   const navigate = useNavigate()
+  const { fields, error: fieldsError, retry: retryFields } = useFindingFields()
   const [operations, setOperations] = useState<OperationListItem[]>([])
   const [settledRevision, setSettledRevision] = useState(-1)
   const [revision, setRevision] = useState(0)
@@ -41,6 +69,10 @@ export default function OperationsPage() {
         />
       </header>
       <Text>Engagements that group human findings.</Text>
+      {fieldsError && <MessageBar intent="error"><MessageBarBody>
+        Could not load finding fields: {fieldsError}{' '}
+        <Button className={styles.button} aria-label="Retry finding fields" onClick={retryFields}>Retry</Button>
+      </MessageBarBody></MessageBar>}
       {loading ? <Spinner label="Loading operations…" /> : error ? (
         <MessageBar intent="error"><MessageBarBody>
           Could not load operations: {error}{' '}
@@ -58,35 +90,23 @@ export default function OperationsPage() {
             </TableRow>
           </TableHeader>
           <TableBody>
-            {operations.map(operation => {
-              const counts = SEVERITY_ORDER.flatMap(severity => {
-                const count = operation.finding_counts[severity]
-                return count ? [{ severity, count }] : []
-              })
-              return (
-                <TableRow key={operation.id}>
-                  <TableCell>
-                    <Link to={`/operations/${encodeURIComponent(operation.id)}`} className={styles.link}
-                      translate="no">{operation.name}</Link>
-                  </TableCell>
-                  <TableCell>
-                    {counts.length > 0 ? (
-                      <div className={styles.badgeGroup}>
-                        {counts.map(({ severity, count }) => (
-                          <Badge key={severity} appearance="tint" color={findingSeverityColor(severity)}>
-                            {count} {FINDING_SEVERITY_LABELS[severity]}
-                          </Badge>
-                        ))}
-                      </div>
-                    ) : <Text size={200} className={styles.muted}>No findings</Text>}
-                  </TableCell>
-                  <TableCell>
-                    <Text size={200}><time dateTime={operation.created_at}>
-                      {new Date(operation.created_at).toLocaleString()}</time></Text>
-                  </TableCell>
-                </TableRow>
-              )
-            })}
+            {operations.map(operation => (
+              <TableRow key={operation.id}>
+                <TableCell>
+                  <Link to={`/operations/${encodeURIComponent(operation.id)}`} className={styles.link}
+                    translate="no">{operation.name}</Link>
+                </TableCell>
+                <TableCell>
+                  {fields !== null ? <FindingCounts fields={fields} counts={operation.finding_counts} />
+                    : fieldsError ? <Text size={200} className={styles.muted}>Counts unavailable</Text>
+                      : <Spinner size="extra-tiny" aria-label="Loading finding counts" />}
+                </TableCell>
+                <TableCell>
+                  <Text size={200}><time dateTime={operation.created_at}>
+                    {new Date(operation.created_at).toLocaleString()}</time></Text>
+                </TableCell>
+              </TableRow>
+            ))}
           </TableBody>
         </Table>
       )}
diff --git a/frontend/src/hooks/useFindingFields.test.tsx b/frontend/src/hooks/useFindingFields.test.tsx
index 1d0bbf6b57..8fdb9df744 100644
--- a/frontend/src/hooks/useFindingFields.test.tsx
+++ b/frontend/src/hooks/useFindingFields.test.tsx
@@ -59,4 +59,23 @@ describe('useFindingFields', () => {
     expect(mockGetFindingFields).toHaveBeenCalledTimes(2)
     expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS)
   })
+
+  it('loads only while enabled, again each time it is enabled, and clears an earlier failure', async () => {
+    mockGetFindingFields
+      .mockRejectedValueOnce(new Error('The Contoso backend is unavailable.'))
+      .mockResolvedValueOnce(CONTOSO_FINDING_FIELDS)
+
+    const { result, rerender } = renderHook(({ enabled }: { enabled: boolean }) => useFindingFields(enabled), {
+      initialProps: { enabled: false },
+    })
+    expect(mockGetFindingFields).not.toHaveBeenCalled()
+
+    rerender({ enabled: true })
+    await waitFor(() => expect(result.current.error).toBe('The Contoso backend is unavailable.'))
+    rerender({ enabled: false })
+    rerender({ enabled: true })
+    await waitFor(() => expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS))
+    expect(result.current.error).toBe('')
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(2)
+  })
 })
diff --git a/frontend/src/hooks/useFindingFields.ts b/frontend/src/hooks/useFindingFields.ts
index 5351bf6990..2846540063 100644
--- a/frontend/src/hooks/useFindingFields.ts
+++ b/frontend/src/hooks/useFindingFields.ts
@@ -12,17 +12,24 @@ interface FindingFieldsState {
   readonly retry: () => void
 }
 
-/** Loads the active finding fields once, for the finding dialog, cards and counts. */
-export function useFindingFields(): FindingFieldsState {
+/**
+ * Loads the active finding fields, for the finding dialog, cards and counts.
+ * @param enabled - Loads only while true, and again each time it turns true, so a closed dialog fetches nothing.
+ */
+export function useFindingFields(enabled = true): FindingFieldsState {
   const [fields, setFields] = useState<FindingFields | null>(null)
   const [error, setError] = useState('')
   const [attempt, setAttempt] = useState(0)
 
   useEffect(() => {
+    if (!enabled) return
     let ignore = false
     operationsApi.getFindingFields()
       .then((loaded: FindingFields) => {
-        if (!ignore) setFields(loaded)
+        if (!ignore) {
+          setFields(loaded)
+          setError('')
+        }
       })
       .catch((cause: unknown) => {
         if (!ignore) setError(toApiError(cause).detail)
@@ -30,7 +37,7 @@ export function useFindingFields(): FindingFieldsState {
     return () => {
       ignore = true
     }
-  }, [attempt])
+  }, [attempt, enabled])
 
   const retry = useCallback(() => {
     setError('')
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index d330138e4b..fc877c9083 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -48,12 +48,6 @@ import { DEFAULT_ANALYTICS_VIEW } from "@/utils/attackAnalytics";
 
 describe("api service", () => {
   describe("operationsApi", () => {
-    it("reads canonical harm categories without copying the taxonomy into the frontend", async () => {
-      const options = { harm_types: ["Malware", "Other"] };
-      (apiClient.get as jest.Mock).mockResolvedValueOnce({ data: options });
-      expect(await operationsApi.getFindingOptions()).toEqual(options);
-      expect(apiClient.get).toHaveBeenCalledWith("/operations/finding-options");
-    });
     it("gets finding fields", async () => {
       (apiClient.get as jest.Mock).mockResolvedValueOnce({ data: DEFAULT_FINDING_FIELDS_FIXTURE });
       expect(await operationsApi.getFindingFields()).toEqual(DEFAULT_FINDING_FIELDS_FIXTURE);
@@ -79,7 +73,8 @@ describe("api service", () => {
       expect(apiClient.delete).toHaveBeenCalledWith("/operations/a%2Fb/findings/c%2Fd/evidence/e%2Ff");
     });
     it("nests finding requests under an encoded operation ID", async () => {
-      const request = { title: "Assessment", description: "", severity: "low" as const };
+      const request = { title: "Assessment", severity: "low", field_values: { description: "Notes" } };
+      const update = { ...request, remove_retired_keys: ["contoso_ticket"] };
       (apiClient.post as jest.Mock).mockResolvedValueOnce({ data: { name: "Case" } });
       await operationsApi.create({ name: " Case / α% " });
       expect(apiClient.post).toHaveBeenCalledWith("/operations", { name: " Case / α% " });
@@ -92,8 +87,8 @@ describe("api service", () => {
         params: { limit: 20, offset: 0 },
       });
       (apiClient.put as jest.Mock).mockResolvedValueOnce({ data: request });
-      expect(await operationsApi.updateFinding("a/b", "c/d", request)).toEqual(request);
-      expect(apiClient.put).toHaveBeenCalledWith("/operations/a%2Fb/findings/c%2Fd", request);
+      expect(await operationsApi.updateFinding("a/b", "c/d", update)).toEqual(request);
+      expect(apiClient.put).toHaveBeenCalledWith("/operations/a%2Fb/findings/c%2Fd", update);
       (apiClient.delete as jest.Mock).mockResolvedValueOnce({ data: undefined });
       expect(await operationsApi.deleteFinding("a/b", "c/d")).toBeUndefined();
       expect(apiClient.delete).toHaveBeenCalledWith("/operations/a%2Fb/findings/c%2Fd");
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index c96b777c73..f6c6bec97d 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -80,11 +80,10 @@ import type {
   UpdateAttackRequest,
   SaveConversationRequest,
   Finding,
-  FindingCreate,
   FindingCreateRequest,
   FindingFields,
   FindingListResponse,
-  FindingOptionsResponse,
+  FindingUpdateRequest,
   FindingEvidenceCreateRequest,
   FindingEvidenceAttachResponse,
   FindingEvidenceListResponse,
@@ -107,9 +106,6 @@ const API_BASE_URL = import.meta.env.VITE_API_URL || '/api'
 const operationPath = (operationId: string): string => `/operations/${encodeURIComponent(operationId)}`
 
 export const operationsApi = {
-  getFindingOptions: async (): Promise<FindingOptionsResponse> => {
-    return (await apiClient.get('/operations/finding-options')).data
-  },
   getFindingFields: async (): Promise<FindingFields> => {
     return (await apiClient.get('/operations/finding-fields')).data
   },
@@ -136,7 +132,7 @@ export const operationsApi = {
   createFinding: async (operationId: string, request: FindingCreateRequest): Promise<Finding> => {
     return (await apiClient.post(`${operationPath(operationId)}/findings`, request)).data
   },
-  updateFinding: async (operationId: string, findingId: string, request: FindingCreate): Promise<Finding> => {
+  updateFinding: async (operationId: string, findingId: string, request: FindingUpdateRequest): Promise<Finding> => {
     return (await apiClient.put(`${operationPath(operationId)}/findings/${encodeURIComponent(findingId)}`, request)).data
   },
   deleteFinding: async (operationId: string, findingId: string): Promise<void> => {
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 2adf77c6ad..53aec5cbd4 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -2155,7 +2155,6 @@ export interface RuntimeStatus {
   outcome: string
   message: string
 }
-export type FindingSeverity = 'critical' | 'important' | 'moderate' | 'low' | 'informational' | 'other'
 
 export interface OperationCreate {
   name: string
@@ -2185,7 +2184,8 @@ export interface OperationDetail extends Operation {
 }
 
 export interface OperationListItem extends Operation {
-  finding_counts: Partial<Record<FindingSeverity, number>>
+  /** Finding counts by stored severity, including severities that match no current option. */
+  finding_counts: Record<string, number>
 }
 
 export interface OperationListResponse {
@@ -2194,11 +2194,10 @@ export interface OperationListResponse {
 
 export interface FindingCreate {
   title: string
-  description: string
-  severity: FindingSeverity
-  severity_other?: string | null
-  harm_type?: string | null
-  harm_type_other?: string | null
+  /** A severity option key, or Other text. */
+  severity: string
+  /** Values of the other fields and of every level, by key. Severity isn't one of them. */
+  field_values: Record<string, string>
 }
 
 /** Resending the same id and content returns the finding an earlier, unanswered request saved. */
@@ -2213,10 +2212,6 @@ export interface FindingUpdateRequest extends FindingCreate {
   remove_retired_keys: string[]
 }
 
-export interface FindingOptionsResponse {
-  harm_types: string[]
-}
-
 export type FindingFieldType = 'text' | 'multiline' | 'choice'
 
 export type FindingSeverityColor = 'red' | 'orange' | 'yellow' | 'green' | 'blue' | 'gray' | 'dark' | 'neutral'
diff --git a/frontend/src/utils/findingSeverity.test.ts b/frontend/src/utils/findingSeverity.test.ts
deleted file mode 100644
index 47463f8341..0000000000
--- a/frontend/src/utils/findingSeverity.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { findingSeverityColor, findingSeverityLabel, FINDING_SEVERITY_LABELS } from './findingSeverity'
-import type { FindingSeverity } from '@/types'
-
-it.each<[FindingSeverity, string, string]>([
-  ['critical', 'Critical', 'danger'],
-  ['important', 'Important', 'warning'],
-  ['moderate', 'Moderate', 'warning'],
-  ['low', 'Low', 'informative'],
-  ['informational', 'Informational', 'subtle'],
-  ['other', 'Other', 'subtle'],
-])('uses the Operations label and badge color for %s', (severity, label, color) => {
-  expect(FINDING_SEVERITY_LABELS[severity]).toBe(label)
-  expect(findingSeverityColor(severity)).toBe(color)
-})
-
-it('shows the custom assessment as a neutral badge instead of assigning its text a preset priority', () => {
-  expect(findingSeverityLabel({ severity: 'other', severity_other: 'Critical' })).toBe('Critical')
-  expect(findingSeverityColor('other')).toBe('subtle')
-  expect(findingSeverityLabel({ severity: 'low' })).toBe('Low')
-})
diff --git a/frontend/src/utils/findingSeverity.ts b/frontend/src/utils/findingSeverity.ts
deleted file mode 100644
index fd2babd206..0000000000
--- a/frontend/src/utils/findingSeverity.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { FindingCreate, FindingSeverity } from '@/types'
-
-export const FINDING_SEVERITY_LABELS: Record<FindingSeverity, string> = {
-  critical: 'Critical', important: 'Important', moderate: 'Moderate',
-  low: 'Low', informational: 'Informational', other: 'Other',
-}
-
-export function findingSeverityLabel(finding: Pick<FindingCreate, 'severity' | 'severity_other'>): string {
-  return finding.severity === 'other' ? finding.severity_other ?? FINDING_SEVERITY_LABELS.other : FINDING_SEVERITY_LABELS[finding.severity]
-}
-
-export function findingSeverityColor(severity: FindingSeverity): 'danger' | 'warning' | 'informative' | 'subtle' {
-  if (severity === 'critical') return 'danger'
-  if (severity === 'important' || severity === 'moderate') return 'warning'
-  return severity === 'informational' || severity === 'other' ? 'subtle' : 'informative'
-}

From 476e91cf3b688efc560c7e2e0f0176d3a74e4a03 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 09:35:56 -0400
Subject: [PATCH 11/20] Document finding fields and address the final review

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 doc/code/setup/finding_fields.md              | 86 +++++++++++++++++++
 doc/gui/0_gui.md                              |  6 +-
 doc/myst.yml                                  |  1 +
 frontend/e2e/operations.spec.ts               | 80 ++++++++++++++---
 .../Operations/FindingDialog.test.tsx         |  2 +-
 .../Operations/FindingFieldInput.test.tsx     | 18 ++++
 .../Operations/FindingFieldInput.tsx          |  8 +-
 .../Operations/OperationDetailPage.test.tsx   |  2 +-
 .../Operations/RetiredFieldValues.test.tsx    | 25 ++++++
 .../Operations/RetiredFieldValues.tsx         |  8 +-
 frontend/src/utils/findingFields.test.ts      | 22 ++++-
 frontend/src/utils/findingFields.ts           | 17 ++--
 pyrit/models/finding_fields.py                |  3 +-
 tests/unit/backend/conftest.py                | 36 ++++++++
 .../test_operation_service_findings.py        | 66 +++++++-------
 tests/unit/backend/test_operations.py         | 50 +++++++----
 .../test_finding_field_values_migration.py    | 20 +++++
 tests/unit/models/test_finding_fields.py      | 11 ++-
 18 files changed, 381 insertions(+), 80 deletions(-)
 create mode 100644 doc/code/setup/finding_fields.md

diff --git a/doc/code/setup/finding_fields.md b/doc/code/setup/finding_fields.md
new file mode 100644
index 0000000000..b747f09c19
--- /dev/null
+++ b/doc/code/setup/finding_fields.md
@@ -0,0 +1,86 @@
+# Finding Fields
+
+A finding in CoPyRIT has a title, a severity and a set of fields. Each deployment chooses those fields. The finding dialog, the finding cards and the exports all follow them.
+
+## Default Fields
+
+Without any configuration, findings use these fields:
+
+- **Severity**: Critical, Important, Moderate, Low or Informational. People can also choose **Other** and type their own text. The dialog preselects Moderate.
+- **Harm-type**: optional. Its list is searchable, and it also takes **Other** text.
+- **Description**: optional multi-line text.
+
+## Defining Your Own Fields
+
+To use other fields, subclass `FindingsInitializer` and return a `FindingFields` from `get_finding_fields`. The `severity` slot is always a required choice field. The fields in `fields` follow it in the dialog.
+
+```python
+from pyrit.models.finding_fields import FindingField, FindingFields, FindingFieldType, FindingSeverityColor
+from pyrit.setup.initializers import FindingsInitializer
+
+
+class ContosoFindingsInitializer(FindingsInitializer):
+    """Finding fields for the Contoso red team."""
+
+    def get_finding_fields(self) -> FindingFields:
+        return FindingFields(
+            severity=FindingField(
+                key="severity",
+                label="Severity",
+                type=FindingFieldType.CHOICE,
+                options=[("sev1", "Sev 1"), ("sev2", "Sev 2"), ("sev3", "Sev 3")],
+                default="sev2",
+                colors={"sev1": FindingSeverityColor.RED, "sev2": FindingSeverityColor.ORANGE},
+            ),
+            fields=[
+                FindingField(
+                    key="area",
+                    label="Area",
+                    type=FindingFieldType.CHOICE,
+                    required=True,
+                    options={
+                        ("content", "Content safety"): [("hate", "Hate"), ("violence", "Violence")],
+                        ("security", "Security"): [("prompt_injection", "Prompt injection")],
+                    },
+                    levels=[("subarea", "Subarea")],
+                ),
+                FindingField(key="repro_steps", label="Repro steps", type=FindingFieldType.MULTILINE),
+                FindingField(key="contoso_ticket", label="Contoso ticket", type=FindingFieldType.TEXT, internal=True),
+            ],
+        )
+```
+
+A few things to note in this example:
+
+- Options are `(key, label)` pairs. The finding stores the `key`, and people see the `label`. Field and level keys use lowercase letters, digits and underscores. Option keys can be any text that isn't blank.
+- `Area` is a cascade. Each of its options maps to the options of a second dropdown. `levels` names that dropdown, and its value is stored under `subarea`.
+- `colors` sets the badge color of a severity option.
+- `internal=True` keeps `Contoso ticket` out of exports. The dashboard still shows it.
+
+`FindingField` also takes `hint`, `section` and `allow_other`. Its docstring describes each setting.
+
+Save the script as `contoso_findings.py` in your custom initializers source. The file name is the initializer's name. Then turn it on in `.pyrit_conf`:
+
+```yaml
+allow_custom_initializers: true
+custom_initializers_source: /srv/contoso/pyrit_initializers
+initializers:
+  - name: target
+  - name: technique
+  - name: contoso_findings
+```
+
+With `allow_custom_initializers: true`, the backend runs every script in that source. Only trusted administrators should be able to write to it. See [the configuration file guide](../../getting_started/pyrit_conf.md) for details.
+
+## Rules
+
+- Use one `FindingsInitializer` per deployment. If the configuration lists two, or the fields are invalid, the backend doesn't start. A live apply reports invalid configuration instead, and the running fields don't change.
+- Change a field's `label` to rename what people see.
+- A changed `key` makes a new field. Values saved under the old key show under **Retired fields**, where they are read-only. Edits keep them. **Remove** deletes one when you save.
+- Other text that matches an option's key or label is rejected, ignoring case and surrounding spaces. The message names the option to choose instead.
+- On the Operations list, severities that match no option share one **Other** count.
+- Exports put multi-line fields in the Finding column, and choice and text fields in the Assessment column. They leave out internal fields and retired values. The export dialog warns when selected findings have retired values.
+
+## Upgrading
+
+One database migration moves findings saved before finding fields existed. It stores Other severity text as the `severity` itself, and moves the harm type and description into field values. Finding IDs and evidence don't change. Downgrading that migration refuses while any finding exists.
diff --git a/doc/gui/0_gui.md b/doc/gui/0_gui.md
index b653464ac1..df4a703892 100644
--- a/doc/gui/0_gui.md
+++ b/doc/gui/0_gui.md
@@ -135,8 +135,10 @@ This is a cross-result report, not the progress dashboard for one scanner run.
 ## Operations
 
 Operations organize human findings for an engagement. Create an operation,
-record findings with severity and description, and attach saved attacks as
-evidence. A model score does not create a finding automatically.
+record findings, and attach saved attacks as evidence. Findings use the
+deployment's [finding fields](../code/setup/finding_fields.md), which by default
+are severity, harm type, and description. A model score does not create a
+finding automatically.
 
 Select an operation in the labels bar to associate new chats and scans with it.
 The operation page brings its findings, linked evidence, and execution history
diff --git a/doc/myst.yml b/doc/myst.yml
index 00c3bfbfe1..7e8d20f1ae 100644
--- a/doc/myst.yml
+++ b/doc/myst.yml
@@ -180,6 +180,7 @@ project:
             - file: code/setup/1_configuration.ipynb
             - file: code/setup/2_resiliency.ipynb
             - file: code/setup/default_values.md
+            - file: code/setup/finding_fields.md
             - file: code/setup/pyrit_initializer.ipynb
         - file: code/scenarios/0_scenarios.ipynb
           children:
diff --git a/frontend/e2e/operations.spec.ts b/frontend/e2e/operations.spec.ts
index 5ed51dad47..d05ab9e2b8 100644
--- a/frontend/e2e/operations.spec.ts
+++ b/frontend/e2e/operations.spec.ts
@@ -3,7 +3,7 @@ import { readFileSync } from 'node:fs'
 import { test, expect } from '@playwright/test'
 
 import type {
-  CreateAttackResponse, Finding, FindingEvidenceAttachResponse, FindingExportFormat, Operation,
+  CreateAttackResponse, Finding, FindingEvidenceAttachResponse, FindingExportFormat, FindingFields, Operation,
 } from '../src/types'
 import { waitForAppReady } from './_runtime'
 
@@ -21,7 +21,7 @@ for (const width of [1280, 390]) {
     const severity = `Custom severity ${'classification'.repeat(16)}`
     const harmType = `Custom harm ${'unbroken'.repeat(25)}`
     const findingResponse = await request.post(`/api/operations/${operation.id}/findings`, {
-      headers, data: { title, severity: 'other', severity_other: severity, harm_type: 'Other', harm_type_other: harmType },
+      headers, data: { title, severity, field_values: { harm_type: harmType } },
     })
     expect(findingResponse.status()).toBe(201)
 
@@ -65,10 +65,7 @@ for (const width of [1280, 390]) {
     )).toBeTruthy()
     const label = dialog.locator('label').filter({ hasText: title })
     expect(await label.evaluate(element => element.scrollWidth <= element.clientWidth)).toBeTruthy()
-    const pickerBadgeBox = await pickerBadge.boundingBox()
-    const harmBox = await dialog.getByText(`Harm-type: ${harmType}`, { exact: true }).boundingBox()
-    if (!pickerBadgeBox || !harmBox) throw new Error('Expected visible picker classifications.')
-    expect(pickerBadgeBox.y + pickerBadgeBox.height).toBeLessThanOrEqual(harmBox.y)
+    await expect(dialog.getByText(`Harm-type: ${harmType}`, { exact: true })).toHaveCount(0)
     expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBeTruthy()
     await radio.focus()
     await page.keyboard.press('Space')
@@ -116,7 +113,8 @@ test('creates a unique operation and records findings within it @seeded', async
   dialog = page.getByRole('dialog')
   await expect(dialog.getByRole('combobox', { name: 'Operation' })).toHaveCount(0)
   await dialog.getByRole('textbox', { name: 'Title' }).fill(title)
-  await dialog.getByRole('combobox', { name: 'Severity' }).selectOption('informational')
+  await dialog.getByRole('combobox', { name: 'Severity' }).click()
+  await page.getByRole('option', { name: 'Informational', exact: true }).click()
   await dialog.getByRole('textbox', { name: 'Description' }).fill(description)
   const savedResponse = page.waitForResponse(response =>
     response.url().endsWith(`/api/operations/${operation.id}/findings`) && response.request().method() === 'POST')
@@ -145,7 +143,7 @@ test('creates a unique operation and records findings within it @seeded', async
   const headers = { 'PyRIT-Compatibility-ID': version.compatibility_id }
   for (let index = 0; index < 21; index++) {
     const response = await request.post(`/api/operations/${operation.id}/findings`, {
-      headers, data: { title: `Assessment ${index}`, description: '', severity: index === 20 ? 'critical' : 'low' },
+      headers, data: { title: `Assessment ${index}`, severity: index === 20 ? 'critical' : 'low' },
     })
 
     expect(response.status()).toBe(201)
@@ -189,7 +187,7 @@ test('renames an operation and deletes it only once it is empty @seeded', async
     headers, data: { name: `Typo operation ${stamp}` },
   })).json()
   const finding: Finding = await (await request.post(`/api/operations/${operation.id}/findings`, {
-    headers, data: { title: 'Blocks deletion', description: '', severity: 'low' },
+    headers, data: { title: 'Blocks deletion', severity: 'low' },
   })).json()
 
   await page.goto(`/operations/${operation.id}`)
@@ -305,7 +303,7 @@ test('selects saved operations inline and revisits ID-scoped attack history @see
     expect(other.ok()).toBeTruthy()
   }
   const finding = await request.post(`/api/operations/${operation.id}/findings`, {
-    headers, data: { title: 'Independent human finding', description: '', severity: 'low' },
+    headers, data: { title: 'Independent human finding', severity: 'low' },
   })
   expect(finding.status()).toBe(201)
   if (!sourceAttack) throw new Error('Expected a saved attack for the evidence test.')
@@ -370,7 +368,7 @@ test('exports selected findings as Word and Markdown @seeded', async ({ page, re
   // Saved out of severity order, so the document's order can only come from severity.
   const seeds = [
     { title: 'Export low', severity: 'low' },
-    { title: 'Export critical', severity: 'critical', description },
+    { title: 'Export critical', severity: 'critical', field_values: { description } },
     { title: longTitle, severity: 'informational' },
     ...Array.from({ length: 17 }, (_, index) => ({
       title: `Export moderate ${String(index).padStart(2, '0')}`, severity: 'moderate',
@@ -509,3 +507,63 @@ test('exports selected findings as Word and Markdown @seeded', async ({ page, re
   await page.goto(link)
   await expect(page.getByText('Saved offline evidence.', { exact: true })).toBeVisible()
 })
+
+test('keeps the page usable after removing a retired value and cancelling the edit @seeded', async ({
+  page, request,
+}) => {
+  const version = await (await request.get('/api/version')).json()
+  const headers = { 'PyRIT-Compatibility-ID': version.compatibility_id }
+  const fieldsResponse = await request.get('/api/operations/finding-fields', { headers })
+  expect(fieldsResponse.ok()).toBeTruthy()
+  const fields: FindingFields = await fieldsResponse.json()
+  const operationResponse = await request.post('/api/operations', {
+    headers, data: { name: `Retired values ${Date.now()}` },
+  })
+  expect(operationResponse.status()).toBe(201)
+  const operation: Operation = await operationResponse.json()
+  const title = 'Contoso retired notes'
+  const notes = 'Recorded before Contoso changed its finding fields.'
+  const findingResponse = await request.post(`/api/operations/${operation.id}/findings`, {
+    headers, data: { title, severity: 'low', field_values: { description: notes } },
+  })
+  expect(findingResponse.status()).toBe(201)
+  // The seeded backend accepts only known keys, so the browser gets the fields without Description instead,
+  // which makes the saved description a retired value.
+  await page.route('**/api/operations/finding-fields', async route => {
+    await route.fulfill({ json: { ...fields, fields: fields.fields.filter(field => field.key !== 'description') } })
+  })
+
+  await page.goto(`/operations/${operation.id}`)
+  await waitForAppReady(page)
+  const edit = page.getByRole('button', { name: `Edit finding: ${title}`, exact: true })
+  const dialog = page.getByRole('dialog', { name: 'Edit finding' })
+  const retired = dialog.getByRole('group', { name: 'Retired fields · read-only' })
+  const removeButton = retired.getByRole('button', { name: 'Remove retired value description', exact: true })
+  await edit.click()
+  await expect(retired.getByText(notes, { exact: true })).toBeVisible()
+  const confirmation = page.getByRole('dialog', { name: 'Remove description?' })
+  await removeButton.click()
+  await confirmation.getByRole('button', { name: 'Keep it', exact: true }).click()
+  await expect(confirmation).toHaveCount(0)
+  await expect(removeButton).toBeFocused()
+  await removeButton.click()
+  await expect(confirmation).toBeVisible()
+  await page.keyboard.press('Escape')
+  await expect(confirmation).toHaveCount(0)
+  await expect(dialog).toBeVisible()
+  await expect(removeButton).toBeFocused()
+
+  await removeButton.click()
+  await confirmation.getByRole('button', { name: 'Remove', exact: true }).click()
+  await expect(confirmation).toHaveCount(0)
+  await expect(dialog.getByRole('button', { name: 'Undo', exact: true })).toBeFocused()
+  await expect(dialog.getByText('1 retired value is removed when you save.', { exact: true })).toBeVisible()
+  await expect(retired).toHaveCount(0)
+  await dialog.getByRole('button', { name: 'Cancel', exact: true }).click()
+  await expect(page.getByRole('dialog')).toHaveCount(0)
+
+  await edit.click()
+  await expect(dialog).toBeVisible()
+  await expect(retired.getByText(notes, { exact: true })).toBeVisible()
+  await expect(removeButton).toBeVisible()
+})
diff --git a/frontend/src/components/Operations/FindingDialog.test.tsx b/frontend/src/components/Operations/FindingDialog.test.tsx
index e4a31bc537..a77920986f 100644
--- a/frontend/src/components/Operations/FindingDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingDialog.test.tsx
@@ -294,7 +294,7 @@ describe('FindingDialog', () => {
 
   it('shows a rejected Other text in the error message bar and keeps the draft', async () => {
     const user = userEvent.setup()
-    const detail = 'Severity \'Critical\' matches the option \'critical\'. Send \'critical\' instead.'
+    const detail = 'Severity \'Critical\' matches the option \'Critical\' (key \'critical\'). Choose that option instead.'
     const onSave = jest.fn().mockRejectedValueOnce({ isAxiosError: true, response: { status: 422, data: { detail } } })
     renderDialog({ onSave })
     await user.type(screen.getByRole('textbox', { name: 'Title' }), 'Typed severity')
diff --git a/frontend/src/components/Operations/FindingFieldInput.test.tsx b/frontend/src/components/Operations/FindingFieldInput.test.tsx
index 80ea60feaa..66641970f2 100644
--- a/frontend/src/components/Operations/FindingFieldInput.test.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.test.tsx
@@ -368,4 +368,22 @@ describe('FindingFieldInput', () => {
     expect(screen.getByRole('combobox', { name: 'Component' })).toBeDisabled()
     expect(screen.getByRole('combobox', { name: 'Capability' })).toBeDisabled()
   })
+
+  it('ignores inherited members for a field keyed constructor and an option keyed toString', async () => {
+    const user = userEvent.setup()
+    const field: FindingField = {
+      ...TECHNIQUE, key: 'constructor', label: 'Constructor', options: [option('toString', 'To string')],
+    }
+    render(<TestWrapper>
+      <FieldHarness field={field} initialValues={{}} onChange={onChange} />
+      <FindingFieldInput field={{ ...OWNER, key: 'constructor' }} values={{}} onChange={onChange} />
+    </TestWrapper>)
+
+    expect(screen.getByRole('combobox', { name: 'Constructor' })).toHaveValue('')
+    expect(screen.queryByRole('textbox', { name: 'Other Constructor' })).not.toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: 'Owner' })).toHaveValue('')
+    await pick(user, 'Constructor', 'To string')
+    expect(onChange).toHaveBeenLastCalledWith({ constructor: 'toString' })
+    expect(screen.getByRole('combobox', { name: 'Constructor' })).toHaveValue('To string')
+  })
 })
diff --git a/frontend/src/components/Operations/FindingFieldInput.tsx b/frontend/src/components/Operations/FindingFieldInput.tsx
index b047763dee..dc9258e9f9 100644
--- a/frontend/src/components/Operations/FindingFieldInput.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.tsx
@@ -2,7 +2,7 @@ import { useState, type JSX } from 'react'
 import { Combobox, Field, Input, Option, Textarea } from '@fluentui/react-components'
 
 import type { FindingField, FindingFieldOption } from '@/types'
-import { choiceLevels, levelOptions } from '@/utils/findingFields'
+import { choiceLevels, levelOptions, ownValue } from '@/utils/findingFields'
 
 import { useFindingFieldInputStyles } from './FindingFieldInput.styles'
 
@@ -50,7 +50,7 @@ interface LevelState {
 }
 
 function storedValue(values: Record<string, string>, key: string): string {
-  const value = values[key] ?? ''
+  const value = ownValue(values, key) ?? ''
   return value.trim() === '' ? '' : value
 }
 
@@ -185,7 +185,7 @@ function ChoiceFieldInput({
         )
       })}
       {otherChosen && <Field label={`${OTHER_TEXT} ${field.label}`} required>
-        <Input value={values[field.key] ?? ''} disabled={disabled} name={field.key} autoComplete="off"
+        <Input value={ownValue(values, field.key) ?? ''} disabled={disabled} name={field.key} autoComplete="off"
           onChange={(_, data) => {
             onOtherBlankChange?.(data.value.trim() === '')
             onChange({ [field.key]: data.value })
@@ -196,7 +196,7 @@ function ChoiceFieldInput({
 }
 
 function TextFieldInput({ field, values, disabled, onChange }: FieldControlProps): JSX.Element {
-  const value = values[field.key] ?? ''
+  const value = ownValue(values, field.key) ?? ''
   const report = (text: string): void => { onChange({ [field.key]: text }) }
   return (
     <Field label={field.label} hint={field.hint ?? undefined} required={field.required}>
diff --git a/frontend/src/components/Operations/OperationDetailPage.test.tsx b/frontend/src/components/Operations/OperationDetailPage.test.tsx
index d7e35e47a0..d5d275ac43 100644
--- a/frontend/src/components/Operations/OperationDetailPage.test.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.test.tsx
@@ -401,7 +401,7 @@ it.each(['Cancel', 'Escape'])('discards edits with %s and restores the edit butt
 
 it('retains an edited draft on update failure and shows why the backend rejected it', async () => {
   const user = userEvent.setup()
-  const detail = 'Severity \'Critical\' matches the option \'critical\'. Send \'critical\' instead.'
+  const detail = 'Severity \'Critical\' matches the option \'Critical\' (key \'critical\'). Choose that option instead.'
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [FINDING] })
   jest.mocked(operationsApi.updateFinding).mockRejectedValue({
     isAxiosError: true, response: { status: 422, data: { detail } },
diff --git a/frontend/src/components/Operations/RetiredFieldValues.test.tsx b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
index 71f3d45ede..3fe6d23480 100644
--- a/frontend/src/components/Operations/RetiredFieldValues.test.tsx
+++ b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
@@ -143,6 +143,31 @@ describe('RetiredFieldValues', () => {
     expect(await screen.findByRole('button', { name: 'Undo' })).toHaveFocus()
   })
 
+  // jsdom fires no focusout when the dialog removes the focused button, so Tabster only restores focus here after
+  // keyboard use. The e2e spec covers a mouse click on Keep it.
+  it('returns focus to the Remove button on Keep it', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={jest.fn()} onUndo={jest.fn()} /></TestWrapper>)
+    const removeButton = screen.getByRole('button', { name: removeButtonName('contoso_ticket') })
+    await user.click(removeButton)
+    const dialog = await findConfirmation('contoso_ticket')
+    expect(within(dialog).getByRole('button', { name: 'Keep it' })).toHaveFocus()
+    await user.keyboard('{Enter}')
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await waitFor(() => expect(removeButton).toHaveFocus())
+  })
+
+  it('returns focus to the Remove button on Escape', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><RetiredFieldValuesHarness onRemove={jest.fn()} onUndo={jest.fn()} /></TestWrapper>)
+    const removeButton = screen.getByRole('button', { name: removeButtonName('contoso_ticket') })
+    await user.click(removeButton)
+    await findConfirmation('contoso_ticket')
+    await user.keyboard('{Escape}')
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await waitFor(() => expect(removeButton).toHaveFocus())
+  })
+
   it('moves focus to the first Remove button after Undo', async () => {
     const user = userEvent.setup()
     render(<TestWrapper><RetiredFieldValuesHarness onRemove={jest.fn()} onUndo={jest.fn()} /></TestWrapper>)
diff --git a/frontend/src/components/Operations/RetiredFieldValues.tsx b/frontend/src/components/Operations/RetiredFieldValues.tsx
index 66403888b4..2eab86b4d7 100644
--- a/frontend/src/components/Operations/RetiredFieldValues.tsx
+++ b/frontend/src/components/Operations/RetiredFieldValues.tsx
@@ -1,6 +1,7 @@
 import { type RefObject, useEffect, useId, useRef, useState, type JSX } from 'react'
 import {
   Button, Dialog, DialogActions, DialogBody, DialogContent, DialogSurface, DialogTitle, Link, Text,
+  useRestoreFocusTarget,
 } from '@fluentui/react-components'
 
 import { useRetiredFieldValuesStyles } from './RetiredFieldValues.styles'
@@ -33,6 +34,9 @@ export default function RetiredFieldValues({
   const headingId = useId()
   // The key stays set while the dialog closes, so its title doesn't lose the key during the exit animation.
   const [confirming, setConfirming] = useState({ key: '', open: false })
+  // The confirmation dialog opens from state rather than a DialogTrigger. Mark each Remove button so Tabster
+  // can return focus to it when the dialog is cancelled.
+  const restoreFocusTarget = useRestoreFocusTarget()
   const undoRef = useRef<HTMLButtonElement>(null)
   const firstRemoveRef = useRef<HTMLButtonElement>(null)
   const focusAfterChange = useRef<RefObject<HTMLButtonElement | null> | null>(null)
@@ -61,8 +65,8 @@ export default function RetiredFieldValues({
                 <code className={styles.key} translate="no">{key}</code>
                 <Text as="p" className={styles.value}>{value}</Text>
               </div>
-              <Button ref={index === 0 ? firstRemoveRef : undefined} size="small" className={styles.button}
-                disabled={disabled} aria-label={`Remove retired value ${key}`}
+              <Button {...restoreFocusTarget} ref={index === 0 ? firstRemoveRef : undefined} size="small"
+                className={styles.button} disabled={disabled} aria-label={`Remove retired value ${key}`}
                 onClick={() => { setConfirming({ key, open: true }) }}>Remove</Button>
             </li>
           ))}
diff --git a/frontend/src/utils/findingFields.test.ts b/frontend/src/utils/findingFields.test.ts
index 7a5cdefcbc..256d076b00 100644
--- a/frontend/src/utils/findingFields.test.ts
+++ b/frontend/src/utils/findingFields.test.ts
@@ -1,5 +1,5 @@
 import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
-import type { FindingField, FindingFieldOption } from '@/types'
+import type { FindingField, FindingFieldOption, FindingFields } from '@/types'
 
 import {
   choiceLevels,
@@ -23,6 +23,15 @@ function optionKeys(options: FindingFieldOption[]): string[] {
   return options.map((option: FindingFieldOption) => option.key)
 }
 
+// Field and level keys such as `constructor` pass the backend's key pattern, and option keys can be any text.
+const PROTOTYPE_KEY_FIELDS: FindingFields = {
+  severity: {
+    ...DEFAULT_FINDING_FIELDS_FIXTURE.severity,
+    options: [...DEFAULT_FINDING_FIELDS_FIXTURE.severity.options, { key: 'toString', label: 'To string', children: [] }],
+  },
+  fields: [{ ...contosoField('category'), key: 'constructor', label: 'Constructor' }],
+}
+
 describe('findingFields', () => {
   it('maps every author color to one Fluent badge color', () => {
     expect(FLUENT_BADGE_COLOR).toEqual({ red: 'danger', orange: 'severe', yellow: 'warning', green: 'success',
@@ -140,4 +149,15 @@ describe('findingFields', () => {
     ])
     expect(severityCountBadges(CONTOSO_FINDING_FIELDS, {})).toEqual([])
   })
+
+  it('ignores inherited members when a key names an Object.prototype member', () => {
+    const constructorField = PROTOTYPE_KEY_FIELDS.fields[0]
+    expect(severityBadge(PROTOTYPE_KEY_FIELDS, 'toString')).toEqual({ label: 'To string', color: 'subtle' })
+    expect(levelOptions(constructorField, {}, 1)).toEqual([])
+    expect(describeFindingValues(PROTOTYPE_KEY_FIELDS, 'toString', {})).toEqual({ rows: [], retired: [] })
+    expect(firstMissingRequired(PROTOTYPE_KEY_FIELDS, 'toString', {})).toBe('Constructor')
+    expect(severityCountBadges(PROTOTYPE_KEY_FIELDS, { low: 1 })).toEqual([
+      { key: 'low', label: 'Low', color: 'informative', count: 1, tooltip: null },
+    ])
+  })
 })
diff --git a/frontend/src/utils/findingFields.ts b/frontend/src/utils/findingFields.ts
index 5b90ef8b61..994882ce21 100644
--- a/frontend/src/utils/findingFields.ts
+++ b/frontend/src/utils/findingFields.ts
@@ -42,6 +42,11 @@ function filled(value: string | undefined): string | null {
   return value !== undefined && value.trim() !== '' ? value : null
 }
 
+/** The value stored under a configured key, ignoring `Object.prototype` members such as `constructor`. */
+export function ownValue<T>(record: Readonly<Record<string, T>>, key: string): T | undefined {
+  return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined
+}
+
 function allFields(fields: FindingFields): FindingField[] {
   return [fields.severity, ...fields.fields]
 }
@@ -50,7 +55,7 @@ function allFields(fields: FindingFields): FindingField[] {
 export function severityBadge(fields: FindingFields, severity: string): { label: string; color: BadgeColor } {
   const match = fields.severity.options.find((option: FindingFieldOption) => option.key === severity)
   if (match === undefined) return { label: severity, color: FLUENT_BADGE_COLOR.neutral }
-  return { label: match.label, color: FLUENT_BADGE_COLOR[fields.severity.colors[severity] ?? 'neutral'] }
+  return { label: match.label, color: FLUENT_BADGE_COLOR[ownValue(fields.severity.colors, severity) ?? 'neutral'] }
 }
 
 /** The field itself, then each of its levels: one entry per dropdown of a choice field. */
@@ -70,7 +75,7 @@ export function choiceLevels(field: FindingField): Array<{ key: string; label: s
 export function levelOptions(field: FindingField, values: Record<string, string>, depth: number): FindingFieldOption[] {
   let options = field.options
   for (const level of choiceLevels(field).slice(0, depth)) {
-    const value = filled(values[level.key])
+    const value = filled(ownValue(values, level.key))
     const match = options.find((option: FindingFieldOption) => option.key === value)
     if (match === undefined) return []
     options = match.children
@@ -108,7 +113,7 @@ export function describeFindingValues(
   for (const field of allFields(fields)) {
     for (const [depth, level] of choiceLevels(field).entries()) {
       if (field === fields.severity && depth === 0) continue
-      const value = filled(fieldValues[level.key])
+      const value = filled(ownValue(fieldValues, level.key))
       if (value === null) continue
       rows.push({
         key: level.key,
@@ -128,7 +133,7 @@ export function describeFindingValues(
 function firstMissingLevel(field: FindingField, values: Record<string, string>): string | null {
   for (const [depth, level] of choiceLevels(field).entries()) {
     if (levelOptions(field, values, depth).length === 0) return null
-    if (filled(values[level.key]) === null) return level.label
+    if (filled(ownValue(values, level.key)) === null) return level.label
   }
   return null
 }
@@ -149,7 +154,7 @@ export function firstMissingRequired(
     if (field.type === 'choice') {
       const missing = firstMissingLevel(field, values)
       if (missing !== null) return missing
-    } else if (filled(values[field.key]) === null) {
+    } else if (filled(ownValue(values, field.key)) === null) {
       return field.label
     }
   }
@@ -160,7 +165,7 @@ export function firstMissingRequired(
 export function severityCountBadges(fields: FindingFields, counts: Record<string, number>): SeverityCountBadge[] {
   const badges: SeverityCountBadge[] = []
   for (const option of fields.severity.options) {
-    const count = counts[option.key] ?? 0
+    const count = ownValue(counts, option.key) ?? 0
     if (count > 0) badges.push({ key: option.key, ...severityBadge(fields, option.key), count, tooltip: null })
   }
   const optionKeys = new Set(fields.severity.options.map((option: FindingFieldOption) => option.key))
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index 1f2e2dbbe1..270765a700 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -593,7 +593,8 @@ def _check_other_text(*, label: str, value: str, options: list[FindingFieldOptio
     for option in options:
         if folded in (option.key.strip().casefold(), option.label.strip().casefold()):
             raise FindingValuesError(
-                f"{label} {value!r} matches the option {option.key!r}. Send {option.key!r} instead."
+                f"{label} {value!r} matches the option {option.label!r} (key {option.key!r}). "
+                "Choose that option instead."
             )
 
 
diff --git a/tests/unit/backend/conftest.py b/tests/unit/backend/conftest.py
index 6d0ce4bde3..73d5d61363 100644
--- a/tests/unit/backend/conftest.py
+++ b/tests/unit/backend/conftest.py
@@ -18,9 +18,18 @@
 from pyrit.backend.services.manual_send_scheduler import get_manual_send_scheduler
 from pyrit.backend.services.message_send_service import get_message_send_service
 from pyrit.memory import SQLiteMemory
+from pyrit.models import Finding, FindingField, FindingFields, Operation
+from pyrit.setup.finding_fields import set_active_finding_fields
 from test_support.fixtures import authentication_policy, compatibility_headers, compatibility_id  # noqa: F401
 from unit.async_utils import TEST_WATCHDOG_SECONDS
 
+_CONTOSO_FIELDS = FindingFields(
+    severity=FindingField(
+        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
+    ),
+    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
+)
+
 
 @pytest.fixture
 async def analytics_service(sqlite_instance: SQLiteMemory) -> AsyncGenerator[AttackResultAnalytics, None]:
@@ -57,3 +66,30 @@ def isolated_manual_message_services() -> Iterator[None]:
     yield
     for factory in (get_attack_service, get_message_send_service, get_manual_send_scheduler, get_dataset_service):
         factory.cache_clear()
+
+
+@pytest.fixture
+async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
+    """Seed a finding with ``steps`` and ``description`` values, then make fields without ``description`` active."""
+    return await _seed_contoso_finding_async(
+        sqlite_instance=sqlite_instance, severity="sev1", field_values={"steps": "1. Open", "description": "Old text"}
+    )
+
+
+@pytest.fixture
+async def unmatched_severity_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
+    """Seed a finding with severity ``low``, then make fields without a ``low`` severity option active."""
+    return await _seed_contoso_finding_async(
+        sqlite_instance=sqlite_instance, severity="low", field_values={"steps": "1. Open"}
+    )
+
+
+async def _seed_contoso_finding_async(
+    *, sqlite_instance: SQLiteMemory, severity: str, field_values: dict[str, str]
+) -> Finding:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
+    finding = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=operation.id, title="Leak", severity=severity, field_values=field_values)
+    )
+    set_active_finding_fields(finding_fields=_CONTOSO_FIELDS, source="test")
+    return finding
diff --git a/tests/unit/backend/test_operation_service_findings.py b/tests/unit/backend/test_operation_service_findings.py
index e33339af51..f245e651d6 100644
--- a/tests/unit/backend/test_operation_service_findings.py
+++ b/tests/unit/backend/test_operation_service_findings.py
@@ -8,36 +8,20 @@
 from pyrit.backend.models.operations import FindingUpdateRequest
 from pyrit.backend.services.operation_service import OperationService
 from pyrit.memory import SQLiteMemory
-from pyrit.models import Finding, FindingField, FindingFields, FindingValuesError, Operation
-from pyrit.setup.finding_fields import set_active_finding_fields
+from pyrit.models import Finding, FindingValuesError
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
-CONTOSO = FindingFields(
-    severity=FindingField(
-        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
-    ),
-    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
-)
-STORED_VALUES = {"steps": "1. Open", "description": "Old text"}
-
-
-@pytest.fixture
-async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
-    """Seed a finding with a ``description`` value, then make CONTOSO, which has no such field, active."""
-    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
-    finding = await sqlite_instance.add_finding_async(
-        finding=Finding(operation_id=operation.id, title="Leak", severity="sev1", field_values=STORED_VALUES)
-    )
-    set_active_finding_fields(finding_fields=CONTOSO, source="test")
-    return finding
-
 
 async def _update_async(
-    *, finding: Finding, field_values: dict[str, str], remove_retired_keys: list[str] | None = None
+    *,
+    finding: Finding,
+    field_values: dict[str, str],
+    remove_retired_keys: list[str] | None = None,
+    severity: str = "sev1",
 ) -> Finding:
     request = FindingUpdateRequest(
-        title="Leak", severity="sev1", field_values=field_values, remove_retired_keys=remove_retired_keys or []
+        title="Leak", severity=severity, field_values=field_values, remove_retired_keys=remove_retired_keys or []
     )
     return await OperationService().update_finding_async(
         operation_id=finding.operation_id, finding_id=finding.id, request=request
@@ -55,8 +39,8 @@ async def test_update_keeps_an_omitted_retired_value(
 ) -> None:
     finding = retired_value_finding_async
     updated = await _update_async(finding=finding, field_values={"steps": "1. Open"})
-    assert updated.field_values == STORED_VALUES
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+    assert updated.field_values == finding.field_values
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
 
 
 async def test_update_keeps_a_blank_retired_value(
@@ -64,7 +48,7 @@ async def test_update_keeps_a_blank_retired_value(
 ) -> None:
     finding = retired_value_finding_async
     await _update_async(finding=finding, field_values={"steps": "1. Open", "description": " "})
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
 
 
 async def test_update_removes_a_listed_retired_value(
@@ -85,7 +69,7 @@ async def test_update_rejects_removing_a_value_that_is_not_retired(
     finding = retired_value_finding_async
     with pytest.raises(FindingValuesError, match=re.escape(f"{key!r} is not a retired value of this finding.")):
         await _update_async(finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=[key])
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
 
 
 async def test_update_rejects_sending_and_removing_a_value(
@@ -93,8 +77,8 @@ async def test_update_rejects_sending_and_removing_a_value(
 ) -> None:
     finding = retired_value_finding_async
     with pytest.raises(FindingValuesError, match=re.escape("'description' can't be both sent and removed.")):
-        await _update_async(finding=finding, field_values=STORED_VALUES, remove_retired_keys=["description"])
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+        await _update_async(finding=finding, field_values=finding.field_values, remove_retired_keys=["description"])
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
 
 
 async def test_update_rejects_changing_a_retired_value(
@@ -104,4 +88,26 @@ async def test_update_rejects_changing_a_retired_value(
     message = "Finding field 'description' is no longer configured, so its saved value can't change."
     with pytest.raises(FindingValuesError, match=re.escape(message)):
         await _update_async(finding=finding, field_values={"steps": "1. Open", "description": "New text"})
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == STORED_VALUES
+    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+
+
+async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option(
+    sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding
+) -> None:
+    finding = unmatched_severity_finding_async
+    updated = await _update_async(finding=finding, severity="low", field_values={"steps": "1. Open"})
+    assert updated.severity == "low"
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.severity == "low"
+
+
+async def test_update_rejects_changing_to_another_severity_that_is_not_an_option(
+    sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding
+) -> None:
+    finding = unmatched_severity_finding_async
+    with pytest.raises(FindingValuesError, match=re.escape("Severity has no option 'medium'.")):
+        await _update_async(finding=finding, severity="medium", field_values={"steps": "1. Open"})
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.severity == "low"
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index 668a40b5e9..f53a3d1a6a 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -223,7 +223,9 @@ def test_finding_create_rejects_other_text_that_matches_an_option(compatibility_
     path = f"/api/operations/{operation_id}/findings"
     rejected = client.post(path, json={"title": "Leak", "severity": "Critical"})
     assert rejected.status_code == 422
-    assert rejected.json()["detail"] == "Severity 'Critical' matches the option 'critical'. Send 'critical' instead."
+    assert rejected.json()["detail"] == (
+        "Severity 'Critical' matches the option 'Critical' (key 'critical'). Choose that option instead."
+    )
     assert client.get(path).json()["items"] == []
 
 
@@ -411,22 +413,6 @@ def test_finding_mutations_reject_wrong_operations_and_invalid_fields(
     assert client.get(path).json()["items"] == [{**original, "evidence_count": 0}]
 
 
-@pytest.fixture
-async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
-    """Seed a finding with a ``description`` value, then make CONTOSO, which has no such field, active."""
-    operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
-    finding = await sqlite_instance.add_finding_async(
-        finding=Finding(
-            operation_id=operation.id,
-            title="Leak",
-            severity="sev1",
-            field_values={"steps": "1. Open", "description": "Old text"},
-        )
-    )
-    set_active_finding_fields(finding_fields=CONTOSO, source="test")
-    return finding
-
-
 async def test_update_keeps_an_unchanged_retired_value_async(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
 ) -> None:
@@ -493,6 +479,36 @@ async def test_update_removes_a_listed_retired_value_async(
     assert stored.field_values == {"steps": "1. Open"}
 
 
+async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option_async(
+    sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = unmatched_severity_finding_async
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={"title": "Leak", "severity": "low", "field_values": {"steps": "1. Open"}},
+    )
+    assert response.status_code == 200
+    assert response.json()["severity"] == "low"
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.severity == "low"
+
+
+async def test_update_rejects_changing_to_another_severity_that_is_not_an_option_async(
+    sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = unmatched_severity_finding_async
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={"title": "Leak", "severity": "medium", "field_values": {"steps": "1. Open"}},
+    )
+    assert response.status_code == 422
+    assert response.json()["detail"] == "Severity has no option 'medium'."
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.severity == "low"
+
+
 @pytest.fixture
 async def evidence_source_async(sqlite_instance: SQLiteMemory) -> tuple[Operation, Finding, AttackResult]:
     return await _store_evidence_source_async(sqlite_instance)
diff --git a/tests/unit/memory/test_finding_field_values_migration.py b/tests/unit/memory/test_finding_field_values_migration.py
index 6d5433ab9a..3714671932 100644
--- a/tests/unit/memory/test_finding_field_values_migration.py
+++ b/tests/unit/memory/test_finding_field_values_migration.py
@@ -123,6 +123,25 @@ def test_upgrade_moves_existing_findings_into_field_values() -> None:
         engine.dispose()
 
 
+def test_upgrade_moves_an_other_severity_stored_in_any_case() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config_for(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            _insert_operation(connection)
+            # SQL Server's default case-insensitive collation let the old checks accept 'Other'.
+            connection.execute(sa.text("PRAGMA ignore_check_constraints = ON"))
+            _insert_finding(connection=connection, id=A, severity="Other", severity_other="Sev 2.5", description="")
+            connection.execute(sa.text("PRAGMA ignore_check_constraints = OFF"))
+
+            command.upgrade(config, REVISION)
+
+            assert connection.execute(sa.text("SELECT severity FROM FindingEntries")).scalar_one() == "Sev 2.5"
+    finally:
+        engine.dispose()
+
+
 def test_upgrade_drops_the_finding_check_constraints() -> None:
     engine = sa.create_engine("sqlite:///:memory:")
     try:
@@ -179,6 +198,7 @@ def test_upgrade_compiles_for_sql_server() -> None:
     drops = [match.start() for match in re.finditer("DROP CONSTRAINT", ddl)]
     assert len(drops) == 3 and max(drops) < ddl.index("ALTER COLUMN severity")
     assert "COLLATE Latin1_General_100_BIN2" in ddl
+    assert "WHERE LOWER(severity) = 'other'" in ddl
     assert "JSON_MODIFY" in ddl
     for column in ("description", "severity_other", "harm_type", "harm_type_other"):
         assert f"DROP COLUMN {column}" in ddl
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index 5301474f00..8ff49e9ac8 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -383,22 +383,25 @@ def test_check_values_rejects(
         pytest.param(
             "Critical",
             {},
-            "Severity 'Critical' matches the option 'critical'. Send 'critical' instead.",
+            "Severity 'Critical' matches the option 'Critical' (key 'critical'). Choose that option instead.",
             id="severity label",
         ),
         pytest.param(
             "CRITICAL",
             {},
-            "Severity 'CRITICAL' matches the option 'critical'. Send 'critical' instead.",
+            "Severity 'CRITICAL' matches the option 'Critical' (key 'critical'). Choose that option instead.",
             id="severity key in capitals",
         ),
         pytest.param(
-            "low ", {}, "Severity 'low ' matches the option 'low'. Send 'low' instead.", id="severity key with a space"
+            "low ",
+            {},
+            "Severity 'low ' matches the option 'Low' (key 'low'). Choose that option instead.",
+            id="severity key with a space",
         ),
         pytest.param(
             "low",
             {"harm_type": "malware"},
-            "Harm-type 'malware' matches the option 'Malware'. Send 'Malware' instead.",
+            "Harm-type 'malware' matches the option 'Malware' (key 'Malware'). Choose that option instead.",
             id="harm type key in lowercase",
         ),
     ],

From 8c16afd79d5ae091272c5f2998ff08b9b73186fa Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 14:20:58 -0400
Subject: [PATCH 12/20] Keep retired values when CoPyRIT's fields are stale

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 doc/code/setup/finding_fields.md              |  4 +--
 .../Operations/FindingDialog.test.tsx         | 28 +++++++++++++++++--
 .../components/Operations/FindingDialog.tsx   | 27 +++++++++++++-----
 .../Operations/OperationDetailPage.test.tsx   |  4 +--
 frontend/src/hooks/useFindingFields.test.tsx  | 25 +++++++++++++++++
 frontend/src/hooks/useFindingFields.ts        | 10 +++++--
 pyrit/backend/models/operations.py            |  5 ++--
 pyrit/memory/memory_interface.py              |  2 +-
 pyrit/models/__init__.py                      |  4 +++
 pyrit/models/finding.py                       |  6 ++--
 tests/unit/backend/test_operations.py         | 22 ++++++++++++++-
 11 files changed, 115 insertions(+), 22 deletions(-)

diff --git a/doc/code/setup/finding_fields.md b/doc/code/setup/finding_fields.md
index b747f09c19..43032a2365 100644
--- a/doc/code/setup/finding_fields.md
+++ b/doc/code/setup/finding_fields.md
@@ -15,7 +15,7 @@ Without any configuration, findings use these fields:
 To use other fields, subclass `FindingsInitializer` and return a `FindingFields` from `get_finding_fields`. The `severity` slot is always a required choice field. The fields in `fields` follow it in the dialog.
 
 ```python
-from pyrit.models.finding_fields import FindingField, FindingFields, FindingFieldType, FindingSeverityColor
+from pyrit.models import FindingField, FindingFields, FindingFieldType, FindingSeverityColor
 from pyrit.setup.initializers import FindingsInitializer
 
 
@@ -74,7 +74,7 @@ With `allow_custom_initializers: true`, the backend runs every script in that so
 
 ## Rules
 
-- Use one `FindingsInitializer` per deployment. If the configuration lists two, or the fields are invalid, the backend doesn't start. A live apply reports invalid configuration instead, and the running fields don't change.
+- Use one `FindingsInitializer` per deployment. If the configuration lists two, or the fields are invalid, setup fails when the backend starts. The backend still runs, but it blocks runtime operations, including findings, until a process restart. Configuration repair stays available. A live apply reports invalid configuration instead, and the running fields don't change.
 - Change a field's `label` to rename what people see.
 - A changed `key` makes a new field. Values saved under the old key show under **Retired fields**, where they are read-only. Edits keep them. **Remove** deletes one when you save.
 - Other text that matches an option's key or label is rejected, ignoring case and surrounding spaces. The message names the option to choose instead.
diff --git a/frontend/src/components/Operations/FindingDialog.test.tsx b/frontend/src/components/Operations/FindingDialog.test.tsx
index a77920986f..f42794e51e 100644
--- a/frontend/src/components/Operations/FindingDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingDialog.test.tsx
@@ -199,7 +199,7 @@ describe('FindingDialog', () => {
     }, ATTEMPT))
   })
 
-  it('edits don\'t resend retired values', async () => {
+  it('edits resend kept retired values unchanged', async () => {
     const user = userEvent.setup()
     const onSave = jest.fn().mockResolvedValue(undefined)
     renderDialog({ fields: CONTOSO_FINDING_FIELDS, editing: true, initialValues: CONTOSO_EDIT, onSave })
@@ -213,7 +213,29 @@ describe('FindingDialog', () => {
 
     await user.click(saveButton())
     await waitFor(() => expect(onSave).toHaveBeenCalledWith({
-      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES, removeRetiredKeys: [],
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, removeRetiredKeys: [],
+    }, ATTEMPT))
+  })
+
+  it('keeps the fields it opened with when the page reloads them, and resends a returned value unchanged', async () => {
+    const user = userEvent.setup()
+    const onSave = jest.fn().mockResolvedValue(undefined)
+    const props = { editing: true, initialValues: CONTOSO_EDIT, onSave, onClose: jest.fn() }
+    // A live apply brought `description` back after the dialog opened, and the page reloaded its fields.
+    const reloaded: FindingFields = {
+      ...CONTOSO_FINDING_FIELDS, fields: [...CONTOSO_FINDING_FIELDS.fields, DEFAULT_FINDING_FIELDS_FIXTURE.fields[1]],
+    }
+    const { rerender } = render(<TestWrapper><FindingDialog fields={CONTOSO_FINDING_FIELDS} {...props} /></TestWrapper>)
+    rerender(<TestWrapper><FindingDialog fields={reloaded} {...props} /></TestWrapper>)
+
+    const retired = screen.getByRole('group', { name: 'Retired fields · read-only' })
+    expect(within(retired).getByText('description')).toBeInTheDocument()
+    expect(within(retired).getByText('Recorded before Contoso configured its own fields.')).toBeInTheDocument()
+    expect(screen.queryByRole('textbox', { name: 'Description' })).not.toBeInTheDocument()
+
+    await user.click(saveButton())
+    await waitFor(() => expect(onSave).toHaveBeenCalledWith({
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, removeRetiredKeys: [],
     }, ATTEMPT))
   })
 
@@ -241,6 +263,8 @@ describe('FindingDialog', () => {
       title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES,
       removeRetiredKeys: ['description'],
     }, ATTEMPT))
+    // The backend rejects a key that is both sent and listed for removal.
+    expect((onSave.mock.calls[0] as [FindingDraft])[0].field_values).not.toHaveProperty('description')
   })
 
   it('moves focus to Undo after a removal, and Escape closes only the confirmation', async () => {
diff --git a/frontend/src/components/Operations/FindingDialog.tsx b/frontend/src/components/Operations/FindingDialog.tsx
index 1d234b733f..7a08c429c2 100644
--- a/frontend/src/components/Operations/FindingDialog.tsx
+++ b/frontend/src/components/Operations/FindingDialog.tsx
@@ -24,12 +24,13 @@ export interface FindingSaveAttempt {
   attackResultId: string
 }
 
-/** The finding Save sends. Only an edit lists the retired values to delete. */
+/** The finding Save sends. An edit also resends its kept retired values unchanged, and lists the keys to delete. */
 export interface FindingDraft extends FindingCreate {
   removeRetiredKeys?: string[]
 }
 
 interface FindingDialogProps {
+  /** Read once, when the dialog opens. A reload while it's open doesn't change its inputs or retired values. */
   fields: FindingFields
   initialValues?: FindingCreate
   editing?: boolean
@@ -73,6 +74,12 @@ function filledFinding(draft: FindingCreate): FindingCreate {
   return { title: draft.title, severity: draft.severity, field_values: Object.fromEntries(filled) }
 }
 
+/** The retired values an edit keeps and resends unchanged: all but the removed ones, whose keys it never sends. */
+function keptValues(retired: RetiredValue[], removed: ReadonlySet<string>): Record<string, string> {
+  const kept = retired.filter(({ key }: RetiredValue) => !removed.has(key))
+  return Object.fromEntries(kept.map(({ key, value }: RetiredValue) => [key, value]))
+}
+
 function sameFinding(left: FindingCreate, right: FindingCreate): boolean {
   const leftValues = Object.entries(filledFinding(left).field_values)
   const rightValues = filledFinding(right).field_values
@@ -91,7 +98,8 @@ export default function FindingDialog({
   fields, initialValues, editing = false, context, evidenceField = false, saveDisabled = false, onSave, onClose,
 }: FindingDialogProps) {
   const styles = useFindingDialogStyles()
-  const [opening] = useState(() => openingState(fields, initialValues))
+  const [openFields] = useState(fields)
+  const [opening] = useState(() => openingState(openFields, initialValues))
   const [draft, setDraft] = useState<FindingCreate>(opening.draft)
   const [removed, setRemoved] = useState<ReadonlySet<string>>(NO_KEYS)
   // Whether each field shows Other with blank text, which leaves its value '' just like Not set.
@@ -101,10 +109,10 @@ export default function FindingDialog({
   const [saving, setSaving] = useState(false)
   const submitting = useRef(false)
   const attempt = useRef<{ signature: string; id: string } | null>(null)
-  const slots = [fields.severity, ...fields.fields]
+  const slots = [openFields.severity, ...openFields.fields]
   const values = { ...draft.field_values, [SEVERITY_KEY]: draft.severity }
   const canSave = !saveDisabled && Boolean(draft.title.trim())
-    && firstMissingRequired(fields, draft.severity, draft.field_values) === null
+    && firstMissingRequired(openFields, draft.severity, draft.field_values) === null
     && !Object.values(blankOther).some(Boolean)
   const changed = !sameFinding(draft, opening.draft) || removed.size > 0 || attackResultId !== ''
 
@@ -128,10 +136,15 @@ export default function FindingDialog({
     setSaving(true)
     setError('')
     const trimmedAttackResultId = attackResultId.trim()
-    // The backend keeps retired values on its own, so an edit sends only the keys to delete.
+    // The server clears a current field left out, and its fields may differ from those this dialog opened with.
+    const filled = filledFinding(draft)
     const finding: FindingDraft = editing
-      ? { ...filledFinding(draft), removeRetiredKeys: [...removed] }
-      : filledFinding(draft)
+      ? {
+        ...filled,
+        field_values: { ...keptValues(opening.retired, removed), ...filled.field_values },
+        removeRetiredKeys: [...removed],
+      }
+      : filled
     const signature = JSON.stringify([finding, trimmedAttackResultId])
     if (attempt.current?.signature !== signature) attempt.current = { signature, id: generateClientId() }
     try {
diff --git a/frontend/src/components/Operations/OperationDetailPage.test.tsx b/frontend/src/components/Operations/OperationDetailPage.test.tsx
index d5d275ac43..7eb48578b1 100644
--- a/frontend/src/components/Operations/OperationDetailPage.test.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.test.tsx
@@ -459,7 +459,7 @@ it('shows configured rows and retired values on a finding card', async () => {
   expect(within(screen.getByRole('dialog')).getByRole('combobox', { name: 'Technique' })).toHaveValue('Other')
 })
 
-it('sends the retired values removed in the edit dialog, and none for a new finding', async () => {
+it('resends the kept retired values and lists the removed ones, and sends none for a new finding', async () => {
   const user = userEvent.setup()
   const legacy: FindingListItem = {
     ...FINDING, field_values: { harm_type: 'Malware', contoso_ticket: 'CONTOSO-42', retired_owner: 'Contoso' },
@@ -473,7 +473,7 @@ it('sends the retired values removed in the edit dialog, and none for a new find
   await user.click(within(confirmation).getByRole('button', { name: 'Remove' }))
   await user.click(await screen.findByRole('button', { name: 'Save finding' }))
   await waitFor(() => expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
-    title: FINDING.title, severity: 'informational', field_values: { harm_type: 'Malware' },
+    title: FINDING.title, severity: 'informational', field_values: { harm_type: 'Malware', retired_owner: 'Contoso' },
     remove_retired_keys: ['contoso_ticket'],
   }))
 
diff --git a/frontend/src/hooks/useFindingFields.test.tsx b/frontend/src/hooks/useFindingFields.test.tsx
index 8fdb9df744..46889b7f89 100644
--- a/frontend/src/hooks/useFindingFields.test.tsx
+++ b/frontend/src/hooks/useFindingFields.test.tsx
@@ -8,13 +8,18 @@ import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-u
 import type { FindingFields } from '@/types'
 
 import { useFindingFields } from './useFindingFields'
+import { useRuntime } from './useRuntime'
 
 jest.mock('@/services/api', () => ({ operationsApi: { getFindingFields: jest.fn() } }))
+jest.mock('./useRuntime', () => ({ useRuntime: jest.fn() }))
 const mockGetFindingFields = jest.mocked(operationsApi.getFindingFields)
+const mockRuntime = jest.mocked(useRuntime)
 
 describe('useFindingFields', () => {
   beforeEach(() => {
     jest.clearAllMocks()
+    mockGetFindingFields.mockReset()
+    mockRuntime.mockReturnValue({ ready: true, state: 'ready', generation: 'one' })
   })
 
   it('loads the finding fields once', async () => {
@@ -29,6 +34,23 @@ describe('useFindingFields', () => {
     expect(mockGetFindingFields).toHaveBeenCalledTimes(1)
   })
 
+  it('loads the fields again when the runtime generation changes, keeping the last ones meanwhile', async () => {
+    const reloaded = deferred<FindingFields>()
+    mockGetFindingFields.mockResolvedValueOnce(DEFAULT_FINDING_FIELDS_FIXTURE).mockReturnValueOnce(reloaded.promise)
+
+    const { result, rerender } = renderHook(() => useFindingFields())
+    await waitFor(() => expect(result.current.fields).toBe(DEFAULT_FINDING_FIELDS_FIXTURE))
+
+    mockRuntime.mockReturnValue({ ready: true, state: 'ready', generation: 'two' })
+    rerender()
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(2)
+    expect(result.current.fields).toBe(DEFAULT_FINDING_FIELDS_FIXTURE)
+
+    await act(async () => { reloaded.resolve(CONTOSO_FINDING_FIELDS) })
+    expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS)
+    expect(result.current.error).toBe('')
+  })
+
   it('reports a load failure and retries', async () => {
     mockGetFindingFields
       .mockRejectedValueOnce(new Error('The Contoso backend is unavailable.'))
@@ -73,6 +95,9 @@ describe('useFindingFields', () => {
     rerender({ enabled: true })
     await waitFor(() => expect(result.current.error).toBe('The Contoso backend is unavailable.'))
     rerender({ enabled: false })
+    mockRuntime.mockReturnValue({ ready: true, state: 'ready', generation: 'two' })
+    rerender({ enabled: false })
+    expect(mockGetFindingFields).toHaveBeenCalledTimes(1)
     rerender({ enabled: true })
     await waitFor(() => expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS))
     expect(result.current.error).toBe('')
diff --git a/frontend/src/hooks/useFindingFields.ts b/frontend/src/hooks/useFindingFields.ts
index 2846540063..0fe46eaf69 100644
--- a/frontend/src/hooks/useFindingFields.ts
+++ b/frontend/src/hooks/useFindingFields.ts
@@ -4,8 +4,10 @@ import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
 import type { FindingFields } from '@/types'
 
+import { useRuntime } from './useRuntime'
+
 interface FindingFieldsState {
-  /** Null until the fields load. */
+  /** Null until the fields first load. A reload keeps the last fields until the new ones arrive. */
   readonly fields: FindingFields | null
   /** The last load failure, or an empty string. */
   readonly error: string
@@ -13,10 +15,12 @@ interface FindingFieldsState {
 }
 
 /**
- * Loads the active finding fields, for the finding dialog, cards and counts.
+ * Loads the active finding fields, for the finding dialog, cards and counts, and again when the runtime
+ * generation changes, because a live apply can change them.
  * @param enabled - Loads only while true, and again each time it turns true, so a closed dialog fetches nothing.
  */
 export function useFindingFields(enabled = true): FindingFieldsState {
+  const { generation } = useRuntime()
   const [fields, setFields] = useState<FindingFields | null>(null)
   const [error, setError] = useState('')
   const [attempt, setAttempt] = useState(0)
@@ -37,7 +41,7 @@ export function useFindingFields(enabled = true): FindingFieldsState {
     return () => {
       ignore = true
     }
-  }, [attempt, enabled])
+  }, [attempt, enabled, generation])
 
   const retry = useCallback(() => {
     setError('')
diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 65f42ba27f..5c6db559b4 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -63,7 +63,8 @@ class FindingCreateRequest(FindingCreate):
     """
     A finding to record, optionally with one saved attack result as evidence.
 
-    Sending the same ``id`` and content again returns the saved finding, so a client can retry safely.
+    Sending the same ``id`` and content again returns the saved finding, as long as it still fits the active finding
+    fields, so a client can retry safely.
     """
 
     id: UUID | None = None
@@ -74,7 +75,7 @@ class FindingUpdateRequest(FindingCreate):
     """A finding's new editable values, and any retired values to remove."""
 
     remove_retired_keys: list[str] = Field(
-        default_factory=list, description="Retired values to delete from the finding"
+        default_factory=list, description="Keys of the retired values to delete from the finding"
     )
 
 
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index b1354e7f71..d0d934d34d 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -1081,7 +1081,7 @@ async def get_findings_by_ids_async(
         self, *, operation_id: uuid.UUID, finding_ids: Sequence[uuid.UUID], severity_order: Sequence[str] = ()
     ) -> list[Finding]:
         """
-        Read selected findings of one operation, highest severity first, then newest first.
+        Read selected findings of one operation in ``severity_order``, then newest first.
 
         IDs that are not in the operation are omitted.
 
diff --git a/pyrit/models/__init__.py b/pyrit/models/__init__.py
index 8aca6abb6b..019cb6acb0 100644
--- a/pyrit/models/__init__.py
+++ b/pyrit/models/__init__.py
@@ -78,6 +78,8 @@
         DEFAULT_FINDING_FIELDS,
         FindingField,
         FindingFields,
+        FindingFieldType,
+        FindingSeverityColor,
         FindingValuesError,
     )
     from pyrit.models.harm_definition import HarmDefinition, ScaleDescription, get_all_harm_definitions
@@ -452,6 +454,8 @@
     "DEFAULT_FINDING_FIELDS": "pyrit.models.finding_fields",
     "FindingField": "pyrit.models.finding_fields",
     "FindingFields": "pyrit.models.finding_fields",
+    "FindingFieldType": "pyrit.models.finding_fields",
+    "FindingSeverityColor": "pyrit.models.finding_fields",
     "FindingValuesError": "pyrit.models.finding_fields",
     "ConversationType": "pyrit.models.messages.conversation_reference",
     "ContentEntryScorable": "pyrit.models.score",
diff --git a/pyrit/models/finding.py b/pyrit/models/finding.py
index 0fa2a9c2d8..335e8f2154 100644
--- a/pyrit/models/finding.py
+++ b/pyrit/models/finding.py
@@ -13,8 +13,10 @@ class FindingCreate(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
     title: str
-    severity: str
-    field_values: dict[str, str] = {}
+    severity: str = Field(description="The key of a severity option, or Other text")
+    field_values: dict[str, str] = Field(
+        {}, description="Values by field or level key, each an option's key or text; blank values are dropped"
+    )
 
     @field_validator("title", "severity")
     @classmethod
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index f53a3d1a6a..ccdc35e79c 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -33,7 +33,7 @@
     Operation,
     Score,
 )
-from pyrit.setup.finding_fields import set_active_finding_fields
+from pyrit.setup.finding_fields import reset_active_finding_fields, set_active_finding_fields
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
@@ -479,6 +479,26 @@ async def test_update_removes_a_listed_retired_value_async(
     assert stored.field_values == {"steps": "1. Open"}
 
 
+async def test_update_keeps_a_current_value_that_a_stale_client_resends_async(
+    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+) -> None:
+    finding = retired_value_finding_async
+    # A live apply makes ``description`` current again, while the client still shows it as retired.
+    reset_active_finding_fields()
+    description = FindingField(key="description", label="Description", type="multiline")
+    set_active_finding_fields(
+        finding_fields=FindingFields(severity=CONTOSO.severity, fields=[*CONTOSO.fields, description]), source="test"
+    )
+    response = TestClient(app, headers=compatibility_headers).put(
+        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
+        json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "Old text"}},
+    )
+    assert response.status_code == 200
+    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
+
+
 async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option_async(
     sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding, compatibility_headers: dict[str, str]
 ) -> None:

From 46ac4868fb199873b6f6060f961c32f20a6c5e4c Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 14:21:10 -0400
Subject: [PATCH 13/20] Simplify finding field code and share test setup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Chat/FindingEvidenceDialog.test.tsx       |   8 +-
 .../Operations/FindingCardValues.tsx          |   5 +-
 .../Operations/FindingDialog.test.tsx         |  28 +--
 .../components/Operations/FindingDialog.tsx   |  21 +--
 .../Operations/FindingExportDialog.tsx        |   5 +-
 .../Operations/FindingFieldInput.test.tsx     |  22 +--
 .../Operations/FindingFieldInput.tsx          |  36 ++--
 .../Operations/FindingSeverityBadge.tsx       |   1 -
 .../Operations/OperationDetailPage.test.tsx   |  12 +-
 .../Operations/OperationDetailPage.tsx        |   7 +-
 .../components/Operations/OperationsPage.tsx  |   1 -
 .../Operations/RetiredFieldValues.test.tsx    |   2 +-
 frontend/src/hooks/useFindingFields.ts        |   4 +-
 frontend/src/test-utils/findingDialog.ts      |  16 ++
 .../src/test-utils/findingFieldsFixtures.ts   |   8 +-
 frontend/src/utils/findingFields.test.ts      |  12 +-
 frontend/src/utils/findingFields.ts           |  50 ++++--
 pyrit/backend/services/operation_service.py   |   3 +-
 pyrit/models/finding_fields.py                | 162 ++++--------------
 pyrit/setup/initializers/findings.py          |   2 -
 tests/unit/backend/conftest.py                |  34 ++--
 tests/unit/backend/mocks.py                   |  11 +-
 .../test_operation_service_findings.py        |  27 +--
 tests/unit/backend/test_operations.py         | 104 +++--------
 tests/unit/memory/test_findings.py            |  27 ---
 tests/unit/models/test_finding_fields.py      |  13 +-
 tests/unit/setup/conftest.py                  |  14 ++
 tests/unit/setup/test_finding_fields.py       |  24 ++-
 tests/unit/setup/test_findings_initializer.py |  38 ++--
 tests/unit/setup/test_initialization.py       |  37 ++--
 tests/unit/setup/test_reinitialization.py     |  88 ++++------
 31 files changed, 297 insertions(+), 525 deletions(-)
 create mode 100644 frontend/src/test-utils/findingDialog.ts
 create mode 100644 tests/unit/setup/conftest.py

diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
index 945b441070..804d89ab04 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
@@ -5,6 +5,7 @@ import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter } from 'react-router'
 
 import { attacksApi, operationsApi } from '@/services/api'
+import { pick } from '@/test-utils/findingDialog'
 import { DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { FindingListItem } from '@/types'
 import FindingEvidenceDialog from './FindingEvidenceDialog'
@@ -193,11 +194,6 @@ async function openCreation(user: ReturnType<typeof userEvent.setup>): Promise<v
   await screen.findByRole('heading', { name: 'New finding' })
 }
 
-async function pick(user: ReturnType<typeof userEvent.setup>, label: string, optionName: string): Promise<void> {
-  await user.click(screen.getByRole('combobox', { name: label }))
-  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
-}
-
 it('creates the finding with the viewed attack as evidence in one request and closes both dialogs', async () => {
   const user = userEvent.setup()
   renderDialog()
@@ -221,7 +217,7 @@ it('creates the finding with the viewed attack as evidence in one request and cl
   await waitFor(() => { expect(screen.getByRole('button', { name: 'Link to finding' })).toHaveFocus() })
 })
 
-it('creates and attaches custom classifications from the same shared form and shows them in the picker', async () => {
+it('shows a custom severity but not the harm type in the picker, and creates and attaches custom classifications', async () => {
   const user = userEvent.setup()
   jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [{
     ...FINDING, severity: 'Team severity', field_values: { harm_type: 'Team harm' },
diff --git a/frontend/src/components/Operations/FindingCardValues.tsx b/frontend/src/components/Operations/FindingCardValues.tsx
index 73a4905ad2..357e443490 100644
--- a/frontend/src/components/Operations/FindingCardValues.tsx
+++ b/frontend/src/components/Operations/FindingCardValues.tsx
@@ -11,10 +11,7 @@ interface FindingCardValuesProps {
   finding: Pick<FindingListItem, 'severity' | 'field_values'>
 }
 
-/**
- * A finding card's filled values in configured order: a single-line value as one `Label: value` line, and a
- * multi-line value under its label. Values of fields that are no longer configured follow under their raw keys.
- */
+/** A finding card's filled values, then the values of fields that are no longer configured under their raw keys. */
 export default function FindingCardValues({ fields, finding }: FindingCardValuesProps) {
   const styles = useOperationsStyles()
   const retiredHeadingId = useId()
diff --git a/frontend/src/components/Operations/FindingDialog.test.tsx b/frontend/src/components/Operations/FindingDialog.test.tsx
index f42794e51e..c5c8cc4046 100644
--- a/frontend/src/components/Operations/FindingDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingDialog.test.tsx
@@ -4,6 +4,7 @@ import userEvent, { type UserEvent } from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 
 import { deferred } from '@/test-utils/deferred'
+import { findRemovalConfirmation, pick } from '@/test-utils/findingDialog'
 import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { FindingCreate, FindingFields } from '@/types'
 
@@ -60,23 +61,10 @@ function EditHarness({ onSave }: { onSave: (draft: FindingDraft) => Promise<void
   </>
 }
 
-async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
-  await user.click(screen.getByRole('combobox', { name: label }))
-  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
-}
-
 function saveButton(): HTMLElement {
   return screen.getByRole('button', { name: 'Save finding' })
 }
 
-// The confirmation's title wraps the key in <code>, so it is found by its Keep it button instead of its name.
-async function findRemovalConfirmation(): Promise<HTMLElement> {
-  const dialogs = await screen.findAllByRole('dialog')
-  const confirmation = dialogs.find((dialog: HTMLElement) => within(dialog).queryByRole('button', { name: 'Keep it' }))
-  if (confirmation === undefined) throw new Error('No removal confirmation is open')
-  return confirmation
-}
-
 async function confirmRemoval(user: UserEvent, key: string): Promise<void> {
   await user.click(await screen.findByRole('button', { name: `Remove retired value ${key}` }))
   const confirmation = await findRemovalConfirmation()
@@ -89,7 +77,7 @@ describe('FindingDialog', () => {
     jest.clearAllMocks()
   })
 
-  it('keeps the #3066 form for the default fields', async () => {
+  it('renders the default fields and saves only the filled values', async () => {
     const user = userEvent.setup()
     const onSave = jest.fn().mockResolvedValue(undefined)
     renderDialog({ onSave })
@@ -213,7 +201,7 @@ describe('FindingDialog', () => {
 
     await user.click(saveButton())
     await waitFor(() => expect(onSave).toHaveBeenCalledWith({
-      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, removeRetiredKeys: [],
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, remove_retired_keys: [],
     }, ATTEMPT))
   })
 
@@ -235,7 +223,7 @@ describe('FindingDialog', () => {
 
     await user.click(saveButton())
     await waitFor(() => expect(onSave).toHaveBeenCalledWith({
-      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, removeRetiredKeys: [],
+      title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_EDIT.field_values, remove_retired_keys: [],
     }, ATTEMPT))
   })
 
@@ -261,13 +249,13 @@ describe('FindingDialog', () => {
     await user.click(await screen.findByRole('button', { name: 'Save finding' }))
     await waitFor(() => expect(onSave).toHaveBeenCalledWith({
       title: CONTOSO_EDIT.title, severity: 'sev1', field_values: CONTOSO_CURRENT_VALUES,
-      removeRetiredKeys: ['description'],
+      remove_retired_keys: ['description'],
     }, ATTEMPT))
     // The backend rejects a key that is both sent and listed for removal.
     expect((onSave.mock.calls[0] as [FindingDraft])[0].field_values).not.toHaveProperty('description')
   })
 
-  it('moves focus to Undo after a removal, and Escape closes only the confirmation', async () => {
+  it('Escape closes only the removal confirmation', async () => {
     const user = userEvent.setup()
     const onClose = jest.fn()
     renderDialog({ fields: CONTOSO_FINDING_FIELDS, editing: true, initialValues: CONTOSO_EDIT, onClose })
@@ -279,10 +267,6 @@ describe('FindingDialog', () => {
     expect(onClose).not.toHaveBeenCalled()
     expect(await screen.findByRole('heading', { name: 'Edit finding' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Remove retired value description' })).toBeInTheDocument()
-
-    await confirmRemoval(user, 'description')
-    expect(await screen.findByRole('button', { name: 'Undo' })).toHaveFocus()
-    expect(onClose).not.toHaveBeenCalled()
   })
 
   it('prevents duplicate submissions and reuses the attempt ID after a failure', async () => {
diff --git a/frontend/src/components/Operations/FindingDialog.tsx b/frontend/src/components/Operations/FindingDialog.tsx
index 7a08c429c2..8876aa28c9 100644
--- a/frontend/src/components/Operations/FindingDialog.tsx
+++ b/frontend/src/components/Operations/FindingDialog.tsx
@@ -8,14 +8,12 @@ import {
 import { toApiError } from '@/services/errors'
 import type { FindingCreate, FindingField, FindingFields } from '@/types'
 import { generateClientId } from '@/utils/clientId'
-import { fieldKeys, firstMissingRequired } from '@/utils/findingFields'
+import { firstMissingRequired, type RetiredValue, SEVERITY_KEY, splitRetiredValues } from '@/utils/findingFields'
 
 import { useFindingDialogStyles } from './FindingDialog.styles'
 import FindingFieldInput from './FindingFieldInput'
 import RetiredFieldValues from './RetiredFieldValues'
 
-// FindingFieldInput reads and reports the severity slot's own value under this key.
-const SEVERITY_KEY = 'severity'
 const NO_KEYS: ReadonlySet<string> = new Set()
 
 /** One save attempt. The id repeats while the input does, so a retry returns a finding a lost response saved. */
@@ -26,7 +24,7 @@ export interface FindingSaveAttempt {
 
 /** The finding Save sends. An edit also resends its kept retired values unchanged, and lists the keys to delete. */
 export interface FindingDraft extends FindingCreate {
-  removeRetiredKeys?: string[]
+  remove_retired_keys?: string[]
 }
 
 interface FindingDialogProps {
@@ -42,11 +40,6 @@ interface FindingDialogProps {
   onClose: () => void
 }
 
-interface RetiredValue {
-  key: string
-  value: string
-}
-
 /** A new finding starts from the field defaults. An edit starts from its values, with retired ones set apart. */
 function openingState(
   fields: FindingFields, initialValues: FindingCreate | undefined,
@@ -58,13 +51,7 @@ function openingState(
     }
     return { draft: { title: '', severity: fields.severity.default ?? '', field_values: defaults }, retired: [] }
   }
-  const known = fieldKeys(fields)
-  const current: Record<string, string> = {}
-  const retired: RetiredValue[] = []
-  for (const [key, value] of Object.entries(initialValues.field_values)) {
-    if (known.has(key)) current[key] = value
-    else retired.push({ key, value })
-  }
+  const { current, retired } = splitRetiredValues(fields, initialValues.field_values)
   return { draft: { title: initialValues.title, severity: initialValues.severity, field_values: current }, retired }
 }
 
@@ -142,7 +129,7 @@ export default function FindingDialog({
       ? {
         ...filled,
         field_values: { ...keptValues(opening.retired, removed), ...filled.field_values },
-        removeRetiredKeys: [...removed],
+        remove_retired_keys: [...removed],
       }
       : filled
     const signature = JSON.stringify([finding, trimmedAttackResultId])
diff --git a/frontend/src/components/Operations/FindingExportDialog.tsx b/frontend/src/components/Operations/FindingExportDialog.tsx
index 07869d8ced..07267a80da 100644
--- a/frontend/src/components/Operations/FindingExportDialog.tsx
+++ b/frontend/src/components/Operations/FindingExportDialog.tsx
@@ -11,7 +11,7 @@ import { toApiError } from '@/services/errors'
 import type { FindingExportFormat, FindingFields, FindingListItem, Operation } from '@/types'
 import { downloadFile } from '@/utils/downloadFile'
 import { findingExportFilename } from '@/utils/findingExportFilename'
-import { fieldKeys } from '@/utils/findingFields'
+import { splitRetiredValues } from '@/utils/findingFields'
 
 import { useFindingExportDialogStyles } from './FindingExportDialog.styles'
 import FindingSeverityBadge from './FindingSeverityBadge'
@@ -74,9 +74,8 @@ export default function FindingExportDialog({ operation, fields }: FindingExport
   const selectedIds = findings.filter(finding => selected.has(finding.id)).map(finding => finding.id)
   const allSelected = selectedIds.length === findings.length
   const selectAllChecked = allSelected ? true : selectedIds.length === 0 ? false : 'mixed'
-  const knownKeys = fieldKeys(fields)
   const selectedWithRetired = findings.filter(finding => selected.has(finding.id)
-    && Object.keys(finding.field_values).some(key => !knownKeys.has(key))).length
+    && splitRetiredValues(fields, finding.field_values).retired.length > 0).length
   // A natively disabled button drops keyboard focus out of the dialog, so while an export runs, and while the list
   // reloads or shows nothing selected after a deleted finding, Download stays focusable but unavailable.
   const downloadKeepsFocus = exporting || (selectedIds.length === 0 && (recovering || removedTitles.length > 0))
diff --git a/frontend/src/components/Operations/FindingFieldInput.test.tsx b/frontend/src/components/Operations/FindingFieldInput.test.tsx
index 66641970f2..a69d1980f1 100644
--- a/frontend/src/components/Operations/FindingFieldInput.test.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.test.tsx
@@ -3,8 +3,9 @@ import { render, screen } from '@testing-library/react'
 import userEvent, { type UserEvent } from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 
-import { CONTOSO_FINDING_FIELDS } from '@/test-utils/findingFieldsFixtures'
-import type { FindingField, FindingFieldOption } from '@/types'
+import { pick } from '@/test-utils/findingDialog'
+import { CONTOSO_FINDING_FIELDS, contosoField, option } from '@/test-utils/findingFieldsFixtures'
+import type { FindingField } from '@/types'
 
 import FindingFieldInput from './FindingFieldInput'
 
@@ -14,16 +15,6 @@ const TestWrapper: React.FC<{ children: React.ReactNode }> = ({ children }) => (
 
 const UNMATCHED_HINT = 'Not a current option. It stays unless you change it.'
 
-function contosoField(key: string): FindingField {
-  const field = CONTOSO_FINDING_FIELDS.fields.find((candidate: FindingField) => candidate.key === key)
-  if (field === undefined) throw new Error(`CONTOSO_FINDING_FIELDS has no field ${key}`)
-  return field
-}
-
-function option(key: string, label: string, children: FindingFieldOption[] = []): FindingFieldOption {
-  return { key, label, children }
-}
-
 const CATEGORY = contosoField('category')
 const TECHNIQUE = contosoField('technique')
 const STEPS = contosoField('steps')
@@ -64,7 +55,7 @@ interface FieldHarnessProps {
   onOtherBlankChange?: (blank: boolean) => void
 }
 
-// Holds the draft the way the finding dialog will, so a test can follow several changes.
+// Holds the draft as the finding dialog does, so a test can follow several changes.
 function FieldHarness({ field, initialValues, onChange, onOtherBlankChange }: FieldHarnessProps) {
   const [values, setValues] = useState(initialValues)
   return (
@@ -81,11 +72,6 @@ async function openPicker(user: UserEvent, label: string): Promise<void> {
   await screen.findByRole('listbox')
 }
 
-async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
-  await openPicker(user, label)
-  await user.click(screen.getByRole('option', { name: optionName }))
-}
-
 function optionNames(): string[] {
   return screen.getAllByRole('option').map((element: HTMLElement) => element.textContent ?? '')
 }
diff --git a/frontend/src/components/Operations/FindingFieldInput.tsx b/frontend/src/components/Operations/FindingFieldInput.tsx
index dc9258e9f9..82789d7a75 100644
--- a/frontend/src/components/Operations/FindingFieldInput.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.tsx
@@ -2,7 +2,7 @@ import { useState, type JSX } from 'react'
 import { Combobox, Field, Input, Option, Textarea } from '@fluentui/react-components'
 
 import type { FindingField, FindingFieldOption } from '@/types'
-import { choiceLevels, levelOptions, ownValue } from '@/utils/findingFields'
+import { choiceLevels, filled, findOption, levelOptions, ownValue } from '@/utils/findingFields'
 
 import { useFindingFieldInputStyles } from './FindingFieldInput.styles'
 
@@ -49,20 +49,6 @@ interface LevelState {
   unavailable: boolean
 }
 
-function storedValue(values: Record<string, string>, key: string): string {
-  const value = ownValue(values, key) ?? ''
-  return value.trim() === '' ? '' : value
-}
-
-function isOption(options: FindingFieldOption[], value: string): boolean {
-  return options.some((option: FindingFieldOption) => option.key === value)
-}
-
-function levelHint(field: FindingField, depth: number, unmatched: boolean): string | undefined {
-  if (unmatched) return UNMATCHED_HINT
-  return depth === 0 ? field.hint ?? undefined : undefined
-}
-
 /**
  * What one dropdown of a choice field offers and shows. A stored value that isn't an option under its path is
  * listed as typed and stays selected, unless the field is showing Other text.
@@ -71,13 +57,13 @@ function levelState(field: FindingField, values: Record<string, string>, depth:
   const levels = choiceLevels(field)
   const fieldOptions = levelOptions(field, values, depth)
   const options = fieldOptions.map((option: FindingFieldOption) => ({ value: option.key, text: option.label }))
-  const value = storedValue(values, levels[depth].key)
-  const unmatched = !otherChosen && value !== '' && !isOption(fieldOptions, value)
-  const parentBlank = depth > 0 && storedValue(values, levels[depth - 1].key) === ''
+  const value = filled(ownValue(values, levels[depth].key)) ?? ''
+  const unmatched = !otherChosen && value !== '' && findOption(fieldOptions, value) === undefined
+  const parentBlank = depth > 0 && filled(ownValue(values, levels[depth - 1].key)) === null
   return {
     options: unmatched ? [{ value, text: value }, ...options] : options,
     selected: otherChosen ? OTHER_VALUE : value,
-    hint: levelHint(field, depth, unmatched),
+    hint: unmatched ? UNMATCHED_HINT : depth === 0 ? field.hint ?? undefined : undefined,
     required: field.required && fieldOptions.length > 0,
     unavailable: depth > 0 && (parentBlank || (options.length === 0 && !unmatched)),
   }
@@ -95,8 +81,8 @@ function cascadeChanges(
   const next = { ...values, ...changes }
   for (const [lower, level] of levels.entries()) {
     if (lower <= depth) continue
-    const current = storedValue(next, level.key)
-    if (current === '' || isOption(levelOptions(field, next, lower), current)) continue
+    const current = filled(ownValue(next, level.key))
+    if (current === null || findOption(levelOptions(field, next, lower), current) !== undefined) continue
     changes[level.key] = ''
     next[level.key] = ''
   }
@@ -161,8 +147,8 @@ function ChoiceFieldInput({
   const levels = choiceLevels(field)
   const allowOther = field.allow_other && levels.length === 1
   const [otherChosen, setOtherChosen] = useState(() => {
-    const value = storedValue(values, field.key)
-    return allowOther && value !== '' && !isOption(field.options, value)
+    const value = filled(ownValue(values, field.key))
+    return allowOther && value !== null && findOption(field.options, value) === undefined
   })
 
   const select = (depth: number, optionValue: string): void => {
@@ -211,9 +197,7 @@ function TextFieldInput({ field, values, disabled, onChange }: FieldControlProps
 
 /**
  * The input for one finding field: a text box for a `text` or `multiline` field, and one searchable dropdown per
- * level for a `choice` field. Changing a cascade level clears each lower level that its new path doesn't offer.
- * A single-level choice with `allow_other` also takes typed Other text, and a stored value that isn't an option
- * stays selected until the user picks another.
+ * level for a `choice` field. A single-level choice with `allow_other` also takes typed Other text.
  */
 export default function FindingFieldInput({
   field, values, disabled = false, onChange, onOtherBlankChange,
diff --git a/frontend/src/components/Operations/FindingSeverityBadge.tsx b/frontend/src/components/Operations/FindingSeverityBadge.tsx
index 48cce56966..abf601cbe4 100644
--- a/frontend/src/components/Operations/FindingSeverityBadge.tsx
+++ b/frontend/src/components/Operations/FindingSeverityBadge.tsx
@@ -9,7 +9,6 @@ interface FindingSeverityBadgeProps {
   severity: string
 }
 
-/** The severity's option label and color, or its stored text on a neutral badge when it matches no option. */
 export default function FindingSeverityBadge({ fields, severity }: FindingSeverityBadgeProps) {
   const styles = useFindingSeverityBadgeStyles()
   const { label, color } = severityBadge(fields, severity)
diff --git a/frontend/src/components/Operations/OperationDetailPage.test.tsx b/frontend/src/components/Operations/OperationDetailPage.test.tsx
index 7eb48578b1..9844188500 100644
--- a/frontend/src/components/Operations/OperationDetailPage.test.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.test.tsx
@@ -1,10 +1,11 @@
 import { act, render, screen, waitFor, within } from '@testing-library/react'
-import userEvent, { type UserEvent } from '@testing-library/user-event'
+import userEvent from '@testing-library/user-event'
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter, Route, Routes } from 'react-router'
 
 import { attacksApi, operationsApi, scenariosApi } from '@/services/api'
 import { deferred } from '@/test-utils/deferred'
+import { findRemovalConfirmation, pick } from '@/test-utils/findingDialog'
 import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { Finding, FindingFields, FindingListItem, Operation, OperationDetail } from '@/types'
 import OperationDetailPage from './OperationDetailPage'
@@ -44,11 +45,6 @@ function renderPage(route = '/operations/op-1', onOperationChanged?: () => void)
   )
 }
 
-async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
-  await user.click(screen.getByRole('combobox', { name: label }))
-  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName, exact: true }))
-}
-
 beforeEach(() => {
   jest.clearAllMocks()
   jest.mocked(operationsApi.getFindingFields).mockResolvedValue(DEFAULT_FINDING_FIELDS_FIXTURE)
@@ -468,9 +464,7 @@ it('resends the kept retired values and lists the removed ones, and sends none f
   renderPage()
   await user.click(await screen.findByRole('button', { name: `Edit finding: ${FINDING.title}` }))
   await user.click(screen.getByRole('button', { name: 'Remove retired value contoso_ticket' }))
-  const confirmation = (await screen.findAllByRole('dialog'))
-    .find(dialog => within(dialog).queryByRole('button', { name: 'Keep it' })) as HTMLElement
-  await user.click(within(confirmation).getByRole('button', { name: 'Remove' }))
+  await user.click(within(await findRemovalConfirmation()).getByRole('button', { name: 'Remove' }))
   await user.click(await screen.findByRole('button', { name: 'Save finding' }))
   await waitFor(() => expect(operationsApi.updateFinding).toHaveBeenCalledWith('op-1', FINDING.id, {
     title: FINDING.title, severity: 'informational', field_values: { harm_type: 'Malware', retired_owner: 'Contoso' },
diff --git a/frontend/src/components/Operations/OperationDetailPage.tsx b/frontend/src/components/Operations/OperationDetailPage.tsx
index 50e8ea8a75..f83898cd7b 100644
--- a/frontend/src/components/Operations/OperationDetailPage.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.tsx
@@ -102,11 +102,12 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
   }
 
   const save = async (draft: FindingDraft, attempt: FindingSaveAttempt): Promise<void> => {
-    const { removeRetiredKeys = [], ...finding } = draft
     const saved = editing
-      ? await operationsApi.updateFinding(operationId, editing.id, { ...finding, remove_retired_keys: removeRetiredKeys })
+      ? await operationsApi.updateFinding(operationId, editing.id, {
+        ...draft, remove_retired_keys: draft.remove_retired_keys ?? [],
+      })
       : await operationsApi.createFinding(operationId, {
-        ...finding, id: attempt.id, ...(attempt.attackResultId ? { attack_result_id: attempt.attackResultId } : {}),
+        ...draft, id: attempt.id, ...(attempt.attackResultId ? { attack_result_id: attempt.attackResultId } : {}),
       })
     setNotice(`Finding ${editing ? 'updated' : 'saved'}: ${saved.title}`)
     setOpen(false)
diff --git a/frontend/src/components/Operations/OperationsPage.tsx b/frontend/src/components/Operations/OperationsPage.tsx
index 7afefd0e67..0c677b9351 100644
--- a/frontend/src/components/Operations/OperationsPage.tsx
+++ b/frontend/src/components/Operations/OperationsPage.tsx
@@ -18,7 +18,6 @@ interface FindingCountsProps {
   counts: Record<string, number>
 }
 
-/** One badge per counted severity option, then one Other badge whose tooltip lists the unmatched severities. */
 function FindingCounts({ fields, counts }: FindingCountsProps) {
   const styles = useOperationsStyles()
   const badges = severityCountBadges(fields, counts)
diff --git a/frontend/src/components/Operations/RetiredFieldValues.test.tsx b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
index 3fe6d23480..c27b17a41d 100644
--- a/frontend/src/components/Operations/RetiredFieldValues.test.tsx
+++ b/frontend/src/components/Operations/RetiredFieldValues.test.tsx
@@ -23,7 +23,7 @@ interface RetiredFieldValuesHarnessProps {
   onUndo: () => void
 }
 
-// Holds the removed keys the way the edit dialog will, so a test can follow a removal through to Undo.
+// Holds the removed keys as the edit dialog does, so a test can follow a removal through to Undo.
 function RetiredFieldValuesHarness({ onRemove, onUndo }: RetiredFieldValuesHarnessProps) {
   const [removed, setRemoved] = useState<ReadonlySet<string>>(new Set())
   return (
diff --git a/frontend/src/hooks/useFindingFields.ts b/frontend/src/hooks/useFindingFields.ts
index 0fe46eaf69..675e374447 100644
--- a/frontend/src/hooks/useFindingFields.ts
+++ b/frontend/src/hooks/useFindingFields.ts
@@ -15,8 +15,8 @@ interface FindingFieldsState {
 }
 
 /**
- * Loads the active finding fields, for the finding dialog, cards and counts, and again when the runtime
- * generation changes, because a live apply can change them.
+ * Loads the active finding fields, and again when the runtime generation changes, because a live apply can
+ * change them.
  * @param enabled - Loads only while true, and again each time it turns true, so a closed dialog fetches nothing.
  */
 export function useFindingFields(enabled = true): FindingFieldsState {
diff --git a/frontend/src/test-utils/findingDialog.ts b/frontend/src/test-utils/findingDialog.ts
new file mode 100644
index 0000000000..e0c0175f65
--- /dev/null
+++ b/frontend/src/test-utils/findingDialog.ts
@@ -0,0 +1,16 @@
+import { screen, within } from '@testing-library/react'
+import type { UserEvent } from '@testing-library/user-event'
+
+/** Opens a finding field's dropdown by its label and picks the option with this exact name. */
+export async function pick(user: UserEvent, label: string, optionName: string): Promise<void> {
+  await user.click(screen.getByRole('combobox', { name: label }))
+  await user.click(within(await screen.findByRole('listbox')).getByRole('option', { name: optionName }))
+}
+
+// The confirmation's title wraps the key in <code>, so it is found by its Keep it button instead of its name.
+export async function findRemovalConfirmation(): Promise<HTMLElement> {
+  const dialogs = await screen.findAllByRole('dialog')
+  const confirmation = dialogs.find((dialog: HTMLElement) => within(dialog).queryByRole('button', { name: 'Keep it' }))
+  if (confirmation === undefined) throw new Error('No removal confirmation is open')
+  return confirmation
+}
diff --git a/frontend/src/test-utils/findingFieldsFixtures.ts b/frontend/src/test-utils/findingFieldsFixtures.ts
index 65dd7a7387..ce84619c4b 100644
--- a/frontend/src/test-utils/findingFieldsFixtures.ts
+++ b/frontend/src/test-utils/findingFieldsFixtures.ts
@@ -18,7 +18,7 @@ function field(definition: FieldDefinition): FindingField {
   }
 }
 
-function option(key: string, label: string, children: FindingFieldOption[] = []): FindingFieldOption {
+export function option(key: string, label: string, children: FindingFieldOption[] = []): FindingFieldOption {
   return { key, label, children }
 }
 
@@ -75,6 +75,12 @@ export const CONTOSO_FINDING_FIELDS: FindingFields = {
   ],
 }
 
+export function contosoField(key: string): FindingField {
+  const match = CONTOSO_FINDING_FIELDS.fields.find((candidate: FindingField) => candidate.key === key)
+  if (match === undefined) throw new Error(`CONTOSO_FINDING_FIELDS has no field ${key}`)
+  return match
+}
+
 /** A copy of the backend's `DEFAULT_FINDING_FIELDS`, with three harm types instead of the whole taxonomy. */
 export const DEFAULT_FINDING_FIELDS_FIXTURE: FindingFields = {
   severity: field({
diff --git a/frontend/src/utils/findingFields.test.ts b/frontend/src/utils/findingFields.test.ts
index 256d076b00..07b123b5fc 100644
--- a/frontend/src/utils/findingFields.test.ts
+++ b/frontend/src/utils/findingFields.test.ts
@@ -1,5 +1,5 @@
-import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
-import type { FindingField, FindingFieldOption, FindingFields } from '@/types'
+import { CONTOSO_FINDING_FIELDS, contosoField, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import type { FindingFieldOption, FindingFields } from '@/types'
 
 import {
   choiceLevels,
@@ -13,12 +13,6 @@ import {
   severityCountBadges,
 } from './findingFields'
 
-function contosoField(key: string): FindingField {
-  const match = CONTOSO_FINDING_FIELDS.fields.find((field: FindingField) => field.key === key)
-  if (match === undefined) throw new Error(`The Contoso fixture has no field ${key}`)
-  return match
-}
-
 function optionKeys(options: FindingFieldOption[]): string[] {
   return options.map((option: FindingFieldOption) => option.key)
 }
@@ -38,7 +32,7 @@ describe('findingFields', () => {
       blue: 'brand', gray: 'informative', dark: 'important', neutral: 'subtle' })
   })
 
-  it('keeps the #3066 badge colors for the default fields', () => {
+  it('gives the default severities their badge colors', () => {
     expect(['critical', 'important', 'moderate', 'low', 'informational']
       .map((key: string) => severityBadge(DEFAULT_FINDING_FIELDS_FIXTURE, key).color))
       .toEqual(['danger', 'warning', 'warning', 'informative', 'subtle'])
diff --git a/frontend/src/utils/findingFields.ts b/frontend/src/utils/findingFields.ts
index 994882ce21..f93fc35799 100644
--- a/frontend/src/utils/findingFields.ts
+++ b/frontend/src/utils/findingFields.ts
@@ -1,6 +1,8 @@
+import type { BadgeProps } from '@fluentui/react-components'
+
 import type { FindingField, FindingFieldOption, FindingFields, FindingSeverityColor } from '@/types'
 
-export type BadgeColor = 'danger' | 'severe' | 'warning' | 'success' | 'brand' | 'informative' | 'important' | 'subtle'
+export type BadgeColor = NonNullable<BadgeProps['color']>
 
 export const FLUENT_BADGE_COLOR: Record<FindingSeverityColor, BadgeColor> = {
   red: 'danger',
@@ -13,7 +15,8 @@ export const FLUENT_BADGE_COLOR: Record<FindingSeverityColor, BadgeColor> = {
   neutral: 'subtle',
 }
 
-const SEVERITY_KEY = 'severity'
+/** The key under which the severity slot's own value travels with the other values. */
+export const SEVERITY_KEY = 'severity'
 
 export interface FindingValueRow {
   key: string
@@ -23,6 +26,11 @@ export interface FindingValueRow {
   multiline: boolean
 }
 
+export interface RetiredValue {
+  key: string
+  value: string
+}
+
 export interface SeverityCountBadge {
   key: string
   label: string
@@ -38,7 +46,8 @@ const OTHER_SEVERITY_BADGE: Pick<SeverityCountBadge, 'key' | 'label' | 'color'>
   color: FLUENT_BADGE_COLOR.neutral,
 }
 
-function filled(value: string | undefined): string | null {
+/** The value, or null when it is missing or blank. */
+export function filled(value: string | undefined): string | null {
   return value !== undefined && value.trim() !== '' ? value : null
 }
 
@@ -47,13 +56,17 @@ export function ownValue<T>(record: Readonly<Record<string, T>>, key: string): T
   return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined
 }
 
+export function findOption(options: FindingFieldOption[], key: string | null): FindingFieldOption | undefined {
+  return options.find((option: FindingFieldOption) => option.key === key)
+}
+
 function allFields(fields: FindingFields): FindingField[] {
   return [fields.severity, ...fields.fields]
 }
 
 /** The severity's option label and badge color, or the stored text on a neutral badge when no option matches. */
 export function severityBadge(fields: FindingFields, severity: string): { label: string; color: BadgeColor } {
-  const match = fields.severity.options.find((option: FindingFieldOption) => option.key === severity)
+  const match = findOption(fields.severity.options, severity)
   if (match === undefined) return { label: severity, color: FLUENT_BADGE_COLOR.neutral }
   return { label: match.label, color: FLUENT_BADGE_COLOR[ownValue(fields.severity.colors, severity) ?? 'neutral'] }
 }
@@ -75,8 +88,7 @@ export function choiceLevels(field: FindingField): Array<{ key: string; label: s
 export function levelOptions(field: FindingField, values: Record<string, string>, depth: number): FindingFieldOption[] {
   let options = field.options
   for (const level of choiceLevels(field).slice(0, depth)) {
-    const value = filled(ownValue(values, level.key))
-    const match = options.find((option: FindingFieldOption) => option.key === value)
+    const match = findOption(options, filled(ownValue(values, level.key)))
     if (match === undefined) return []
     options = match.children
   }
@@ -93,10 +105,24 @@ export function fieldKeys(fields: FindingFields): Set<string> {
   return keys
 }
 
+/** Sets apart the stored values whose keys the active fields no longer define, keeping their stored order. */
+export function splitRetiredValues(
+  fields: FindingFields,
+  fieldValues: Record<string, string>,
+): { current: Record<string, string>; retired: RetiredValue[] } {
+  const known = fieldKeys(fields)
+  const current: Record<string, string> = {}
+  const retired: RetiredValue[] = []
+  for (const [key, value] of Object.entries(fieldValues)) {
+    if (known.has(key)) current[key] = value
+    else retired.push({ key, value })
+  }
+  return { current, retired }
+}
+
 function displayValue(field: FindingField, values: Record<string, string>, depth: number, value: string): string {
   if (field.type !== 'choice') return value
-  const match = levelOptions(field, values, depth).find((option: FindingFieldOption) => option.key === value)
-  return match?.label ?? value
+  return findOption(levelOptions(field, values, depth), value)?.label ?? value
 }
 
 /**
@@ -107,7 +133,7 @@ export function describeFindingValues(
   fields: FindingFields,
   severity: string,
   fieldValues: Record<string, string>,
-): { rows: FindingValueRow[]; retired: Array<{ key: string; value: string }> } {
+): { rows: FindingValueRow[]; retired: RetiredValue[] } {
   const values: Record<string, string> = { ...fieldValues, [SEVERITY_KEY]: severity }
   const rows: FindingValueRow[] = []
   for (const field of allFields(fields)) {
@@ -123,11 +149,7 @@ export function describeFindingValues(
       })
     }
   }
-  const known = fieldKeys(fields)
-  const retired = Object.entries(fieldValues)
-    .filter(([key]: [string, string]) => !known.has(key))
-    .map(([key, value]: [string, string]) => ({ key, value }))
-  return { rows, retired }
+  return { rows, retired: splitRetiredValues(fields, fieldValues).retired }
 }
 
 function firstMissingLevel(field: FindingField, values: Record<string, string>): string | null {
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index d14876071e..4296e26f71 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -486,8 +486,7 @@ def _merge_retired_values(
             FindingValuesError: If ``remove_retired_keys`` lists a key that isn't a retired value of the finding
                 or that is also sent.
         """
-        known = fields.field_keys
-        retired = {key: value for key, value in stored.field_values.items() if key not in known}
+        retired = dict(fields.describe_values(severity=stored.severity, field_values=stored.field_values).retired)
         for key in request.remove_retired_keys:
             if key not in retired:
                 raise FindingValuesError(f"{key!r} is not a retired value of this finding.")
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index 270765a700..95aaf47f0f 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -117,9 +117,6 @@ def _check_key(self, key: str) -> None:
         """
         Require a key of lowercase letters, digits and underscores.
 
-        Args:
-            key (str): The field or level key.
-
         Raises:
             ValueError: If the key uses any other character or is empty.
         """
@@ -242,7 +239,8 @@ def severity_order(self) -> list[str]:
     @property
     def field_keys(self) -> frozenset[str]:
         """The key of every field and level, except ``severity``."""
-        return frozenset(key for field in [self.severity, *self.fields] for key in _keys_of(field)) - {"severity"}
+        keys = (key for field in [self.severity, *self.fields] for key, _ in _keys_and_labels(field))
+        return frozenset(keys) - {"severity"}
 
     @field_validator("severity")
     @classmethod
@@ -282,7 +280,7 @@ def _validate_keys(self) -> Self:
         colored = next((field.key for field in self.fields if field.colors), None)
         if colored is not None:
             raise ValueError(f"Only the severity field can set colors, not '{colored}'.")
-        keys = [key for field in [self.severity, *self.fields] for key in _keys_of(field)]
+        keys = [key for field in [self.severity, *self.fields] for key, _ in _keys_and_labels(field)]
         repeated = _first_repeated(keys)
         if repeated is not None:
             raise ValueError(f"The key '{repeated}' is used more than once across fields and levels.")
@@ -353,10 +351,6 @@ def _check_known_keys(self, *, field_values: dict[str, str], previous_values: di
         """
         Reject a key that no field or level uses, unless its value has not changed.
 
-        Args:
-            field_values (dict[str, str]): The values to check, by key.
-            previous_values (dict[str, str]): The stored finding's field values.
-
         Raises:
             FindingValuesError: If a key is unknown and its value differs from the stored one.
         """
@@ -378,9 +372,6 @@ def _parse_options(value: Any) -> Any:
     A dict maps each ``(key, label)`` pair to its children, written the same way. In a list, a
     ``(key, label)`` pair becomes an option without children, and anything else passes through.
 
-    Args:
-        value (Any): The options as written.
-
     Returns:
         Any: The options as a list, or ``value`` unchanged if it is neither a dict nor a list.
     """
@@ -395,10 +386,6 @@ def _parse_branch(*, pair: Any, children: Any) -> dict[str, Any]:
     """
     Turn one cascade dict entry into an option dict with its children.
 
-    Args:
-        pair (Any): The entry's key, which must be a ``(key, label)`` pair.
-        children (Any): The options under it, as a list or a dict.
-
     Returns:
         dict[str, Any]: The option with its parsed children.
 
@@ -414,9 +401,6 @@ def _is_pair(value: Any) -> bool:
     """
     Check whether a value is a 2-item tuple or list of strings.
 
-    Args:
-        value (Any): The value to check.
-
     Returns:
         bool: True if the value is a ``(key, label)`` pair.
     """
@@ -427,9 +411,6 @@ def _walk(options: list[FindingFieldOption]) -> Iterator[FindingFieldOption]:
     """
     Yield every option in a tree, each parent before its children.
 
-    Args:
-        options (list[FindingFieldOption]): The top-level options.
-
     Yields:
         FindingFieldOption: Each option in the tree.
     """
@@ -442,9 +423,6 @@ def _depth(options: list[FindingFieldOption]) -> int:
     """
     Count the dropdowns that the deepest branch of an option tree needs.
 
-    Args:
-        options (list[FindingFieldOption]): The top-level options.
-
     Returns:
         int: The depth of the tree, or 0 for no options.
     """
@@ -457,9 +435,6 @@ def _first_repeated(keys: Iterable[str]) -> str | None:
     """
     Find the first key that appears a second time.
 
-    Args:
-        keys (Iterable[str]): The keys in written order.
-
     Returns:
         str | None: The first repeated key, or None if all keys are unique.
     """
@@ -471,28 +446,38 @@ def _first_repeated(keys: Iterable[str]) -> str | None:
     return None
 
 
-def _keys_of(field: FindingField) -> list[str]:
+def _keys_and_labels(field: FindingField) -> list[tuple[str, str]]:
     """
-    List a field's key followed by its level keys.
-
-    Args:
-        field (FindingField): The field.
+    List the ``(key, label)`` of a field followed by those of its levels.
 
     Returns:
-        list[str]: The field key and level keys in written order.
+        list[tuple[str, str]]: The field's and its levels' keys and labels in written order.
+    """
+    return [(field.key, field.label), *field.levels]
+
+
+def _walk_values(
+    *, field: FindingField, values: dict[str, str]
+) -> Iterator[tuple[str, str, str | None, list[FindingFieldOption], FindingFieldOption | None]]:
+    """
+    Walk a field and its levels, following each value to the options of the next level.
+
+    Yields:
+        tuple[str, str, str | None, list[FindingFieldOption], FindingFieldOption | None]: The key, label,
+            non-blank value or None, offered options, and matching option or None of the field and of each level.
     """
-    return [field.key, *(level_key for level_key, _ in field.levels)]
+    options = field.options
+    for key, label in _keys_and_labels(field):
+        value = _non_blank(values.get(key))
+        match = _find_option(options=options, value=value)
+        yield key, label, value, options, match
+        options = match.children if match is not None else []
 
 
 def _check_field_values(*, field: FindingField, values: dict[str, str], previous_values: dict[str, str]) -> None:
     """
     Check the value of one field and of its levels.
 
-    Args:
-        field (FindingField): The field.
-        values (dict[str, str]): Every value of the finding, by key.
-        previous_values (dict[str, str]): Every value of the stored finding, by key.
-
     Raises:
         FindingValuesError: If a required value is missing or a value is not an option.
     """
@@ -508,81 +493,24 @@ def _check_choice_values(*, field: FindingField, values: dict[str, str], previou
 
     A value that is not an option passes if it and every value above it are unchanged.
 
-    Args:
-        field (FindingField): The choice field.
-        values (dict[str, str]): Every value of the finding, by key.
-        previous_values (dict[str, str]): Every value of the stored finding, by key.
-
     Raises:
         FindingValuesError: If a required dropdown with options has no value, or a changed value is
             not an option and is not allowed as Other text.
     """
-    options = field.options
     path_unchanged = True
-    for key, label in [(field.key, field.label), *field.levels]:
-        value = _non_blank(values.get(key))
+    for key, label, value, options, match in _walk_values(field=field, values=values):
         path_unchanged = path_unchanged and value == _non_blank(previous_values.get(key))
-        options = _check_level(
-            label=label,
-            value=value,
-            options=options,
-            required=field.required,
-            unchanged=path_unchanged,
-            allow_other=field.allow_other,
-        )
-
-
-def _check_level(
-    *,
-    label: str,
-    value: str | None,
-    options: list[FindingFieldOption],
-    required: bool,
-    unchanged: bool,
-    allow_other: bool,
-) -> list[FindingFieldOption]:
-    """
-    Check one dropdown's value and find the options of the next dropdown.
-
-    Args:
-        label (str): The dropdown's label.
-        value (str | None): The dropdown's value, or None if it is missing.
-        options (list[FindingFieldOption]): The options the dropdown offers.
-        required (bool): Whether the field is required.
-        unchanged (bool): Whether this value and every value above it are unchanged, so a value
-            that is not an option passes.
-        allow_other (bool): Whether the field accepts Other text.
-
-    Returns:
-        list[FindingFieldOption]: The children of the chosen option, or an empty list if there is
-            no matching option.
-
-    Raises:
-        FindingValuesError: If a required dropdown with options has no value, or a changed value is
-            not an option and is not allowed as Other text.
-    """
-    if value is None:
-        if required and options:
-            raise FindingValuesError(f"{label} is required.")
-        return []
-    match = _find_option(options=options, value=value)
-    if match is not None:
-        return match.children
-    if not unchanged:
-        _check_other_text(label=label, value=value, options=options, allow_other=allow_other)
-    return []
+        if value is None:
+            if field.required and options:
+                raise FindingValuesError(f"{label} is required.")
+        elif match is None and not path_unchanged:
+            _check_other_text(label=label, value=value, options=options, allow_other=field.allow_other)
 
 
 def _check_other_text(*, label: str, value: str, options: list[FindingFieldOption], allow_other: bool) -> None:
     """
     Accept a value that is not an option only as Other text that names no option.
 
-    Args:
-        label (str): The dropdown's label.
-        value (str): The dropdown's value.
-        options (list[FindingFieldOption]): The options the dropdown offers.
-        allow_other (bool): Whether the field accepts Other text.
-
     Raises:
         FindingValuesError: If the field takes no Other text, or the text matches an option's key or
             label apart from case and surrounding spaces.
@@ -615,10 +543,6 @@ def _find_option(*, options: list[FindingFieldOption], value: str | None) -> Fin
     """
     Find the option whose key is a dropdown's value.
 
-    Args:
-        options (list[FindingFieldOption]): The options the dropdown offers.
-        value (str | None): The dropdown's value, or None if it is missing.
-
     Returns:
         FindingFieldOption | None: The matching option, or None if no option has that key.
     """
@@ -629,18 +553,10 @@ def _value_rows(*, field: FindingField, values: dict[str, str]) -> Iterator[Find
     """
     Label the filled values of one field and of its levels.
 
-    Args:
-        field (FindingField): The field.
-        values (dict[str, str]): Every value of the finding, by key.
-
     Yields:
         FindingValueRow: A row for each filled value, in level order.
     """
-    options = field.options
-    for key, label in [(field.key, field.label), *field.levels]:
-        value = _non_blank(values.get(key))
-        match = _find_option(options=options, value=value)
-        options = match.children if match is not None else []
+    for key, label, value, _, match in _walk_values(field=field, values=values):
         if value is not None:
             yield FindingValueRow(
                 key=key,
@@ -657,11 +573,11 @@ def _value_rows(*, field: FindingField, values: dict[str, str]) -> Iterator[Find
         label="Severity",
         type=FindingFieldType.CHOICE,
         options=[
-            FindingFieldOption(key="critical", label="Critical"),
-            FindingFieldOption(key="important", label="Important"),
-            FindingFieldOption(key="moderate", label="Moderate"),
-            FindingFieldOption(key="low", label="Low"),
-            FindingFieldOption(key="informational", label="Informational"),
+            ("critical", "Critical"),
+            ("important", "Important"),
+            ("moderate", "Moderate"),
+            ("low", "Low"),
+            ("informational", "Informational"),
         ],
         default="moderate",
         allow_other=True,
@@ -678,9 +594,7 @@ def _value_rows(*, field: FindingField, values: dict[str, str]) -> Iterator[Find
             label="Harm-type",
             type=FindingFieldType.CHOICE,
             options=[
-                FindingFieldOption(key=category.value, label=category.value)
-                for category in HarmCategory
-                if category is not HarmCategory.OTHER
+                (category.value, category.value) for category in HarmCategory if category is not HarmCategory.OTHER
             ],
             allow_other=True,
             hint="Optional. Select a category, or choose Other for custom text.",
diff --git a/pyrit/setup/initializers/findings.py b/pyrit/setup/initializers/findings.py
index b7c31adf39..9b6e06c666 100644
--- a/pyrit/setup/initializers/findings.py
+++ b/pyrit/setup/initializers/findings.py
@@ -31,8 +31,6 @@ async def get_dynamic_default_values_info_async(self) -> dict[str, Any]:
         """
         Report no default values or global variables without running ``initialize_async``.
 
-        The base class runs ``initialize_async`` to find out, which would change the active finding fields.
-
         Returns:
             dict[str, Any]: Empty ``default_values`` and ``global_variables`` lists.
         """
diff --git a/tests/unit/backend/conftest.py b/tests/unit/backend/conftest.py
index 73d5d61363..6b989f3ff1 100644
--- a/tests/unit/backend/conftest.py
+++ b/tests/unit/backend/conftest.py
@@ -23,13 +23,6 @@
 from test_support.fixtures import authentication_policy, compatibility_headers, compatibility_id  # noqa: F401
 from unit.async_utils import TEST_WATCHDOG_SECONDS
 
-_CONTOSO_FIELDS = FindingFields(
-    severity=FindingField(
-        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
-    ),
-    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
-)
-
 
 @pytest.fixture
 async def analytics_service(sqlite_instance: SQLiteMemory) -> AsyncGenerator[AttackResultAnalytics, None]:
@@ -69,16 +62,31 @@ def isolated_manual_message_services() -> Iterator[None]:
 
 
 @pytest.fixture
-async def retired_value_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
-    """Seed a finding with ``steps`` and ``description`` values, then make fields without ``description`` active."""
+def contoso_finding_fields(reset_finding_fields: None) -> FindingFields:
+    """Make Contoso's finding fields active: severities ``sev1`` and ``sev2``, and a required ``steps`` field."""
+    fields = FindingFields(
+        severity=FindingField(
+            key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
+        ),
+        fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
+    )
+    set_active_finding_fields(finding_fields=fields, source="test")
+    return fields
+
+
+@pytest.fixture
+async def retired_value_finding_async(sqlite_instance: SQLiteMemory, contoso_finding_fields: FindingFields) -> Finding:
+    """Seed a finding with ``steps`` and a ``description`` value that Contoso's fields don't use."""
     return await _seed_contoso_finding_async(
         sqlite_instance=sqlite_instance, severity="sev1", field_values={"steps": "1. Open", "description": "Old text"}
     )
 
 
 @pytest.fixture
-async def unmatched_severity_finding_async(sqlite_instance: SQLiteMemory, reset_finding_fields: None) -> Finding:
-    """Seed a finding with severity ``low``, then make fields without a ``low`` severity option active."""
+async def unmatched_severity_finding_async(
+    sqlite_instance: SQLiteMemory, contoso_finding_fields: FindingFields
+) -> Finding:
+    """Seed a finding with severity ``low``, which Contoso's fields don't offer."""
     return await _seed_contoso_finding_async(
         sqlite_instance=sqlite_instance, severity="low", field_values={"steps": "1. Open"}
     )
@@ -88,8 +96,6 @@ async def _seed_contoso_finding_async(
     *, sqlite_instance: SQLiteMemory, severity: str, field_values: dict[str, str]
 ) -> Finding:
     operation = await sqlite_instance.add_operation_async(Operation(name="Contoso"))
-    finding = await sqlite_instance.add_finding_async(
+    return await sqlite_instance.add_finding_async(
         finding=Finding(operation_id=operation.id, title="Leak", severity=severity, field_values=field_values)
     )
-    set_active_finding_fields(finding_fields=_CONTOSO_FIELDS, source="test")
-    return finding
diff --git a/tests/unit/backend/mocks.py b/tests/unit/backend/mocks.py
index 285d705371..2f09f0fbaf 100644
--- a/tests/unit/backend/mocks.py
+++ b/tests/unit/backend/mocks.py
@@ -1,7 +1,7 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT license.
 
-"""Shared attack fixtures for backend service tests."""
+"""Shared attack and finding helpers for backend service tests."""
 
 import asyncio
 from collections.abc import AsyncGenerator
@@ -12,11 +12,18 @@
 from pyrit.backend.models.message_sends import MessageSendState, MessageSendStatus
 from pyrit.backend.services.message_send_service import MessageSendService
 from pyrit.memory import MemoryInterface
-from pyrit.models import AtomicAttackIdentifier, AttackOutcome, AttackResult, ComponentIdentifier
+from pyrit.models import AtomicAttackIdentifier, AttackOutcome, AttackResult, ComponentIdentifier, Finding
 from pyrit.prompt_target import PromptTarget
 from unit.async_utils import TEST_WATCHDOG_SECONDS
 
 
+async def read_finding_async(*, memory: MemoryInterface, finding: Finding) -> Finding:
+    """Read a finding back from memory, failing if it is gone."""
+    stored = await memory.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
+    assert stored is not None
+    return stored
+
+
 async def _settle_send_async(
     *, service: MessageSendService, status: MessageSendStatus, timeout_seconds: float = TEST_WATCHDOG_SECONDS
 ) -> MessageSendStatus:
diff --git a/tests/unit/backend/test_operation_service_findings.py b/tests/unit/backend/test_operation_service_findings.py
index f245e651d6..33739af52f 100644
--- a/tests/unit/backend/test_operation_service_findings.py
+++ b/tests/unit/backend/test_operation_service_findings.py
@@ -9,6 +9,7 @@
 from pyrit.backend.services.operation_service import OperationService
 from pyrit.memory import SQLiteMemory
 from pyrit.models import Finding, FindingValuesError
+from unit.backend.mocks import read_finding_async
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
@@ -28,19 +29,13 @@ async def _update_async(
     )
 
 
-async def _stored_values_async(*, sqlite_instance: SQLiteMemory, finding: Finding) -> dict[str, str]:
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    return stored.field_values
-
-
 async def test_update_keeps_an_omitted_retired_value(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
 ) -> None:
     finding = retired_value_finding_async
     updated = await _update_async(finding=finding, field_values={"steps": "1. Open"})
     assert updated.field_values == finding.field_values
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
 async def test_update_keeps_a_blank_retired_value(
@@ -48,7 +43,7 @@ async def test_update_keeps_a_blank_retired_value(
 ) -> None:
     finding = retired_value_finding_async
     await _update_async(finding=finding, field_values={"steps": "1. Open", "description": " "})
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
 async def test_update_removes_a_listed_retired_value(
@@ -59,7 +54,7 @@ async def test_update_removes_a_listed_retired_value(
         finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=["description"]
     )
     assert updated.field_values == {"steps": "1. Open"}
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == {"steps": "1. Open"}
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == {"steps": "1. Open"}
 
 
 @pytest.mark.parametrize("key", ["steps", "nonexistent"])
@@ -69,7 +64,7 @@ async def test_update_rejects_removing_a_value_that_is_not_retired(
     finding = retired_value_finding_async
     with pytest.raises(FindingValuesError, match=re.escape(f"{key!r} is not a retired value of this finding.")):
         await _update_async(finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=[key])
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
 async def test_update_rejects_sending_and_removing_a_value(
@@ -78,7 +73,7 @@ async def test_update_rejects_sending_and_removing_a_value(
     finding = retired_value_finding_async
     with pytest.raises(FindingValuesError, match=re.escape("'description' can't be both sent and removed.")):
         await _update_async(finding=finding, field_values=finding.field_values, remove_retired_keys=["description"])
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
 async def test_update_rejects_changing_a_retired_value(
@@ -88,7 +83,7 @@ async def test_update_rejects_changing_a_retired_value(
     message = "Finding field 'description' is no longer configured, so its saved value can't change."
     with pytest.raises(FindingValuesError, match=re.escape(message)):
         await _update_async(finding=finding, field_values={"steps": "1. Open", "description": "New text"})
-    assert await _stored_values_async(sqlite_instance=sqlite_instance, finding=finding) == finding.field_values
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
 async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option(
@@ -97,9 +92,7 @@ async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option(
     finding = unmatched_severity_finding_async
     updated = await _update_async(finding=finding, severity="low", field_values={"steps": "1. Open"})
     assert updated.severity == "low"
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.severity == "low"
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).severity == "low"
 
 
 async def test_update_rejects_changing_to_another_severity_that_is_not_an_option(
@@ -108,6 +101,4 @@ async def test_update_rejects_changing_to_another_severity_that_is_not_an_option
     finding = unmatched_severity_finding_async
     with pytest.raises(FindingValuesError, match=re.escape("Severity has no option 'medium'.")):
         await _update_async(finding=finding, severity="medium", field_values={"steps": "1. Open"})
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.severity == "low"
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).severity == "low"
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index ccdc35e79c..5f6dbc05d1 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -34,17 +34,12 @@
     Score,
 )
 from pyrit.setup.finding_fields import reset_active_finding_fields, set_active_finding_fields
+from unit.backend.mocks import read_finding_async
 
 pytestmark = pytest.mark.usefixtures("patch_central_database")
 
 MISSING_ID = UUID(int=404)
 EMPTY_USAGE = {"findings": 0, "attacks": 0, "scenario_runs": 0}
-CONTOSO = FindingFields(
-    severity=FindingField(
-        key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1"), ("sev2", "Sev 2")]
-    ),
-    fields=[FindingField(key="steps", label="Steps to reproduce", type="multiline", required=True)],
-)
 
 
 def test_operations_create_list_and_get(compatibility_headers: dict[str, str]) -> None:
@@ -156,20 +151,10 @@ def test_findings_are_created_and_listed_under_an_operation(compatibility_header
     assert counts == {"Case": {"informational": 1}, "Other": {"low": 1}}
 
 
-def test_findings_list_highest_severity_first(compatibility_headers: dict[str, str]) -> None:
-    client = TestClient(app, headers=compatibility_headers)
-    operation_id = client.post("/api/operations", json={"name": "Sorted"}).json()["id"]
-    for title, severity in [("First", "critical"), ("Second", "low")]:
-        client.post(f"/api/operations/{operation_id}/findings", json={"title": title, "severity": severity})
-    listed = client.get(f"/api/operations/{operation_id}/findings", params={"limit": 20}).json()["items"]
-    assert [item["title"] for item in listed] == ["First", "Second"]
-
-
-@pytest.mark.usefixtures("reset_finding_fields")
+@pytest.mark.usefixtures("contoso_finding_fields")
 async def test_findings_list_in_the_active_severity_order_async(
     sqlite_instance: SQLiteMemory, compatibility_headers: dict[str, str]
 ) -> None:
-    set_active_finding_fields(finding_fields=CONTOSO, source="test")
     client = TestClient(app, headers=compatibility_headers)
     operation_id = client.post("/api/operations", json={"name": "Contoso"}).json()["id"]
     path = f"/api/operations/{operation_id}/findings"
@@ -183,52 +168,30 @@ async def test_findings_list_in_the_active_severity_order_async(
     assert [item["severity"] for item in listed] == ["sev1", "sev2", "Sev 2.5"]
 
 
-@pytest.mark.usefixtures("reset_finding_fields")
-def test_finding_fields_returns_the_active_fields(compatibility_headers: dict[str, str]) -> None:
+def test_finding_fields_returns_the_active_fields(
+    compatibility_headers: dict[str, str], contoso_finding_fields: FindingFields
+) -> None:
     client = TestClient(app, headers=compatibility_headers)
+    assert FindingFields.model_validate(client.get("/api/operations/finding-fields").json()) == contoso_finding_fields
+    reset_active_finding_fields()
     assert FindingFields.model_validate(client.get("/api/operations/finding-fields").json()) == DEFAULT_FINDING_FIELDS
-    set_active_finding_fields(finding_fields=CONTOSO, source="test")
-    assert FindingFields.model_validate(client.get("/api/operations/finding-fields").json()) == CONTOSO
     assert client.get("/api/operations/finding-options").status_code != 200
     assert TestClient(app).get("/api/operations/finding-fields").status_code != 200
 
 
-@pytest.mark.usefixtures("reset_finding_fields")
-@pytest.mark.parametrize(
-    ("body", "detail"),
-    [
-        ({"severity": "sev1"}, "Steps to reproduce is required."),
-        ({"severity": "sev9", "field_values": {"steps": "1. Open"}}, "Severity has no option 'sev9'."),
-        ({"severity": "sev1", "field_values": {"steps": "1. Open", "owner": "dana"}}, "Unknown finding field 'owner'."),
-    ],
-)
-def test_finding_create_is_checked_against_the_active_fields(
-    body: dict[str, object], detail: str, compatibility_headers: dict[str, str]
-) -> None:
-    set_active_finding_fields(finding_fields=CONTOSO, source="test")
+@pytest.mark.usefixtures("contoso_finding_fields")
+def test_finding_create_is_checked_against_the_active_fields(compatibility_headers: dict[str, str]) -> None:
     client = TestClient(app, headers=compatibility_headers)
     operation_id = client.post("/api/operations", json={"name": "Contoso"}).json()["id"]
     path = f"/api/operations/{operation_id}/findings"
-    rejected = client.post(path, json={"title": "Leak", **body})
+    rejected = client.post(path, json={"title": "Leak", "severity": "sev1"})
     assert rejected.status_code == 422
-    assert rejected.json()["detail"] == detail
+    assert rejected.json()["detail"] == "Steps to reproduce is required."
     assert client.get(path).json()["items"] == []
     created = client.post(path, json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open"}})
     assert created.status_code == 201
 
 
-def test_finding_create_rejects_other_text_that_matches_an_option(compatibility_headers: dict[str, str]) -> None:
-    client = TestClient(app, headers=compatibility_headers)
-    operation_id = client.post("/api/operations", json={"name": "Case"}).json()["id"]
-    path = f"/api/operations/{operation_id}/findings"
-    rejected = client.post(path, json={"title": "Leak", "severity": "Critical"})
-    assert rejected.status_code == 422
-    assert rejected.json()["detail"] == (
-        "Severity 'Critical' matches the option 'Critical' (key 'critical'). Choose that option instead."
-    )
-    assert client.get(path).json()["items"] == []
-
-
 def test_finding_api_round_trips_field_values_and_drops_blanks(compatibility_headers: dict[str, str]) -> None:
     client = TestClient(app, headers=compatibility_headers)
     operation_id = client.post("/api/operations", json={"name": "Field values"}).json()["id"]
@@ -422,8 +385,7 @@ async def test_update_keeps_an_unchanged_retired_value_async(
         json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "Old text"}},
     )
     assert response.status_code == 200
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
+    stored = await read_finding_async(memory=sqlite_instance, finding=finding)
     assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
 
 
@@ -440,26 +402,11 @@ async def test_update_rejects_a_changed_retired_value_async(
         response.json()["detail"]
         == "Finding field 'description' is no longer configured, so its saved value can't change."
     )
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
+    stored = await read_finding_async(memory=sqlite_instance, finding=finding)
     assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
     assert client.put(f"{path}/{MISSING_ID}", json=body).status_code == 404
 
 
-async def test_update_keeps_an_omitted_retired_value_async(
-    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
-) -> None:
-    finding = retired_value_finding_async
-    response = TestClient(app, headers=compatibility_headers).put(
-        f"/api/operations/{finding.operation_id}/findings/{finding.id}",
-        json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open"}},
-    )
-    assert response.status_code == 200
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
-
-
 async def test_update_removes_a_listed_retired_value_async(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
 ) -> None:
@@ -474,28 +421,31 @@ async def test_update_removes_a_listed_retired_value_async(
         },
     )
     assert response.status_code == 200
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.field_values == {"steps": "1. Open"}
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == {"steps": "1. Open"}
 
 
 async def test_update_keeps_a_current_value_that_a_stale_client_resends_async(
-    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, compatibility_headers: dict[str, str]
+    sqlite_instance: SQLiteMemory,
+    retired_value_finding_async: Finding,
+    contoso_finding_fields: FindingFields,
+    compatibility_headers: dict[str, str],
 ) -> None:
     finding = retired_value_finding_async
     # A live apply makes ``description`` current again, while the client still shows it as retired.
     reset_active_finding_fields()
     description = FindingField(key="description", label="Description", type="multiline")
     set_active_finding_fields(
-        finding_fields=FindingFields(severity=CONTOSO.severity, fields=[*CONTOSO.fields, description]), source="test"
+        finding_fields=FindingFields(
+            severity=contoso_finding_fields.severity, fields=[*contoso_finding_fields.fields, description]
+        ),
+        source="test",
     )
     response = TestClient(app, headers=compatibility_headers).put(
         f"/api/operations/{finding.operation_id}/findings/{finding.id}",
         json={"title": "Leak", "severity": "sev1", "field_values": {"steps": "1. Open", "description": "Old text"}},
     )
     assert response.status_code == 200
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
+    stored = await read_finding_async(memory=sqlite_instance, finding=finding)
     assert stored.field_values == {"steps": "1. Open", "description": "Old text"}
 
 
@@ -509,9 +459,7 @@ async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option_as
     )
     assert response.status_code == 200
     assert response.json()["severity"] == "low"
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.severity == "low"
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).severity == "low"
 
 
 async def test_update_rejects_changing_to_another_severity_that_is_not_an_option_async(
@@ -524,9 +472,7 @@ async def test_update_rejects_changing_to_another_severity_that_is_not_an_option
     )
     assert response.status_code == 422
     assert response.json()["detail"] == "Severity has no option 'medium'."
-    stored = await sqlite_instance.get_finding_async(operation_id=finding.operation_id, finding_id=finding.id)
-    assert stored is not None
-    assert stored.severity == "low"
+    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).severity == "low"
 
 
 @pytest.fixture
diff --git a/tests/unit/memory/test_findings.py b/tests/unit/memory/test_findings.py
index 85dd032e9c..419e264363 100644
--- a/tests/unit/memory/test_findings.py
+++ b/tests/unit/memory/test_findings.py
@@ -225,33 +225,6 @@ async def test_update_finding_replaces_field_values_without_losing_evidence(sqli
     assert await sqlite_instance.get_finding_evidence_counts_async(finding_ids=[saved.id]) == {saved.id: 1}
 
 
-async def test_custom_severity_sorts_after_every_preset(sqlite_instance: SQLiteMemory) -> None:
-    operation = await sqlite_instance.add_operation_async(Operation(name="Order"))
-    stamp = datetime(2026, 10, 9, tzinfo=UTC)
-    for number, severity in enumerate(
-        ["Sev 2.5", "informational", "low", "moderate", "important", "critical"], start=1
-    ):
-        await sqlite_instance.add_finding_async(
-            finding=Finding.model_validate(
-                {
-                    "id": UUID(int=number),
-                    "created_at": stamp,
-                    "operation_id": operation.id,
-                    "title": severity,
-                    "severity": severity,
-                }
-            )
-        )
-    assert [finding.title for finding in await sqlite_instance.get_findings_async(severity_order=SEVERITY_ORDER)] == [
-        "critical",
-        "important",
-        "moderate",
-        "low",
-        "informational",
-        "Sev 2.5",
-    ]
-
-
 async def test_get_findings_sorts_unlisted_severities_after_listed_ones(sqlite_instance: SQLiteMemory) -> None:
     operation = await sqlite_instance.add_operation_async(Operation(name="Partial order"))
     stamp = datetime(2026, 10, 9, tzinfo=UTC)
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index 8ff49e9ac8..634399db79 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -92,7 +92,7 @@ def test_field_keys_lists_every_field_and_level_key_except_severity() -> None:
     )
 
 
-def test_default_finding_fields_match_3066() -> None:
+def test_default_finding_fields_define_severity_harm_type_and_description() -> None:
     severity, (harm, description) = DEFAULT_FINDING_FIELDS.severity, DEFAULT_FINDING_FIELDS.fields
     assert DEFAULT_FINDING_FIELDS.severity_order == ["critical", "important", "moderate", "low", "informational"]
     assert [option.label for option in severity.options] == [
@@ -124,17 +124,6 @@ def test_default_finding_fields_match_3066() -> None:
 SEVERITY = {"key": "severity", "label": "Severity", "type": "choice", "options": [("high", "High")]}
 
 
-@pytest.mark.parametrize("color", ["red", "orange", "yellow", "green", "blue", "gray", "dark", "neutral"])
-def test_severity_slot_accepts_every_badge_color(color: str) -> None:
-    fields = FindingFields.model_validate({"severity": {**SEVERITY, "colors": {"high": color}}, "fields": []})
-    assert fields.severity.colors == {"high": color}
-
-
-def test_severity_slot_rejects_an_unknown_color() -> None:
-    with pytest.raises(ValidationError, match="Input should be"):
-        FindingFields.model_validate({"severity": {**SEVERITY, "colors": {"high": "pink"}}, "fields": []})
-
-
 def _choice(**overrides: object) -> dict[str, object]:
     return {"key": "area", "label": "Area", "type": "choice", "options": [("chat", "Chat")], **overrides}
 
diff --git a/tests/unit/setup/conftest.py b/tests/unit/setup/conftest.py
new file mode 100644
index 0000000000..e177debda2
--- /dev/null
+++ b/tests/unit/setup/conftest.py
@@ -0,0 +1,14 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import pytest
+
+from pyrit.models import FindingField, FindingFields
+
+
+@pytest.fixture
+def custom_finding_fields() -> FindingFields:
+    """Finding fields with one severity option, unlike ``DEFAULT_FINDING_FIELDS``."""
+    return FindingFields(
+        severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+    )
diff --git a/tests/unit/setup/test_finding_fields.py b/tests/unit/setup/test_finding_fields.py
index eb35a3b7bd..f7051019c3 100644
--- a/tests/unit/setup/test_finding_fields.py
+++ b/tests/unit/setup/test_finding_fields.py
@@ -5,7 +5,7 @@
 
 import pytest
 
-from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingFields
 from pyrit.setup.finding_fields import (
     get_active_finding_fields,
     reset_active_finding_fields,
@@ -14,25 +14,21 @@
 
 pytestmark = pytest.mark.usefixtures("reset_finding_fields")
 
-CUSTOM = FindingFields(
-    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
-)
-
 
-def test_active_finding_fields_default_to_3066() -> None:
+def test_get_active_finding_fields_returns_the_default_until_set() -> None:
     assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
 
 
-def test_set_active_finding_fields_replaces_the_default() -> None:
-    set_active_finding_fields(finding_fields=CUSTOM, source="First")
-    assert get_active_finding_fields() is CUSTOM
+def test_set_active_finding_fields_replaces_the_default(custom_finding_fields: FindingFields) -> None:
+    set_active_finding_fields(finding_fields=custom_finding_fields, source="First")
+    assert get_active_finding_fields() is custom_finding_fields
 
 
-def test_set_active_finding_fields_twice_names_both_sources() -> None:
-    set_active_finding_fields(finding_fields=CUSTOM, source="First")
+def test_set_active_finding_fields_twice_names_both_sources(custom_finding_fields: FindingFields) -> None:
+    set_active_finding_fields(finding_fields=custom_finding_fields, source="First")
     with pytest.raises(ValueError, match="Second cannot set the finding fields: First already set them"):
         set_active_finding_fields(finding_fields=DEFAULT_FINDING_FIELDS, source="Second")
-    assert get_active_finding_fields() is CUSTOM
+    assert get_active_finding_fields() is custom_finding_fields
 
 
 def test_set_active_finding_fields_rejects_a_value_that_is_not_finding_fields() -> None:
@@ -41,7 +37,7 @@ def test_set_active_finding_fields_rejects_a_value_that_is_not_finding_fields()
     assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
 
 
-def test_reset_restores_the_default() -> None:
-    set_active_finding_fields(finding_fields=CUSTOM, source="First")
+def test_reset_restores_the_default(custom_finding_fields: FindingFields) -> None:
+    set_active_finding_fields(finding_fields=custom_finding_fields, source="First")
     reset_active_finding_fields()
     assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
diff --git a/tests/unit/setup/test_findings_initializer.py b/tests/unit/setup/test_findings_initializer.py
index 5bf8cd1509..2150b83d82 100644
--- a/tests/unit/setup/test_findings_initializer.py
+++ b/tests/unit/setup/test_findings_initializer.py
@@ -7,7 +7,7 @@
 import pytest
 
 import pyrit.setup.initializers
-from pyrit.models import DEFAULT_FINDING_FIELDS, FindingField, FindingFields
+from pyrit.models import DEFAULT_FINDING_FIELDS, FindingFields
 from pyrit.registry import InitializerRegistry
 from pyrit.registry.discovery import discover_in_directory
 from pyrit.setup.finding_fields import get_active_finding_fields
@@ -16,10 +16,6 @@
 
 pytestmark = pytest.mark.usefixtures("reset_finding_fields")
 
-EXAMPLE = FindingFields(
-    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
-)
-
 CONTOSO_SCRIPT = '''
 from pyrit.models import FindingField, FindingFields
 from pyrit.setup.initializers import FindingsInitializer
@@ -35,22 +31,28 @@ def get_finding_fields(self) -> FindingFields:
 '''
 
 
-class ExampleFindingFields(FindingsInitializer):
-    """Example finding fields."""
+@pytest.fixture
+def example_initializer_class(custom_finding_fields: FindingFields) -> type[FindingsInitializer]:
+    class ExampleFindingFields(FindingsInitializer):
+        """Example finding fields."""
 
-    def get_finding_fields(self) -> FindingFields:
-        return EXAMPLE
+        def get_finding_fields(self) -> FindingFields:
+            return custom_finding_fields
+
+    return ExampleFindingFields
 
 
-async def test_findings_initializer_sets_the_active_fields() -> None:
-    await ExampleFindingFields().initialize_async()
-    assert get_active_finding_fields() is EXAMPLE
+async def test_findings_initializer_sets_the_active_fields(
+    example_initializer_class: type[FindingsInitializer], custom_finding_fields: FindingFields
+) -> None:
+    await example_initializer_class().initialize_async()
+    assert get_active_finding_fields() is custom_finding_fields
 
 
 @pytest.mark.usefixtures("patch_central_database")
-async def test_get_info_leaves_the_active_fields_alone() -> None:
-    await ExampleFindingFields.get_info_async()
-    info = await ExampleFindingFields.get_info_async()
+async def test_get_info_leaves_the_active_fields_alone(example_initializer_class: type[FindingsInitializer]) -> None:
+    await example_initializer_class.get_info_async()
+    info = await example_initializer_class.get_info_async()
 
     assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
     assert info["default_values"] == []
@@ -66,7 +68,7 @@ def test_findings_initializer_is_skipped_by_builtin_discovery() -> None:
     assert "FindingsInitializer" not in names
 
 
-async def test_discovery_copy_shares_the_active_finding_fields() -> None:
+async def test_discovery_copy_shares_the_active_finding_fields(custom_finding_fields: FindingFields) -> None:
     path = Path(pyrit.setup.initializers.__file__).parent / "findings.py"
     spec = importlib.util.spec_from_file_location("discovered_module.findings", path)
     copy = importlib.util.module_from_spec(spec)
@@ -74,10 +76,10 @@ async def test_discovery_copy_shares_the_active_finding_fields() -> None:
 
     class CopiedFindingFields(copy.FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
-            return EXAMPLE
+            return custom_finding_fields
 
     await CopiedFindingFields().initialize_async()
-    assert get_active_finding_fields() is EXAMPLE
+    assert get_active_finding_fields() is custom_finding_fields
 
 
 async def test_custom_script_subclass_sets_the_active_fields(tmp_path: Path) -> None:
diff --git a/tests/unit/setup/test_initialization.py b/tests/unit/setup/test_initialization.py
index 2f94efb109..9d0f66bcae 100644
--- a/tests/unit/setup/test_initialization.py
+++ b/tests/unit/setup/test_initialization.py
@@ -22,10 +22,6 @@
 from pyrit.setup.initializers import FindingsInitializer
 from pyrit.setup.pyrit_initializer import PyRITInitializer
 
-CUSTOM = FindingFields(
-    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
-)
-
 
 @pytest.mark.parametrize("existing_memory", [False, True])
 async def test_initializer_failure_closes_only_newly_installed_memory(
@@ -450,27 +446,26 @@ async def test_initialize_forwards_silent_to_memory(self, mock_load_environment,
         assert CentralMemory.get_memory_instance()._silent is silent
 
 
-class _SetsCustomFields(PyRITInitializer):
-    async def initialize_async(self) -> None:
-        set_active_finding_fields(finding_fields=CUSTOM, source="pass")
-
-
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
-async def test_each_setup_pass_resets_finding_fields() -> None:
+async def test_each_setup_pass_resets_finding_fields(custom_finding_fields: FindingFields) -> None:
+    class SetsCustomFields(PyRITInitializer):
+        async def initialize_async(self) -> None:
+            set_active_finding_fields(finding_fields=custom_finding_fields, source="pass")
+
     with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):
-        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[_SetsCustomFields()])
-        assert get_active_finding_fields() is CUSTOM
+        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[SetsCustomFields()])
+        assert get_active_finding_fields() is custom_finding_fields
 
-        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[_SetsCustomFields()])
-        assert get_active_finding_fields() is CUSTOM
+        await initialize_pyrit_async(memory_db_type=IN_MEMORY, initializers=[SetsCustomFields()])
+        assert get_active_finding_fields() is custom_finding_fields
 
         await initialize_pyrit_async(memory_db_type=IN_MEMORY, load_defaults=False)
         assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
 
 
 @pytest.mark.usefixtures("reset_finding_fields")
-async def test_reinitialize_resets_finding_fields() -> None:
-    set_active_finding_fields(finding_fields=CUSTOM, source="pass")
+async def test_reinitialize_resets_finding_fields(custom_finding_fields: FindingFields) -> None:
+    set_active_finding_fields(finding_fields=custom_finding_fields, source="pass")
     with (
         mock.patch.object(CentralMemory, "set_memory_instance"),
         mock.patch.object(initialization, "_execute_initializers_async", new_callable=mock.AsyncMock),
@@ -482,14 +477,14 @@ async def test_reinitialize_resets_finding_fields() -> None:
 
 
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
-async def test_second_findings_initializer_stops_setup() -> None:
+async def test_second_findings_initializer_stops_setup(custom_finding_fields: FindingFields) -> None:
     class FirstFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
-            return CUSTOM
+            return custom_finding_fields
 
     class SecondFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
-            return CUSTOM
+            return custom_finding_fields
 
     with mock.patch("pyrit.setup.initialization.load_environment_async", new_callable=mock.AsyncMock):
         with pytest.raises(
@@ -501,11 +496,11 @@ def get_finding_fields(self) -> FindingFields:
 
 
 @pytest.mark.usefixtures("reset_memory_singletons", "reset_finding_fields")
-async def test_invalid_finding_fields_stop_setup() -> None:
+async def test_invalid_finding_fields_stop_setup(custom_finding_fields: FindingFields) -> None:
     class BrokenFindingFields(FindingsInitializer):
         def get_finding_fields(self) -> FindingFields:
             return FindingFields(
-                severity=CUSTOM.severity,
+                severity=custom_finding_fields.severity,
                 fields=[FindingField(key="broken", label="Broken", type="choice", options=[])],
             )
 
diff --git a/tests/unit/setup/test_reinitialization.py b/tests/unit/setup/test_reinitialization.py
index 8950484163..4ca59bf4a6 100644
--- a/tests/unit/setup/test_reinitialization.py
+++ b/tests/unit/setup/test_reinitialization.py
@@ -16,7 +16,7 @@
 from pyrit.common.apply_defaults import get_global_default_values
 from pyrit.common.random_context import configure_random_seed, get_configured_random_seed
 from pyrit.memory import AzureSQLMemory, CentralMemory, SQLiteMemory
-from pyrit.models import FindingField, FindingFields
+from pyrit.models import FindingFields
 from pyrit.models.catalog import ScenarioSuite
 from pyrit.registry import (
     AttackRegistry,
@@ -32,9 +32,10 @@
 from pyrit.setup.initialization import reset_setup_registries, validate_reinitialization_memory
 from pyrit.setup.initializers.targets import TARGET_CONFIGS
 
-CUSTOM = FindingFields(
-    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
-)
+FINDINGS_SCRIPT_IMPORTS = """
+from pyrit.models import FindingField, FindingFields
+from pyrit.setup.initializers import FindingsInitializer
+"""
 
 
 @contextmanager
@@ -121,13 +122,11 @@ async def test_preflight_uses_isolated_registry_without_changing_live_state() ->
 
 
 @pytest.mark.usefixtures("reset_finding_fields")
-async def test_preflight_rejects_two_findings_initializers(tmp_path: Path) -> None:
-    script = tmp_path / "two_finding_fields.py"
-    script.write_text(
-        """
-from pyrit.models import FindingField, FindingFields
-from pyrit.setup.initializers import FindingsInitializer
-
+@pytest.mark.parametrize(
+    ("initializers", "message"),
+    [
+        pytest.param(
+            """
 SEVERITY = FindingField(key="severity", label="Severity", type="choice", options=[("sev1", "Sev 1")])
 
 class ContosoFindingFields(FindingsInitializer):
@@ -136,62 +135,41 @@ def get_finding_fields(self): return FindingFields(severity=SEVERITY)
 class ContosoBackupFields(FindingsInitializer):
     def get_finding_fields(self): return FindingFields(severity=SEVERITY)
 """,
-        encoding="utf-8",
-    )
-    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
-    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
-
-    message = (
-        "ContosoBackupFields and ContosoFindingFields both set the finding fields. "
-        "Use one FindingsInitializer per deployment."
-    )
-    with pytest.raises(ValueError, match=re.escape(message)):
-        await config.preflight_reinitialization_async(environment_values={})
-    assert get_active_finding_fields() is CUSTOM
-
-
-@pytest.mark.usefixtures("reset_finding_fields")
-async def test_preflight_rejects_invalid_finding_fields(tmp_path: Path) -> None:
-    script = tmp_path / "invalid_finding_fields.py"
-    script.write_text(
-        """
-from pyrit.models import FindingField, FindingFields
-from pyrit.setup.initializers import FindingsInitializer
-
+            "ContosoBackupFields and ContosoFindingFields both set the finding fields. "
+            "Use one FindingsInitializer per deployment.",
+            id="two initializers",
+        ),
+        pytest.param(
+            """
 class ContosoFindingFields(FindingsInitializer):
     def get_finding_fields(self):
         return FindingFields(severity=FindingField(key="severity", label="Severity", type="choice", options=[]))
 """,
-        encoding="utf-8",
-    )
-    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
-    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
-
-    with pytest.raises(ValueError, match="needs at least one option"):
-        await config.preflight_reinitialization_async(environment_values={})
-    assert get_active_finding_fields() is CUSTOM
-
-
-@pytest.mark.usefixtures("reset_finding_fields")
-async def test_preflight_rejects_finding_fields_of_the_wrong_type(tmp_path: Path) -> None:
-    script = tmp_path / "wrong_type_finding_fields.py"
-    script.write_text(
-        """
-from pyrit.setup.initializers import FindingsInitializer
-
+            "needs at least one option",
+            id="invalid fields",
+        ),
+        pytest.param(
+            """
 class ContosoFindingFields(FindingsInitializer):
     def get_finding_fields(self):
         return {}
 """,
-        encoding="utf-8",
-    )
+            "ContosoFindingFields.get_finding_fields() must return FindingFields, not dict.",
+            id="wrong type",
+        ),
+    ],
+)
+async def test_preflight_rejects_bad_finding_fields_and_keeps_the_active_ones(
+    tmp_path: Path, custom_finding_fields: FindingFields, initializers: str, message: str
+) -> None:
+    script = tmp_path / "contoso_finding_fields.py"
+    script.write_text(FINDINGS_SCRIPT_IMPORTS + initializers, encoding="utf-8")
     config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], initialization_scripts=[str(script)])
-    set_active_finding_fields(finding_fields=CUSTOM, source="ContosoRunning")
+    set_active_finding_fields(finding_fields=custom_finding_fields, source="ContosoRunning")
 
-    message = "ContosoFindingFields.get_finding_fields() must return FindingFields, not dict."
     with pytest.raises(ValueError, match=re.escape(message)):
         await config.preflight_reinitialization_async(environment_values={})
-    assert get_active_finding_fields() is CUSTOM
+    assert get_active_finding_fields() is custom_finding_fields
 
 
 @pytest.mark.usefixtures("patch_central_database")

From c414a366ed1338897a45f89383aeaa1a4eabdd30 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 14:33:15 -0400
Subject: [PATCH 14/20] Apply request limits to finding request fields

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pyrit/backend/models/operations.py       | 21 ++++++++++---
 tests/unit/backend/test_common_models.py | 39 ++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 5c6db559b4..0264d37816 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -7,6 +7,7 @@
 from pydantic import AnyHttpUrl, BaseModel, ConfigDict, Field, field_validator
 
 from pyrit.backend.models.attacks import ScoreView
+from pyrit.backend.models.common import MAX_ITEMS, IdentifierStr, TextStr
 from pyrit.models import (
     AttackOutcome,
     Finding,
@@ -59,7 +60,19 @@ class FindingListResponse(BaseModel):
     next_offset: int | None
 
 
-class FindingCreateRequest(FindingCreate):
+class _FindingRequestFields(FindingCreate):
+    """A finding's values as a request carries them, within the request limits."""
+
+    title: TextStr
+    severity: TextStr = Field(description="The key of a severity option, or Other text")
+    field_values: dict[IdentifierStr, TextStr] = Field(
+        default_factory=dict,
+        max_length=MAX_ITEMS,
+        description="Values by field or level key, each an option's key or text; blank values are dropped",
+    )
+
+
+class FindingCreateRequest(_FindingRequestFields):
     """
     A finding to record, optionally with one saved attack result as evidence.
 
@@ -71,11 +84,11 @@ class FindingCreateRequest(FindingCreate):
     attack_result_id: UUID | None = Field(None, description="A saved attack result to link as evidence")
 
 
-class FindingUpdateRequest(FindingCreate):
+class FindingUpdateRequest(_FindingRequestFields):
     """A finding's new editable values, and any retired values to remove."""
 
-    remove_retired_keys: list[str] = Field(
-        default_factory=list, description="Keys of the retired values to delete from the finding"
+    remove_retired_keys: list[IdentifierStr] = Field(
+        default_factory=list, max_length=MAX_ITEMS, description="Keys of the retired values to delete from the finding"
     )
 
 
diff --git a/tests/unit/backend/test_common_models.py b/tests/unit/backend/test_common_models.py
index 0e63b7958a..ed240ce1e7 100644
--- a/tests/unit/backend/test_common_models.py
+++ b/tests/unit/backend/test_common_models.py
@@ -37,6 +37,7 @@
 )
 from pyrit.backend.models.converters import ConverterPreviewRequest, CreateConverterRequest
 from pyrit.backend.models.initializers import RegisterInitializerRequest
+from pyrit.backend.models.operations import FindingCreateRequest, FindingUpdateRequest
 from pyrit.backend.models.scores import ManualScoreRequest
 from pyrit.backend.models.targets import CreateTargetRequest
 from pyrit.backend.models.techniques import CreateTechniqueRequest
@@ -441,6 +442,44 @@ def test_update_attack_request_expected_objective_is_not_length_limited() -> Non
     assert len(request.expected_objective or "") == MAX_TEXT_LENGTH + 1
 
 
+@pytest.mark.parametrize("model", [FindingCreateRequest, FindingUpdateRequest])
+@pytest.mark.parametrize(
+    "overrides",
+    [
+        {"title": "t" * (MAX_TEXT_LENGTH + 1)},
+        {"severity": "s" * (MAX_TEXT_LENGTH + 1)},
+        {"field_values": {"k" * (MAX_IDENTIFIER_LENGTH + 1): "value"}},
+        {"field_values": {"key": "v" * (MAX_TEXT_LENGTH + 1)}},
+        {"field_values": {f"key{i}": "value" for i in range(MAX_ITEMS + 1)}},
+    ],
+)
+def test_finding_requests_reject_values_over_limits(model: type[BaseModel], overrides: dict[str, object]) -> None:
+    with pytest.raises(ValidationError):
+        model.model_validate({"title": "Finding", "severity": "moderate", **overrides})
+
+
+@pytest.mark.parametrize(
+    "remove_retired_keys",
+    [["k" * (MAX_IDENTIFIER_LENGTH + 1)], [f"key{i}" for i in range(MAX_ITEMS + 1)]],
+)
+def test_finding_update_request_rejects_retired_keys_over_limits(remove_retired_keys: list[str]) -> None:
+    with pytest.raises(ValidationError):
+        FindingUpdateRequest(title="Finding", severity="moderate", remove_retired_keys=remove_retired_keys)
+
+
+def test_finding_update_request_accepts_values_at_limits() -> None:
+    keys = [f"{i:0{MAX_IDENTIFIER_LENGTH}d}" for i in range(MAX_ITEMS)]
+    request = FindingUpdateRequest(
+        title="t" * MAX_TEXT_LENGTH,
+        severity="s" * MAX_TEXT_LENGTH,
+        field_values={key: "v" * MAX_TEXT_LENGTH if key == keys[0] else "v" for key in keys},
+        remove_retired_keys=keys,
+    )
+
+    assert len(request.field_values) == MAX_ITEMS
+    assert len(request.remove_retired_keys) == MAX_ITEMS
+
+
 @pytest.mark.parametrize(
     "overrides",
     [

From 332fda9f22adb06ddde717b75a9a5aaf089efa75 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 29 Oct 2026 14:36:32 -0400
Subject: [PATCH 15/20] Scope internal finding fields to the Word and Markdown
 exports

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 doc/code/setup/finding_fields.md | 2 +-
 frontend/src/types/index.ts      | 2 +-
 pyrit/models/finding_fields.py   | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/code/setup/finding_fields.md b/doc/code/setup/finding_fields.md
index 43032a2365..fcbff996d0 100644
--- a/doc/code/setup/finding_fields.md
+++ b/doc/code/setup/finding_fields.md
@@ -55,7 +55,7 @@ A few things to note in this example:
 - Options are `(key, label)` pairs. The finding stores the `key`, and people see the `label`. Field and level keys use lowercase letters, digits and underscores. Option keys can be any text that isn't blank.
 - `Area` is a cascade. Each of its options maps to the options of a second dropdown. `levels` names that dropdown, and its value is stored under `subarea`.
 - `colors` sets the badge color of a severity option.
-- `internal=True` keeps `Contoso ticket` out of exports. The dashboard still shows it.
+- `internal=True` keeps `Contoso ticket` out of the Word and Markdown exports. The dashboard still shows it.
 
 `FindingField` also takes `hint`, `section` and `allow_other`. Its docstring describes each setting.
 
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 53aec5cbd4..ff546304c3 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -2239,7 +2239,7 @@ export interface FindingField {
   colors: Record<string, FindingSeverityColor>
   hint: string | null
   section: string | null
-  /** Shown on the dashboard but left out of exports. */
+  /** Shown on the dashboard but left out of the Word and Markdown exports. */
   internal: boolean
 }
 
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index 95aaf47f0f..d2d9b09fd9 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -64,7 +64,8 @@ class FindingField(BaseModel):
         colors (dict[str, FindingSeverityColor]): The severity slot's badge color for each top-level option.
         hint (str | None): Help text under the field in the finding dialog.
         section (str | None): A heading the finding dialog shows where the section changes.
-        internal (bool): Whether the field and its levels stay out of exports. The dashboard still shows them.
+        internal (bool): Whether the field and its levels stay out of the Word and Markdown exports. The dashboard
+            still shows them.
     """
 
     model_config = ConfigDict(extra="forbid", frozen=True)

From 52014f21656d1d73092e661d0cb895f95613e763 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Fri, 30 Oct 2026 13:21:48 -0400
Subject: [PATCH 16/20] Address review comments on finding field reloads and
 keys

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 doc/code/setup/finding_fields.md              |  1 +
 .../Chat/FindingEvidenceDialog.test.tsx       | 37 ++++++++++++++++---
 .../components/Chat/FindingEvidenceDialog.tsx |  4 +-
 .../Operations/OperationDetailPage.test.tsx   | 35 ++++++++++++++++--
 .../Operations/OperationDetailPage.tsx        |  4 +-
 frontend/src/hooks/useFindingFields.test.tsx  | 21 +++++++++++
 frontend/src/hooks/useFindingFields.ts        | 13 ++++++-
 pyrit/backend/models/operations.py            |  4 +-
 pyrit/models/finding.py                       | 21 ++++++++++-
 pyrit/models/finding_fields.py                |  7 +++-
 pyrit/setup/initializers/findings.py          |  4 +-
 tests/unit/backend/test_operations.py         |  2 +-
 tests/unit/models/test_finding.py             |  7 ++--
 tests/unit/models/test_finding_fields.py      |  2 +
 14 files changed, 137 insertions(+), 25 deletions(-)

diff --git a/doc/code/setup/finding_fields.md b/doc/code/setup/finding_fields.md
index fcbff996d0..c68d425ac2 100644
--- a/doc/code/setup/finding_fields.md
+++ b/doc/code/setup/finding_fields.md
@@ -75,6 +75,7 @@ With `allow_custom_initializers: true`, the backend runs every script in that so
 ## Rules
 
 - Use one `FindingsInitializer` per deployment. If the configuration lists two, or the fields are invalid, setup fails when the backend starts. The backend still runs, but it blocks runtime operations, including findings, until a process restart. Configuration repair stays available. A live apply reports invalid configuration instead, and the running fields don't change.
+- Don't make `get_finding_fields` depend on environment variables. A live apply checks the fields before it applies the new environment.
 - Change a field's `label` to rename what people see.
 - A changed `key` makes a new field. Values saved under the old key show under **Retired fields**, where they are read-only. Edits keep them. **Remove** deletes one when you save.
 - Other text that matches an option's key or label is rejected, ignoring case and surrounding spaces. The message names the option to choose instead.
diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
index 804d89ab04..0027b8f44c 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.test.tsx
@@ -5,8 +5,9 @@ import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter } from 'react-router'
 
 import { attacksApi, operationsApi } from '@/services/api'
+import { useRuntime } from '@/hooks/useRuntime'
 import { pick } from '@/test-utils/findingDialog'
-import { DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
+import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
 import type { FindingListItem } from '@/types'
 import FindingEvidenceDialog from './FindingEvidenceDialog'
 
@@ -17,6 +18,7 @@ jest.mock('@/services/api', () => ({
     getFindingFields: jest.fn(),
   },
 }))
+jest.mock('@/hooks/useRuntime', () => ({ ...jest.requireActual('@/hooks/useRuntime'), useRuntime: jest.fn() }))
 
 const FINDING: FindingListItem = {
   id: 'finding', operation_id: 'saved', title: 'Proof', severity: 'low', field_values: {},
@@ -38,15 +40,22 @@ function Harness({ disabled, ...props }: {
   </>
 }
 
-function renderDialog(defaultOperationId: string | null = null): void {
-  render(<FluentProvider theme={webLightTheme}><MemoryRouter>
-    <Harness attackResultId="viewed" disabled={false}
-      defaultOperationId={defaultOperationId} />
-  </MemoryRouter></FluentProvider>)
+/** Renders the dialog and returns a function that renders it again, as a context change would. */
+function renderDialog(defaultOperationId: string | null = null): () => void {
+  // A new element each time, so React renders the dialog again instead of keeping the previous output.
+  const tree = () => (
+    <FluentProvider theme={webLightTheme}><MemoryRouter>
+      <Harness attackResultId="viewed" disabled={false}
+        defaultOperationId={defaultOperationId} />
+    </MemoryRouter></FluentProvider>
+  )
+  const { rerender } = render(tree())
+  return () => { rerender(tree()) }
 }
 
 beforeEach(() => {
   jest.clearAllMocks()
+  jest.mocked(useRuntime).mockReturnValue({ ready: true, state: 'ready', generation: 'one' })
   for (const method of Object.values(operationsApi)) jest.mocked(method).mockReset()
   jest.mocked(attacksApi.getAttack).mockReset()
   ;(attacksApi.getAttack as jest.Mock).mockResolvedValue({ operation_id: 'saved', operation_name: 'Exact' })
@@ -76,6 +85,22 @@ it('defaults to the attack\'s own Operation and attaches the viewed attack', asy
   })
 })
 
+it('loads its findings again when a live apply changes the severity order while it is open', async () => {
+  const user = userEvent.setup()
+  const renderAgain = renderDialog()
+  const action = await screen.findByRole('button', { name: 'Link to finding' })
+  await waitFor(() => { expect(action).toBeEnabled() })
+  await user.click(action)
+  await screen.findByRole('radio', { name: /Proof/ })
+  const loads = jest.mocked(operationsApi.listFindings).mock.calls.length
+
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(CONTOSO_FINDING_FIELDS)
+  jest.mocked(useRuntime).mockReturnValue({ ready: true, state: 'ready', generation: 'two' })
+  await act(async () => { renderAgain() })
+  await waitFor(() => expect(operationsApi.listFindings).toHaveBeenCalledTimes(loads + 1))
+  expect(screen.getByRole('dialog')).toBeInTheDocument()
+})
+
 it.each([null, 'Exact'])('links an attack without an Operation ID (legacy name %s) using the selected Operation', async (
   operation: string | null,
 ) => {
diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
index 11c3118454..824fde4161 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
@@ -39,7 +39,7 @@ export default function FindingEvidenceDialog({
 }: FindingEvidenceDialogProps) {
   const styles = useFindingEvidenceDialogStyles()
   // `open` stays true while the embedded finding dialog replaces the picker, so this covers both.
-  const { fields, error: fieldsError, retry: retryFields } = useFindingFields(open)
+  const { fields, error: fieldsError, retry: retryFields, orderRevision } = useFindingFields(open)
   const viewKey = attackResultId
   const [defaultLookup, setDefaultLookup] = useState<{ key: string; operation: Operation | null } | null>(null)
   const [chosen, setChosen] = useState<{ key: string; operation: Operation } | null>(null)
@@ -71,7 +71,7 @@ export default function FindingEvidenceDialog({
   // Evidence can come from any attack; the user picks whose findings to link, defaulting to the attack's own Operation.
   const operation = chosen?.key === viewKey ? chosen.operation
     : defaultLookup?.key === viewKey ? defaultLookup.operation : null
-  const requestKey = JSON.stringify([attackResultId, operation?.id, title, offset, listRevision])
+  const requestKey = JSON.stringify([attackResultId, operation?.id, title, offset, listRevision, orderRevision])
   // A selection only applies to the attack and operation it was made for.
   const selectionKey = JSON.stringify([attackResultId, operation?.id])
   const selection = picked?.key === selectionKey ? picked.finding : null
diff --git a/frontend/src/components/Operations/OperationDetailPage.test.tsx b/frontend/src/components/Operations/OperationDetailPage.test.tsx
index 9844188500..0083e7530b 100644
--- a/frontend/src/components/Operations/OperationDetailPage.test.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.test.tsx
@@ -4,6 +4,7 @@ import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { MemoryRouter, Route, Routes } from 'react-router'
 
 import { attacksApi, operationsApi, scenariosApi } from '@/services/api'
+import { useRuntime } from '@/hooks/useRuntime'
 import { deferred } from '@/test-utils/deferred'
 import { findRemovalConfirmation, pick } from '@/test-utils/findingDialog'
 import { CONTOSO_FINDING_FIELDS, DEFAULT_FINDING_FIELDS_FIXTURE } from '@/test-utils/findingFieldsFixtures'
@@ -20,6 +21,7 @@ jest.mock('@/services/api', () => ({
   attacksApi: { listAttacks: jest.fn() },
   scenariosApi: { listRuns: jest.fn() },
 }))
+jest.mock('@/hooks/useRuntime', () => ({ ...jest.requireActual('@/hooks/useRuntime'), useRuntime: jest.fn() }))
 
 const SAVED: Operation = { id: 'op-1', name: 'Red team / α%', created_at: '2026-10-06T20:00:00Z' }
 const OPERATION: OperationDetail = { ...SAVED, usage: { findings: 0, attacks: 0, scenario_runs: 0 } }
@@ -31,8 +33,10 @@ const EMPTY = { items: [], has_more: false, next_offset: null }
 const NOT_FOUND = { isAxiosError: true, response: { status: 404, data: { detail: 'missing' } } }
 const conflict = (detail: object) => ({ isAxiosError: true, response: { status: 409, data: { detail } } })
 
-function renderPage(route = '/operations/op-1', onOperationChanged?: () => void): void {
-  render(
+/** Renders the page and returns a function that renders it again, as a context change would. */
+function renderPage(route = '/operations/op-1', onOperationChanged?: () => void): () => void {
+  // A new element each time, so React renders the page again instead of keeping the previous output.
+  const page = () => (
     <FluentProvider theme={webLightTheme}>
       <MemoryRouter initialEntries={[route]}>
         <Routes>
@@ -41,12 +45,15 @@ function renderPage(route = '/operations/op-1', onOperationChanged?: () => void)
             element={<OperationDetailPage onOperationChanged={onOperationChanged} />} />
         </Routes>
       </MemoryRouter>
-    </FluentProvider>,
+    </FluentProvider>
   )
+  const { rerender } = render(page())
+  return () => { rerender(page()) }
 }
 
 beforeEach(() => {
   jest.clearAllMocks()
+  jest.mocked(useRuntime).mockReturnValue({ ready: true, state: 'ready', generation: 'one' })
   jest.mocked(operationsApi.getFindingFields).mockResolvedValue(DEFAULT_FINDING_FIELDS_FIXTURE)
   jest.mocked(operationsApi.get).mockResolvedValue(OPERATION)
   jest.mocked(operationsApi.listFindings).mockResolvedValue(EMPTY)
@@ -619,3 +626,25 @@ it('pages through findings', async () => {
   expect(jest.mocked(operationsApi.listFindings).mock.calls.at(-1)).toEqual(['op-1', { limit: 20, offset: 20 }])
   expect(screen.getByText('Page 2')).toBeInTheDocument()
 })
+
+it('loads the shown page again only when a live apply changes the severity order', async () => {
+  jest.mocked(operationsApi.listFindings).mockResolvedValue({ ...EMPTY, items: [FINDING] })
+  const pageCalls = (): unknown[] =>
+    jest.mocked(operationsApi.listFindings).mock.calls.filter(([, params]) => params.limit === 20)
+  const renderAgain = renderPage('/operations/op-1?offset=20')
+  await screen.findByRole('heading', { level: 2, name: FINDING.title })
+  expect(pageCalls()).toHaveLength(1)
+
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue({ ...DEFAULT_FINDING_FIELDS_FIXTURE })
+  jest.mocked(useRuntime).mockReturnValue({ ready: true, state: 'ready', generation: 'two' })
+  await act(async () => { renderAgain() })
+  await waitFor(() => expect(operationsApi.getFindingFields).toHaveBeenCalledTimes(2))
+  await act(async () => {})
+  expect(pageCalls()).toHaveLength(1)
+
+  jest.mocked(operationsApi.getFindingFields).mockResolvedValue(CONTOSO_FINDING_FIELDS)
+  jest.mocked(useRuntime).mockReturnValue({ ready: true, state: 'ready', generation: 'three' })
+  await act(async () => { renderAgain() })
+  await waitFor(() => expect(pageCalls()).toHaveLength(2))
+  expect(pageCalls().at(-1)).toEqual(['op-1', { limit: 20, offset: 20 }])
+})
diff --git a/frontend/src/components/Operations/OperationDetailPage.tsx b/frontend/src/components/Operations/OperationDetailPage.tsx
index f83898cd7b..d226a9ffdd 100644
--- a/frontend/src/components/Operations/OperationDetailPage.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.tsx
@@ -40,7 +40,7 @@ export default function OperationDetailPage({ onOperationChanged }: OperationDet
 function OperationDetailContent({ operationId, onOperationChanged }: { operationId: string } & OperationDetailPageProps) {
   const styles = useOperationsStyles()
   const navigate = useNavigate()
-  const { fields, error: fieldsError, retry: retryFields } = useFindingFields()
+  const { fields, error: fieldsError, retry: retryFields, orderRevision } = useFindingFields()
   const [params, setParams] = useSearchParams()
   const rawOffset = Number(params.get('offset') ?? 0)
   const offset = Number.isSafeInteger(rawOffset) && rawOffset >= 0 ? rawOffset : 0
@@ -52,7 +52,7 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
   const [evidenceRevision, setEvidenceRevision] = useState(0)
   const [settledKey, setSettledKey] = useState('')
   const [error, setError] = useState('')
-  const requestKey = JSON.stringify([operationId, offset, revision])
+  const requestKey = JSON.stringify([operationId, offset, revision, orderRevision])
   const [notice, setNotice] = useState('')
   const [open, setOpen] = useState(false)
   const [editing, setEditing] = useState<Finding | null>(null)
diff --git a/frontend/src/hooks/useFindingFields.test.tsx b/frontend/src/hooks/useFindingFields.test.tsx
index 46889b7f89..d693707d45 100644
--- a/frontend/src/hooks/useFindingFields.test.tsx
+++ b/frontend/src/hooks/useFindingFields.test.tsx
@@ -51,6 +51,27 @@ describe('useFindingFields', () => {
     expect(result.current.error).toBe('')
   })
 
+  it('changes orderRevision only when a reload brings a different severity order', async () => {
+    mockGetFindingFields
+      .mockResolvedValueOnce(DEFAULT_FINDING_FIELDS_FIXTURE)
+      .mockResolvedValueOnce({ ...DEFAULT_FINDING_FIELDS_FIXTURE })
+      .mockResolvedValueOnce(CONTOSO_FINDING_FIELDS)
+
+    const { result, rerender } = renderHook(() => useFindingFields())
+    await waitFor(() => expect(result.current.fields).toBe(DEFAULT_FINDING_FIELDS_FIXTURE))
+    const loaded = result.current.orderRevision
+
+    mockRuntime.mockReturnValue({ ready: true, state: 'ready', generation: 'two' })
+    rerender()
+    await waitFor(() => expect(result.current.fields).not.toBe(DEFAULT_FINDING_FIELDS_FIXTURE))
+    expect(result.current.orderRevision).toBe(loaded)
+
+    mockRuntime.mockReturnValue({ ready: true, state: 'ready', generation: 'three' })
+    rerender()
+    await waitFor(() => expect(result.current.fields).toBe(CONTOSO_FINDING_FIELDS))
+    expect(result.current.orderRevision).not.toBe(loaded)
+  })
+
   it('reports a load failure and retries', async () => {
     mockGetFindingFields
       .mockRejectedValueOnce(new Error('The Contoso backend is unavailable.'))
diff --git a/frontend/src/hooks/useFindingFields.ts b/frontend/src/hooks/useFindingFields.ts
index 675e374447..aff249334a 100644
--- a/frontend/src/hooks/useFindingFields.ts
+++ b/frontend/src/hooks/useFindingFields.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useRef, useState } from 'react'
 
 import { operationsApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
@@ -12,6 +12,8 @@ interface FindingFieldsState {
   /** The last load failure, or an empty string. */
   readonly error: string
   readonly retry: () => void
+  /** Changes when a reload brings a different severity ranking, so lists can load their pages again. */
+  readonly orderRevision: number
 }
 
 /**
@@ -24,6 +26,8 @@ export function useFindingFields(enabled = true): FindingFieldsState {
   const [fields, setFields] = useState<FindingFields | null>(null)
   const [error, setError] = useState('')
   const [attempt, setAttempt] = useState(0)
+  const [orderRevision, setOrderRevision] = useState(0)
+  const loadedOrder = useRef<string | null>(null)
 
   useEffect(() => {
     if (!enabled) return
@@ -31,6 +35,11 @@ export function useFindingFields(enabled = true): FindingFieldsState {
     operationsApi.getFindingFields()
       .then((loaded: FindingFields) => {
         if (!ignore) {
+          const order = JSON.stringify(loaded.severity.options.map(({ key }) => key))
+          if (loadedOrder.current !== null && loadedOrder.current !== order) {
+            setOrderRevision((count: number) => count + 1)
+          }
+          loadedOrder.current = order
           setFields(loaded)
           setError('')
         }
@@ -48,5 +57,5 @@ export function useFindingFields(enabled = true): FindingFieldsState {
     setAttempt((count: number) => count + 1)
   }, [])
 
-  return { fields, error, retry }
+  return { fields, error, retry, orderRevision }
 }
diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 0264d37816..7b16f088c6 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -64,7 +64,9 @@ class _FindingRequestFields(FindingCreate):
     """A finding's values as a request carries them, within the request limits."""
 
     title: TextStr
-    severity: TextStr = Field(description="The key of a severity option, or Other text")
+    severity: TextStr = Field(
+        description="The key of a severity option, or Other text; surrounding whitespace is removed"
+    )
     field_values: dict[IdentifierStr, TextStr] = Field(
         default_factory=dict,
         max_length=MAX_ITEMS,
diff --git a/pyrit/models/finding.py b/pyrit/models/finding.py
index 335e8f2154..ccefd151d1 100644
--- a/pyrit/models/finding.py
+++ b/pyrit/models/finding.py
@@ -13,12 +13,12 @@ class FindingCreate(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
     title: str
-    severity: str = Field(description="The key of a severity option, or Other text")
+    severity: str = Field(description="The key of a severity option, or Other text; surrounding whitespace is removed")
     field_values: dict[str, str] = Field(
         {}, description="Values by field or level key, each an option's key or text; blank values are dropped"
     )
 
-    @field_validator("title", "severity")
+    @field_validator("title")
     @classmethod
     def _reject_blank(cls, value: str) -> str:
         """
@@ -34,6 +34,23 @@ def _reject_blank(cls, value: str) -> str:
             raise ValueError("Must not be blank.")
         return value
 
+    @field_validator("severity")
+    @classmethod
+    def _strip_severity(cls, value: str) -> str:
+        """
+        Remove surrounding whitespace and reject blank text.
+
+        Returns:
+            str: The severity without surrounding whitespace.
+
+        Raises:
+            ValueError: If the severity is blank.
+        """
+        stripped = value.strip()
+        if not stripped:
+            raise ValueError("Must not be blank.")
+        return stripped
+
     @field_validator("field_values")
     @classmethod
     def _drop_blank_values(cls, value: dict[str, str]) -> dict[str, str]:
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index d2d9b09fd9..7aa0b1b37f 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -116,13 +116,16 @@ def _validate_definition(self) -> Self:
 
     def _check_key(self, key: str) -> None:
         """
-        Require a key of lowercase letters, digits and underscores.
+        Require a key of lowercase letters, digits and underscores, other than ``__proto__``.
 
         Raises:
-            ValueError: If the key uses any other character or is empty.
+            ValueError: If the key uses any other character, is empty, or is ``__proto__``.
         """
         if not self._KEY_PATTERN.fullmatch(key):
             raise ValueError(f"Key '{key}' must use only lowercase letters, digits and underscores.")
+        # JavaScript objects treat this name as their prototype, so CoPyRIT couldn't keep a value under it.
+        if key == "__proto__":
+            raise ValueError("Key '__proto__' is reserved.")
 
     def _check_not_blank(self) -> None:
         """
diff --git a/pyrit/setup/initializers/findings.py b/pyrit/setup/initializers/findings.py
index 9b6e06c666..3fa98e82e3 100644
--- a/pyrit/setup/initializers/findings.py
+++ b/pyrit/setup/initializers/findings.py
@@ -17,7 +17,9 @@ class FindingsInitializer(PyRITInitializer):
     @abstractmethod
     def get_finding_fields(self) -> FindingFields:
         """
-        Return the deployment's finding fields.
+        Return the deployment's finding fields, the same whatever the environment variables.
+
+        A live apply checks these fields before it applies the new environment.
 
         Returns:
             FindingFields: The fields that setup makes active.
diff --git a/tests/unit/backend/test_operations.py b/tests/unit/backend/test_operations.py
index 5f6dbc05d1..4fb042c615 100644
--- a/tests/unit/backend/test_operations.py
+++ b/tests/unit/backend/test_operations.py
@@ -204,7 +204,7 @@ def test_finding_api_round_trips_field_values_and_drops_blanks(compatibility_hea
     response = client.post(path, json=body)
     assert response.status_code == 201
     finding = response.json()
-    assert finding["severity"] == "  Team severity  "
+    assert finding["severity"] == "Team severity"
     assert finding["field_values"] == {"harm_type": "Malware"}
     assert client.get(path).json()["items"] == [{**finding, "evidence_count": 0}]
     updated = client.put(f"{path}/{finding['id']}", json={"title": "Edited", "severity": "low"})
diff --git a/tests/unit/models/test_finding.py b/tests/unit/models/test_finding.py
index 0fb17a61f7..48dd7951a2 100644
--- a/tests/unit/models/test_finding.py
+++ b/tests/unit/models/test_finding.py
@@ -20,11 +20,12 @@ def test_finding_round_trips_severity_and_field_values() -> None:
     assert finding.created_at.utcoffset().total_seconds() == 0
 
 
-def test_finding_drops_blank_field_values_and_keeps_other_text_exactly() -> None:
+def test_finding_strips_severity_drops_blank_field_values_and_keeps_other_text_exactly() -> None:
     finding = FindingCreate(
-        title="Leak", severity="  Sev 2.5  ", field_values={"steps": "", "owner": "   ", "notes": "  kept  "}
+        title="  Leak  ", severity="  Sev 2.5  ", field_values={"steps": "", "owner": "   ", "notes": "  kept  "}
     )
-    assert finding.severity == "  Sev 2.5  "
+    assert finding.title == "  Leak  "
+    assert finding.severity == "Sev 2.5"
     assert finding.field_values == {"notes": "  kept  "}
 
 
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index 634399db79..e330494805 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -170,6 +170,8 @@ def test_finding_fields_rejects_invalid_definitions(severity: dict, fields: list
     ("field", "match"),
     [
         (_choice(levels=[("Feature", "Feature")], options=NESTED), "lowercase letters, digits and underscores"),
+        (_choice(key="__proto__"), "'__proto__' is reserved"),
+        (_choice(levels=[("__proto__", "Feature")], options=NESTED), "'__proto__' is reserved"),
         (_choice(options=[("chat", " ")]), "must not be blank"),
         (_choice(levels=[("feature", "Feature")], options={("chat", "Chat"): [(" ", "History")]}), "must not be blank"),
         ({"key": "notes", "label": "Notes", "type": "text", "default": "a"}, "cannot have default"),

From dfbd29fb8b3077a1a40688dce5c47d2a8a5983e4 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Tue, 3 Nov 2026 13:49:04 -0500
Subject: [PATCH 17/20] Address review comments on option keys, migrated
 severities and export reloads

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 doc/code/setup/finding_fields.md              |  2 +-
 .../Operations/FindingExportDialog.test.tsx   | 48 +++++++++++++++++--
 .../Operations/FindingExportDialog.tsx        | 15 ++++--
 .../Operations/OperationDetailPage.tsx        |  2 +-
 ...d43b1bcf9c56_store_finding_field_values.py | 36 ++++++++++++--
 pyrit/models/finding_fields.py                | 11 +++--
 .../test_finding_field_values_migration.py    | 22 ++++++++-
 tests/unit/models/test_finding_fields.py      |  6 +++
 8 files changed, 125 insertions(+), 17 deletions(-)

diff --git a/doc/code/setup/finding_fields.md b/doc/code/setup/finding_fields.md
index c68d425ac2..e97f083b9d 100644
--- a/doc/code/setup/finding_fields.md
+++ b/doc/code/setup/finding_fields.md
@@ -52,7 +52,7 @@ class ContosoFindingsInitializer(FindingsInitializer):
 
 A few things to note in this example:
 
-- Options are `(key, label)` pairs. The finding stores the `key`, and people see the `label`. Field and level keys use lowercase letters, digits and underscores. Option keys can be any text that isn't blank.
+- Options are `(key, label)` pairs. The finding stores the `key`, and people see the `label`. Field and level keys use lowercase letters, digits and underscores. Option keys can be any text that isn't blank and has no surrounding whitespace.
 - `Area` is a cascade. Each of its options maps to the options of a second dropdown. `levels` names that dropdown, and its value is stored under `subarea`.
 - `colors` sets the badge color of a severity option.
 - `internal=True` keeps `Contoso ticket` out of the Word and Markdown exports. The dashboard still shows it.
diff --git a/frontend/src/components/Operations/FindingExportDialog.test.tsx b/frontend/src/components/Operations/FindingExportDialog.test.tsx
index 88a8925d0b..aa213034a2 100644
--- a/frontend/src/components/Operations/FindingExportDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingExportDialog.test.tsx
@@ -48,7 +48,8 @@ const REVIEW_AGAIN = 'Review the list and download again.'
 function renderDialog(operation: Operation = OPERATION): ReturnType<typeof render> {
   return render(
     <FluentProvider theme={webLightTheme}>
-      <FindingExportDialog key={operation.id} operation={operation} fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
+      <FindingExportDialog key={operation.id} operation={operation} fields={DEFAULT_FINDING_FIELDS_FIXTURE}
+        orderRevision={0} />
     </FluentProvider>,
   )
 }
@@ -502,7 +503,7 @@ describe('FindingExportDialog', () => {
     view.rerender(
       <FluentProvider theme={webLightTheme}>
         <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION}
-          fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
+          fields={DEFAULT_FINDING_FIELDS_FIXTURE} orderRevision={0} />
       </FluentProvider>,
     )
     expect(jest.mocked(operationsApi.exportFindings).mock.calls[0][2]?.aborted).toBe(true)
@@ -524,7 +525,7 @@ describe('FindingExportDialog', () => {
     view.rerender(
       <FluentProvider theme={webLightTheme}>
         <FindingExportDialog key={OTHER_OPERATION.id} operation={OTHER_OPERATION}
-          fields={DEFAULT_FINDING_FIELDS_FIXTURE} />
+          fields={DEFAULT_FINDING_FIELDS_FIXTURE} orderRevision={0} />
       </FluentProvider>,
     )
     const dialog = await openDialog(user)
@@ -536,6 +537,47 @@ describe('FindingExportDialog', () => {
     expect(within(dialog).getByRole('checkbox', { name: other.title })).toBeChecked()
   })
 
+  it('loads every page again when the severity order changes, keeping the selection', async () => {
+    const user = userEvent.setup()
+    const delta = syntheticFinding(4, { title: 'Delta', severity: 'critical' })
+    const view = renderDialog(OPERATION)
+    const dialog = await openDialog(user)
+    await user.click(await within(dialog).findByRole('checkbox', { name: BETA.title }))
+    expect(within(dialog).getByRole('checkbox', { name: BETA.title })).not.toBeChecked()
+
+    jest.mocked(operationsApi.listFindings).mockResolvedValue(onePage([delta, GAMMA, ALPHA, BETA]))
+    view.rerender(
+      <FluentProvider theme={webLightTheme}>
+        <FindingExportDialog key={OPERATION.id} operation={OPERATION} fields={DEFAULT_FINDING_FIELDS_FIXTURE}
+          orderRevision={1} />
+      </FluentProvider>,
+    )
+    expect(await within(dialog).findByRole('checkbox', { name: delta.title })).not.toBeChecked()
+    expect(operationsApi.listFindings).toHaveBeenCalledTimes(2)
+    expect(operationsApi.listFindings).toHaveBeenLastCalledWith(OPERATION.id, { limit: 100, offset: 0 })
+    expect(within(dialog).getByRole('checkbox', { name: BETA.title })).not.toBeChecked()
+    expect(within(dialog).getByRole('checkbox', { name: ALPHA.title })).toBeChecked()
+    expect(within(dialog).getByRole('checkbox', { name: GAMMA.title })).toBeChecked()
+  })
+
+  it('selects every finding again after the severity order changes when every finding was selected', async () => {
+    const user = userEvent.setup()
+    jest.mocked(operationsApi.listFindings).mockResolvedValue(onePage([ALPHA, BETA]))
+    const view = renderDialog(OPERATION)
+    const dialog = await openDialog(user)
+    expect(await within(dialog).findByRole('checkbox', { name: 'Select all' })).toBeChecked()
+
+    jest.mocked(operationsApi.listFindings).mockResolvedValue(onePage([GAMMA, ALPHA, BETA]))
+    view.rerender(
+      <FluentProvider theme={webLightTheme}>
+        <FindingExportDialog key={OPERATION.id} operation={OPERATION} fields={DEFAULT_FINDING_FIELDS_FIXTURE}
+          orderRevision={1} />
+      </FluentProvider>,
+    )
+    expect(await within(dialog).findByRole('checkbox', { name: GAMMA.title })).toBeChecked()
+    expect(within(dialog).getByRole('checkbox', { name: 'Select all' })).toBeChecked()
+  })
+
   it('warns when selected findings have retired values', async () => {
     const user = userEvent.setup()
     const legacyAlpha = { ...ALPHA, field_values: { harm_type: 'Malware', contoso_ticket: 'CONTOSO-42' } }
diff --git a/frontend/src/components/Operations/FindingExportDialog.tsx b/frontend/src/components/Operations/FindingExportDialog.tsx
index 07267a80da..0d452599ec 100644
--- a/frontend/src/components/Operations/FindingExportDialog.tsx
+++ b/frontend/src/components/Operations/FindingExportDialog.tsx
@@ -50,9 +50,11 @@ interface FindingExportDialogProps {
   operation: Operation
   /** The active finding fields, which decide the severity badges and which stored values are retired. */
   fields: FindingFields
+  /** Changes when the severity ranking changes, which loads every page again. */
+  orderRevision: number
 }
 
-export default function FindingExportDialog({ operation, fields }: FindingExportDialogProps) {
+export default function FindingExportDialog({ operation, fields, orderRevision }: FindingExportDialogProps) {
   const styles = useFindingExportDialogStyles()
   const [open, setOpen] = useState(false)
   const [loadRevision, setLoadRevision] = useState(0)
@@ -65,6 +67,8 @@ export default function FindingExportDialog({ operation, fields }: FindingExport
   const [exporting, setExporting] = useState(false)
   const submitting = useRef(false)
   const recovery = useRef<SelectionRecovery | null>(null)
+  // The IDs of the last list loaded since the dialog opened. A reload ticks every row only if all of these were ticked.
+  const shown = useRef<ReadonlySet<string> | null>(null)
   const triggerRef = useRef<HTMLButtonElement>(null)
   const rowId = useId()
   // Aborted when the dialog closes or unmounts, so a late export never downloads into a later view.
@@ -111,8 +115,12 @@ export default function FindingExportDialog({ operation, fields }: FindingExport
       setRecovering(false)
       const kept = recovery.current
       recovery.current = null
+      const previous = shown.current
+      shown.current = new Set(loaded.keys())
       if (kept === null) {
-        setSelected(new Set(loaded.keys()))
+        setSelected(current => (previous === null || [...previous].every(findingId => current.has(findingId))
+          ? new Set(loaded.keys())
+          : new Set([...current].filter(findingId => loaded.has(findingId)))))
         return
       }
       setSelected(new Set(kept.selected.filter(finding => loaded.has(finding.id)).map(finding => finding.id)))
@@ -126,11 +134,12 @@ export default function FindingExportDialog({ operation, fields }: FindingExport
       setRecovering(false)
     })
     return () => { ignore = true }
-  }, [open, loadRevision, operation.id])
+  }, [open, loadRevision, operation.id, orderRevision])
 
   const start = (): void => {
     submitting.current = false
     recovery.current = null
+    shown.current = null
     setRecovering(false)
     setExporting(false)
     setExportError('')
diff --git a/frontend/src/components/Operations/OperationDetailPage.tsx b/frontend/src/components/Operations/OperationDetailPage.tsx
index f8f063807f..1420f4a57e 100644
--- a/frontend/src/components/Operations/OperationDetailPage.tsx
+++ b/frontend/src/components/Operations/OperationDetailPage.tsx
@@ -209,7 +209,7 @@ function OperationDetailContent({ operationId, onOperationChanged }: { operation
               void navigate('/operations')
             }} />
           {fields !== null && <FindingExportDialog key={current.operation.id} operation={current.operation}
-            fields={fields} />}
+            fields={fields} orderRevision={orderRevision} />}
           <Button ref={newFindingRef} appearance="primary" className={styles.button} icon={<AddRegular />}
             disabled={fields === null} onClick={event => {
               returnFocusRef.current = event.currentTarget
diff --git a/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py b/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
index 9000fb0ccf..49f63af9bb 100644
--- a/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
+++ b/pyrit/memory/alembic/versions/d43b1bcf9c56_store_finding_field_values.py
@@ -5,27 +5,32 @@
 Store each finding as a severity plus a JSON object of field values.
 
 Drops the three classification CHECK constraints on ``FindingEntries``, makes ``severity`` unbounded Unicode
-(binary-collated on SQL Server), replaces an Other severity with its custom text, and moves the harm type (its
-custom text when it is Other) and any description that isn't empty or only spaces into the new ``field_values``
-column. Finding IDs, Operation links, creation times, and evidence links do not change. Downgrading restores the
-old columns only while no findings exist.
+(binary-collated on SQL Server), replaces an Other severity with its custom text without surrounding whitespace, and
+moves the harm type (its custom text when it is Other) and any description that isn't empty or only spaces into the
+new ``field_values`` column. Finding IDs, Operation links, creation times, and evidence links do not change.
+Downgrading restores the old columns only while no findings exist.
 
 Revision ID: d43b1bcf9c56
 Revises: e7c4a2d9f013
 Create Date: 2026-10-27 12:00:00.000000
 """
 
+import logging
 from collections.abc import Sequence  # noqa: TC003
 
 import sqlalchemy as sa
 from alembic import op
 
+from pyrit.memory.memory_models import CustomUUID
+
 # revision identifiers, used by Alembic.
 revision: str = "d43b1bcf9c56"
 down_revision: str | None = "e7c4a2d9f013"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 
+logger = logging.getLogger(__name__)
+
 _SEVERITY_TYPE = sa.Unicode().with_variant(sa.Unicode(collation="Latin1_General_100_BIN2"), "mssql")
 _HARM_TYPE_SQL = "CASE WHEN harm_type = 'Other' THEN harm_type_other ELSE harm_type END"
 _DESCRIPTION_SQL = "CASE WHEN LTRIM(RTRIM(description)) = '' THEN NULL ELSE description END"
@@ -53,6 +58,7 @@ def upgrade() -> None:
         batch_op.add_column(sa.Column("field_values", sa.JSON(), nullable=True))
         batch_op.alter_column("severity", existing_type=sa.String(32), type_=_SEVERITY_TYPE, existing_nullable=False)
     op.execute(sa.text("UPDATE FindingEntries SET severity = severity_other WHERE LOWER(severity) = 'other'"))
+    _strip_custom_severities()
     op.execute(sa.text(f"UPDATE FindingEntries SET field_values = {_field_values_sql()}"))
     with op.batch_alter_table("FindingEntries") as batch_op:
         batch_op.alter_column("field_values", existing_type=sa.JSON(), nullable=False)
@@ -60,6 +66,28 @@ def upgrade() -> None:
             batch_op.drop_column(column)
 
 
+def _strip_custom_severities() -> None:
+    """
+    Remove the surrounding whitespace from each severity copied from Other text, as new findings have it removed.
+
+    SQL trimming keeps tabs, line breaks and non-breaking spaces, so Python strips the text instead.
+    """
+    if op.get_context().as_sql:
+        logger.warning("Skipping custom severity trimming: offline SQL generation cannot read existing findings.")
+        return
+    bind = op.get_bind()
+    findings = sa.table(
+        "FindingEntries",
+        sa.column("id", CustomUUID()),
+        sa.column("severity", sa.Unicode()),
+        sa.column("severity_other", sa.Unicode()),
+    )
+    custom = sa.select(findings.c.id, findings.c.severity).where(findings.c.severity_other.is_not(None))
+    for finding_id, severity in bind.execute(custom).all():
+        if severity != severity.strip():
+            bind.execute(findings.update().where(findings.c.id == finding_id).values(severity=severity.strip()))
+
+
 def _field_values_sql() -> str:
     """
     Build the dialect's SQL expression for a JSON object of harm type and description, leaving out NULL values.
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index 7aa0b1b37f..2b25eae09b 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -129,16 +129,21 @@ def _check_key(self, key: str) -> None:
 
     def _check_not_blank(self) -> None:
         """
-        Require non-blank labels, option keys and option labels.
+        Require non-blank labels, option keys and option labels, and option keys without surrounding whitespace.
 
         Raises:
-            ValueError: If any of them is blank.
+            ValueError: If any of them is blank, or an option key has surrounding whitespace.
         """
+        options = list(_walk(self.options))
         texts = [self.label, *(label for _, label in self.levels)]
-        for option in _walk(self.options):
+        for option in options:
             texts += [option.key, option.label]
         if any(not text.strip() for text in texts):
             raise ValueError(f"Labels, option keys and option labels of '{self.key}' must not be blank.")
+        # Saved severities lose surrounding whitespace, so a padded key could never be chosen.
+        padded = next((option.key for option in options if option.key != option.key.strip()), None)
+        if padded is not None:
+            raise ValueError(f"Option key {padded!r} of '{self.key}' has surrounding whitespace.")
 
     def _check_no_choice_settings(self) -> None:
         """
diff --git a/tests/unit/memory/test_finding_field_values_migration.py b/tests/unit/memory/test_finding_field_values_migration.py
index 45dbe532c6..bad10ae242 100644
--- a/tests/unit/memory/test_finding_field_values_migration.py
+++ b/tests/unit/memory/test_finding_field_values_migration.py
@@ -142,6 +142,23 @@ def test_upgrade_moves_an_other_severity_stored_in_any_case() -> None:
         engine.dispose()
 
 
+@pytest.mark.parametrize("custom_text", ["  Review  ", "\tReview\n", "\u00a0Review\u00a0"])
+def test_upgrade_removes_surrounding_whitespace_from_other_severity_text(custom_text: str) -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config_for(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            _insert_operation(connection)
+            _insert_finding(connection=connection, id=A, severity="other", severity_other=custom_text, description="")
+
+            command.upgrade(config, REVISION)
+
+            assert connection.execute(sa.text("SELECT severity FROM FindingEntries")).scalar_one() == "Review"
+    finally:
+        engine.dispose()
+
+
 def test_upgrade_drops_the_finding_check_constraints() -> None:
     engine = sa.create_engine("sqlite:///:memory:")
     try:
@@ -186,19 +203,20 @@ def test_downgrade_refuses_offline() -> None:
         _migration().downgrade()
 
 
-def test_upgrade_compiles_for_sql_server() -> None:
+def test_upgrade_compiles_for_sql_server(caplog: pytest.LogCaptureFixture) -> None:
     output = io.StringIO()
     context = MigrationContext.configure(dialect_name="mssql", opts={"as_sql": True, "output_buffer": output})
     with Operations.context(context):
         _migration().upgrade()
     ddl = output.getvalue()
+    assert "Skipping custom severity trimming" in caplog.text
     assert _migration().down_revision == "e7c4a2d9f013"
     for name in CHECKS:
         assert f"DROP CONSTRAINT {name}" in ddl
     drops = [match.start() for match in re.finditer("DROP CONSTRAINT", ddl)]
     assert len(drops) == 3 and max(drops) < ddl.index("ALTER COLUMN severity")
     assert "COLLATE Latin1_General_100_BIN2" in ddl
-    assert "WHERE LOWER(severity) = 'other'" in ddl
+    assert "SET severity = severity_other WHERE LOWER(severity) = 'other'" in ddl
     assert "JSON_MODIFY" in ddl
     for column in ("description", "severity_other", "harm_type", "harm_type_other"):
         assert f"DROP COLUMN {column}" in ddl
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index e330494805..f281b29c88 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -159,6 +159,7 @@ def _choice(**overrides: object) -> dict[str, object]:
         (SEVERITY, [_choice(levels=[("severity", "Severity")], options=NESTED)], "'severity' is used more than once"),
         (SEVERITY, [_choice(key="title")], "'title' is reserved"),
         (SEVERITY, [_choice(label=" ")], "must not be blank"),
+        ({**SEVERITY, "options": [("high ", "High")]}, [], "surrounding whitespace"),
     ],
 )
 def test_finding_fields_rejects_invalid_definitions(severity: dict, fields: list, match: str) -> None:
@@ -173,6 +174,11 @@ def test_finding_fields_rejects_invalid_definitions(severity: dict, fields: list
         (_choice(key="__proto__"), "'__proto__' is reserved"),
         (_choice(levels=[("__proto__", "Feature")], options=NESTED), "'__proto__' is reserved"),
         (_choice(options=[("chat", " ")]), "must not be blank"),
+        (_choice(options=[(" chat", "Chat")]), "surrounding whitespace"),
+        (
+            _choice(levels=[("feature", "Feature")], options={("chat", "Chat"): [("history ", "History")]}),
+            "surrounding whitespace",
+        ),
         (_choice(levels=[("feature", "Feature")], options={("chat", "Chat"): [(" ", "History")]}), "must not be blank"),
         ({"key": "notes", "label": "Notes", "type": "text", "default": "a"}, "cannot have default"),
         (_choice(options={"chat": []}), r"\(key, label\) pair"),

From d01f275dc72e5a4745c51c896190b6e513f81c7d Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Thu, 5 Nov 2026 14:21:27 -0500
Subject: [PATCH 18/20] Let multiline finding values use the available width

---
 frontend/src/components/Operations/Operations.styles.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/components/Operations/Operations.styles.ts b/frontend/src/components/Operations/Operations.styles.ts
index 8c42a1bf5e..ed0d573caa 100644
--- a/frontend/src/components/Operations/Operations.styles.ts
+++ b/frontend/src/components/Operations/Operations.styles.ts
@@ -57,7 +57,7 @@ export const useOperationsStyles = makeStyles({
     gap: tokens.spacingHorizontalM,
     marginTop: tokens.spacingVerticalS,
   },
-  description: { whiteSpace: 'pre-wrap', maxWidth: '75ch', marginBottom: 0 },
+  description: { whiteSpace: 'pre-wrap', marginBottom: 0 },
   values: {
     display: 'flex',
     flexDirection: 'column',
@@ -75,7 +75,7 @@ export const useOperationsStyles = makeStyles({
     gap: tokens.spacingVerticalXS,
   },
   retiredKey: { fontFamily: tokens.fontFamilyMonospace, fontSize: tokens.fontSizeBase200 },
-  retiredValue: { margin: 0, whiteSpace: 'pre-wrap', maxWidth: '75ch' },
+  retiredValue: { margin: 0, whiteSpace: 'pre-wrap' },
   notice: { flexShrink: 0 },
   table: {
     minWidth: '100%',

From c4f362e9a480d2e2401f2b8d94c9c86d8c9b3b57 Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Tue, 10 Nov 2026 16:33:56 -0500
Subject: [PATCH 19/20] Address review comments on per-run findings
 initializers and optional cascade levels

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../Operations/FindingFieldInput.test.tsx     | 40 ++++++++++++++-----
 .../Operations/FindingFieldInput.tsx          |  2 +-
 .../backend/services/scenario_run_service.py  | 19 ++++++++-
 .../unit/backend/test_scenario_run_service.py | 29 ++++++++++++++
 4 files changed, 77 insertions(+), 13 deletions(-)

diff --git a/frontend/src/components/Operations/FindingFieldInput.test.tsx b/frontend/src/components/Operations/FindingFieldInput.test.tsx
index a69d1980f1..8210eeb471 100644
--- a/frontend/src/components/Operations/FindingFieldInput.test.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.test.tsx
@@ -232,7 +232,7 @@ describe('FindingFieldInput', () => {
     expect(optionNames()).toEqual(['System prompt leak', 'Tool misuse'])
   })
 
-  it('offers Not set only on optional fields', async () => {
+  it('offers Not set on every level of optional fields only', async () => {
     const user = userEvent.setup()
     render(<TestWrapper>
       <FieldHarness field={TECHNIQUE} initialValues={{ technique: 'role_play' }} onChange={onChange} />
@@ -240,16 +240,17 @@ describe('FindingFieldInput', () => {
       <FindingFieldInput field={{ ...SURFACE, required: false }} values={{ surface: 'web_chat' }} onChange={onChange} />
     </TestWrapper>)
 
-    await openPicker(user, 'Category')
-    expect(screen.queryByRole('option', { name: 'Not set' })).not.toBeInTheDocument()
-    await user.keyboard('{Escape}')
+    for (const label of ['Category', 'Subcategory']) {
+      await openPicker(user, label)
+      expect(screen.queryByRole('option', { name: 'Not set' })).not.toBeInTheDocument()
+      await user.keyboard('{Escape}')
+    }
 
-    await openPicker(user, 'Surface')
-    expect(screen.getByRole('option', { name: 'Not set' })).toBeInTheDocument()
-    await user.keyboard('{Escape}')
-    await openPicker(user, 'Component')
-    expect(screen.queryByRole('option', { name: 'Not set' })).not.toBeInTheDocument()
-    await user.keyboard('{Escape}')
+    for (const label of ['Surface', 'Component']) {
+      await openPicker(user, label)
+      expect(screen.getByRole('option', { name: 'Not set' })).toBeInTheDocument()
+      await user.keyboard('{Escape}')
+    }
 
     await pick(user, 'Technique', 'Not set')
     expect(onChange).toHaveBeenLastCalledWith({ technique: '' })
@@ -355,6 +356,25 @@ describe('FindingFieldInput', () => {
     expect(screen.getByRole('combobox', { name: 'Capability' })).toBeDisabled()
   })
 
+  it('returns an optional lower level to Not set and keeps the levels above it', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <FieldHarness field={{ ...SURFACE, required: false }}
+        initialValues={{ surface: 'web_chat', component: 'plugins', capability: 'email' }} onChange={onChange} />
+    </TestWrapper>)
+
+    await pick(user, 'Capability', 'Not set')
+    expect(onChange).toHaveBeenLastCalledWith({ capability: '' })
+    expect(screen.getByRole('combobox', { name: 'Component' })).toHaveValue('Plugins')
+    expect(screen.getByRole('combobox', { name: 'Capability' })).toHaveValue('')
+
+    await pick(user, 'Capability', 'Email')
+    await pick(user, 'Component', 'Not set')
+    expect(onChange).toHaveBeenLastCalledWith({ component: '', capability: '' })
+    expect(screen.getByRole('combobox', { name: 'Surface' })).toHaveValue('Web chat')
+    expect(screen.getByRole('combobox', { name: 'Capability' })).toBeDisabled()
+  })
+
   it('ignores inherited members for a field keyed constructor and an option keyed toString', async () => {
     const user = userEvent.setup()
     const field: FindingField = {
diff --git a/frontend/src/components/Operations/FindingFieldInput.tsx b/frontend/src/components/Operations/FindingFieldInput.tsx
index 6a0bf1d409..fa271eb8ea 100644
--- a/frontend/src/components/Operations/FindingFieldInput.tsx
+++ b/frontend/src/components/Operations/FindingFieldInput.tsx
@@ -171,7 +171,7 @@ function ChoiceFieldInput({
         return (
           <ChoiceLevelPicker key={level.key} label={level.label} hint={state.hint} required={state.required}
             disabled={disabled || state.unavailable} options={state.options} selected={state.selected}
-            offerNotSet={depth === 0 && !field.required} offerOther={allowOther}
+            offerNotSet={!field.required} offerOther={allowOther}
             onSelect={(optionValue: string) => { select(depth, optionValue) }} />
         )
       })}
diff --git a/pyrit/backend/services/scenario_run_service.py b/pyrit/backend/services/scenario_run_service.py
index ed3b7d5aba..d9285a1e1f 100644
--- a/pyrit/backend/services/scenario_run_service.py
+++ b/pyrit/backend/services/scenario_run_service.py
@@ -20,7 +20,7 @@
 from contextvars import ContextVar
 from dataclasses import dataclass, replace
 from datetime import UTC, datetime
-from typing import Any, Literal
+from typing import TYPE_CHECKING, Any, Literal
 from urllib.parse import urlsplit, urlunsplit
 
 from pydantic import TypeAdapter, ValidationError
@@ -103,6 +103,10 @@
 from pyrit.registry.resolution import reject_non_external_params, resolve_declared_params
 from pyrit.scenario import IncompatibleTechniquePolicy, Scenario
 from pyrit.scenario.core import get_default_adversarial_target, override_default_adversarial_target
+from pyrit.setup.initializers import FindingsInitializer
+
+if TYPE_CHECKING:
+    from pyrit.setup.pyrit_initializer import PyRITInitializer
 
 logger = logging.getLogger(__name__)
 
@@ -1609,16 +1613,20 @@ async def _run_initializers_async(self, *, request: RunScenarioRequest) -> None:
         """
         Validate and execute initializers specified in the request.
 
+        Every initializer is built before any runs, so a rejected request changes nothing.
+
         Args:
             request: The run request containing initializer names and args.
 
         Raises:
-            ValueError: If an initializer name is not found in the registry.
+            ValueError: If an initializer name is not found in the registry, or an initializer sets the
+                deployment's finding fields, which only setup from ``.pyrit_conf`` may do.
         """
         if not request.initializers:
             return
 
         initializer_registry = await run_legacy_sync_async(InitializerRegistry.get_registry_singleton)
+        instances: list[PyRITInitializer] = []
         for initializer_name in request.initializers:
             initializer_params = (request.initializer_args or {}).get(initializer_name)
             try:
@@ -1627,6 +1635,13 @@ async def _run_initializers_async(self, *, request: RunScenarioRequest) -> None:
                 )
             except KeyError as e:
                 raise ValueError(f"Initializer not found: {e}") from None
+            if isinstance(instance, FindingsInitializer):
+                raise ValueError(
+                    f"Initializer '{initializer_name}' sets the deployment's finding fields, so it can run only "
+                    "from .pyrit_conf, not for one scenario run."
+                )
+            instances.append(instance)
+        for instance in instances:
             await instance.initialize_async()
 
     async def _initialize_scenario_async(
diff --git a/tests/unit/backend/test_scenario_run_service.py b/tests/unit/backend/test_scenario_run_service.py
index 26659b32d3..2f10c85bfc 100644
--- a/tests/unit/backend/test_scenario_run_service.py
+++ b/tests/unit/backend/test_scenario_run_service.py
@@ -35,6 +35,7 @@
 )
 from pyrit.memory.memory_models import ScenarioResultEntry
 from pyrit.models import (
+    DEFAULT_FINDING_FIELDS,
     SCENARIO_RUN_PLAN_METADATA_KEY,
     SCENARIO_SUITE_EXECUTION_METADATA_KEY,
     AtomicAttackIdentifier,
@@ -43,6 +44,8 @@
     AttackSeedGroup,
     AttackTechniqueIdentifier,
     ComponentIdentifier,
+    FindingField,
+    FindingFields,
     Operation,
     RetryEvent,
     ScenarioAttackResultDelta,
@@ -73,6 +76,9 @@
 )
 from pyrit.scenario.core.dataset_overrides import apply_dataset_overrides
 from pyrit.scenario.scenarios.airt import Jailbreak, Scam
+from pyrit.setup.finding_fields import get_active_finding_fields
+from pyrit.setup.initializers import FindingsInitializer
+from pyrit.setup.pyrit_initializer import PyRITInitializer
 from unit.async_utils import wait_for_completion_async
 from unit.mocks import (
     MockPromptTarget,
@@ -1728,6 +1734,29 @@ async def test_start_run_runs_initializers(self, mock_all_registries) -> None:
         assert response.status == ScenarioRunState.IN_PROGRESS
         assert mock_init_instance.initialize_async.await_count == 2
 
+    @pytest.mark.usefixtures("reset_finding_fields")
+    async def test_start_run_rejects_a_findings_initializer_before_running_any(self, mock_all_registries) -> None:
+        """A run that names a FindingsInitializer runs no initializers and leaves the finding fields alone."""
+
+        class ContosoFindingFields(FindingsInitializer):
+            def get_finding_fields(self) -> FindingFields:
+                return FindingFields(
+                    severity=FindingField(key="severity", label="Severity", type="choice", options=[("high", "High")])
+                )
+
+        service = ScenarioRunService()
+        target_initializer = MagicMock(spec=PyRITInitializer)
+        mock_all_registries["initializer_registry"].create_and_configure.side_effect = [
+            target_initializer,
+            ContosoFindingFields(),
+        ]
+
+        with pytest.raises(ValueError, match="'contoso_findings' sets the deployment's finding fields"):
+            await service.start_run_async(request=_make_request(initializers=["target", "contoso_findings"]))
+
+        target_initializer.initialize_async.assert_not_awaited()
+        assert get_active_finding_fields() is DEFAULT_FINDING_FIELDS
+
     async def test_start_run_passes_scenario_result_id_for_resume(self, mock_all_registries) -> None:
         """Test that scenario_result_id is passed to the registry for resumption."""
         service = ScenarioRunService()

From b3b5b6bda5716d1ea112c97736fce5870e16e85c Mon Sep 17 00:00:00 2001
From: Adrian Gavrila <adrian-gavrila@outlook.com>
Date: Wed, 11 Nov 2026 17:59:04 -0500
Subject: [PATCH 20/20] Move retired-value edit rules into FindingFields and
 match evidence errors by full path

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../Operations/FindingDialog.test.tsx         | 28 ++++++++++++
 .../components/Operations/FindingDialog.tsx   | 10 +++--
 pyrit/backend/services/operation_service.py   | 35 +--------------
 pyrit/models/finding_fields.py                | 40 ++++++++++++++++-
 .../test_operation_service_findings.py        | 30 +------------
 tests/unit/models/test_finding_fields.py      | 43 +++++++++++++++++++
 6 files changed, 119 insertions(+), 67 deletions(-)

diff --git a/frontend/src/components/Operations/FindingDialog.test.tsx b/frontend/src/components/Operations/FindingDialog.test.tsx
index e9d947aa6c..c092737868 100644
--- a/frontend/src/components/Operations/FindingDialog.test.tsx
+++ b/frontend/src/components/Operations/FindingDialog.test.tsx
@@ -497,4 +497,32 @@ describe('FindingDialog', () => {
       expect(save).toBeEnabled()
     }
   })
+
+  it('keeps an error on a deployment field keyed attack_result_id off the Evidence attack ID', async () => {
+    const user = userEvent.setup()
+    const fields: FindingFields = {
+      ...DEFAULT_FINDING_FIELDS_FIXTURE,
+      fields: DEFAULT_FINDING_FIELDS_FIXTURE.fields.map(field => (field.key === 'description'
+        ? { ...field, key: 'attack_result_id', label: 'Attack notes' } : field)),
+    }
+    const message = 'String should have at most 100000 characters'
+    const onSave = jest.fn().mockRejectedValue(Object.assign(new Error('Request failed'), {
+      isAxiosError: true,
+      response: {
+        status: 422,
+        data: {
+          detail: 'Request validation failed',
+          errors: [{ field: 'body.field_values.attack_result_id', message, code: 'string_too_long' }],
+        },
+      },
+    }))
+    renderDialog({
+      fields, evidenceField: true, onSave, initialValues: { title: 'Assessment', severity: 'low', field_values: {} },
+    })
+    await user.click(saveButton())
+
+    expect(await screen.findByText(`field_values.attack_result_id: ${message}`)).toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: 'Evidence attack ID' })).not.toHaveAttribute('aria-invalid', 'true')
+    expect(saveButton()).toBeEnabled()
+  })
 })
diff --git a/frontend/src/components/Operations/FindingDialog.tsx b/frontend/src/components/Operations/FindingDialog.tsx
index 4c6ef3ed3b..b234a97de2 100644
--- a/frontend/src/components/Operations/FindingDialog.tsx
+++ b/frontend/src/components/Operations/FindingDialog.tsx
@@ -5,7 +5,7 @@ import {
   Field, Input, MessageBar, MessageBarBody, Text,
 } from '@fluentui/react-components'
 
-import { toApiError } from '@/services/errors'
+import { type FieldError, toApiError } from '@/services/errors'
 import type { FindingCreate, FindingField, FindingFields } from '@/types'
 import { generateClientId } from '@/utils/clientId'
 import { firstMissingRequired, type RetiredValue, SEVERITY_KEY, splitRetiredValues } from '@/utils/findingFields'
@@ -140,9 +140,11 @@ export default function FindingDialog({
       await onSave(finding, { id: attempt.current.id, attackResultId: trimmedAttackResultId })
     } catch (cause: unknown) {
       const apiError = toApiError(cause)
-      const evidenceMessages = apiError.fieldErrors.filter(item => evidenceField && item.field.split('.').pop() === 'attack_result_id')
-        .map(item => item.message)
-      const otherMessages = apiError.fieldErrors.filter(item => !evidenceField || item.field.split('.').pop() !== 'attack_result_id')
+      // Match the whole path: a deployment's own field can also be keyed attack_result_id under field_values.
+      const isEvidenceError = (item: FieldError): boolean =>
+        evidenceField && item.field.replace(/^body\./, '') === 'attack_result_id'
+      const evidenceMessages = apiError.fieldErrors.filter(isEvidenceError).map(item => item.message)
+      const otherMessages = apiError.fieldErrors.filter(item => !isEvidenceError(item))
         .map(item => `${item.field.replace(/^body\./, '')}: ${item.message}`)
       setAttackResultIdError(evidenceMessages.join(' '))
       if (evidenceMessages.length === 0 || otherMessages.length > 0) {
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index 1f16f23921..328938a147 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -26,8 +26,6 @@
     Finding,
     FindingCreate,
     FindingEvidence,
-    FindingFields,
-    FindingValuesError,
     Operation,
     OperationCreate,
 )
@@ -463,15 +461,9 @@ async def update_finding_async(
         """
         await self.get_async(operation_id)
         stored = await self._require_finding_async(operation_id=operation_id, finding_id=finding_id)
-        fields = get_active_finding_fields()
-        values = self._merge_retired_values(fields=fields, stored=stored, request=request)
-        fields.check_values(
-            severity=request.severity,
-            field_values=values,
-            previous_severity=stored.severity,
-            previous_values=stored.field_values,
+        replacement = get_active_finding_fields().apply_edit(
+            stored=stored, edit=request, remove_retired_keys=request.remove_retired_keys
         )
-        replacement = FindingCreate(title=request.title, severity=request.severity, field_values=values)
         try:
             return await CentralMemory.get_memory_instance().update_finding_async(
                 operation_id=operation_id, finding_id=finding_id, request=replacement
@@ -479,29 +471,6 @@ async def update_finding_async(
         except LookupError as exc:
             raise FindingNotFoundError(str(exc)) from exc
 
-    @staticmethod
-    def _merge_retired_values(
-        *, fields: FindingFields, stored: Finding, request: FindingUpdateRequest
-    ) -> dict[str, str]:
-        """
-        Add the stored values of fields that are no longer configured to the sent values.
-
-        Returns:
-            dict[str, str]: The sent values, plus each retired value not listed in ``remove_retired_keys``.
-
-        Raises:
-            FindingValuesError: If ``remove_retired_keys`` lists a key that isn't a retired value of the finding
-                or that is also sent.
-        """
-        retired = dict(fields.describe_values(severity=stored.severity, field_values=stored.field_values).retired)
-        for key in request.remove_retired_keys:
-            if key not in retired:
-                raise FindingValuesError(f"{key!r} is not a retired value of this finding.")
-            if key in request.field_values:
-                raise FindingValuesError(f"{key!r} can't be both sent and removed.")
-        kept = {key: value for key, value in retired.items() if key not in request.remove_retired_keys}
-        return {**kept, **request.field_values}
-
     async def delete_finding_async(self, *, operation_id: UUID, finding_id: UUID) -> None:
         """
         Permanently remove a finding within an existing operation.
diff --git a/pyrit/models/finding_fields.py b/pyrit/models/finding_fields.py
index 2b25eae09b..a96fe1e9c6 100644
--- a/pyrit/models/finding_fields.py
+++ b/pyrit/models/finding_fields.py
@@ -2,12 +2,13 @@
 # Licensed under the MIT license.
 
 import re
-from collections.abc import Iterable, Iterator
+from collections.abc import Collection, Iterable, Iterator
 from enum import StrEnum
 from typing import Any, ClassVar, Self
 
 from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 
+from pyrit.models.finding import FindingCreate
 from pyrit.models.harm_category import HarmCategory
 
 
@@ -356,6 +357,43 @@ def describe_values(self, *, severity: str, field_values: dict[str, str]) -> Fin
             retired=[(key, value) for key, value in field_values.items() if key not in known],
         )
 
+    def apply_edit(
+        self, *, stored: FindingCreate, edit: FindingCreate, remove_retired_keys: Collection[str] = ()
+    ) -> FindingCreate:
+        """
+        Build the finding that an edit saves, checked against these fields.
+
+        A current field left out of the edit is cleared. Stored values of fields that are no longer configured
+        are kept unchanged, unless their keys are listed in ``remove_retired_keys``.
+
+        Args:
+            stored (FindingCreate): The finding as saved.
+            edit (FindingCreate): The edited title, severity and current field values.
+            remove_retired_keys (Collection[str]): Keys of the stored retired values to delete. Defaults to none.
+
+        Returns:
+            FindingCreate: The finding to save.
+
+        Raises:
+            FindingValuesError: If ``remove_retired_keys`` lists a key that isn't a retired value of the stored
+                finding or that the edit also sends, or the edited values do not fit these fields.
+        """
+        retired = dict(self.describe_values(severity=stored.severity, field_values=stored.field_values).retired)
+        for key in remove_retired_keys:
+            if key not in retired:
+                raise FindingValuesError(f"{key!r} is not a retired value of this finding.")
+            if key in edit.field_values:
+                raise FindingValuesError(f"{key!r} can't be both sent and removed.")
+        kept = {key: value for key, value in retired.items() if key not in remove_retired_keys}
+        values = {**kept, **edit.field_values}
+        self.check_values(
+            severity=edit.severity,
+            field_values=values,
+            previous_severity=stored.severity,
+            previous_values=stored.field_values,
+        )
+        return FindingCreate(title=edit.title, severity=edit.severity, field_values=values)
+
     def _check_known_keys(self, *, field_values: dict[str, str], previous_values: dict[str, str]) -> None:
         """
         Reject a key that no field or level uses, unless its value has not changed.
diff --git a/tests/unit/backend/test_operation_service_findings.py b/tests/unit/backend/test_operation_service_findings.py
index ea6cb5c9e6..eef0e789fe 100644
--- a/tests/unit/backend/test_operation_service_findings.py
+++ b/tests/unit/backend/test_operation_service_findings.py
@@ -67,14 +67,6 @@ async def test_update_keeps_an_omitted_retired_value(
     assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
-async def test_update_keeps_a_blank_retired_value(
-    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
-) -> None:
-    finding = retired_value_finding_async
-    await _update_async(finding=finding, field_values={"steps": "1. Open", "description": " "})
-    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
-
-
 async def test_update_removes_a_listed_retired_value(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
 ) -> None:
@@ -86,17 +78,7 @@ async def test_update_removes_a_listed_retired_value(
     assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == {"steps": "1. Open"}
 
 
-@pytest.mark.parametrize("key", ["steps", "nonexistent"])
-async def test_update_rejects_removing_a_value_that_is_not_retired(
-    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding, key: str
-) -> None:
-    finding = retired_value_finding_async
-    with pytest.raises(FindingValuesError, match=re.escape(f"{key!r} is not a retired value of this finding.")):
-        await _update_async(finding=finding, field_values={"steps": "1. Open"}, remove_retired_keys=[key])
-    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
-
-
-async def test_update_rejects_sending_and_removing_a_value(
+async def test_update_rejects_an_invalid_edit_without_saving(
     sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
 ) -> None:
     finding = retired_value_finding_async
@@ -105,16 +87,6 @@ async def test_update_rejects_sending_and_removing_a_value(
     assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
 
 
-async def test_update_rejects_changing_a_retired_value(
-    sqlite_instance: SQLiteMemory, retired_value_finding_async: Finding
-) -> None:
-    finding = retired_value_finding_async
-    message = "Finding field 'description' is no longer configured, so its saved value can't change."
-    with pytest.raises(FindingValuesError, match=re.escape(message)):
-        await _update_async(finding=finding, field_values={"steps": "1. Open", "description": "New text"})
-    assert (await read_finding_async(memory=sqlite_instance, finding=finding)).field_values == finding.field_values
-
-
 async def test_update_keeps_an_unchanged_severity_that_is_no_longer_an_option(
     sqlite_instance: SQLiteMemory, unmatched_severity_finding_async: Finding
 ) -> None:
diff --git a/tests/unit/models/test_finding_fields.py b/tests/unit/models/test_finding_fields.py
index f281b29c88..e92ffe9883 100644
--- a/tests/unit/models/test_finding_fields.py
+++ b/tests/unit/models/test_finding_fields.py
@@ -6,6 +6,7 @@
 
 from pyrit.models import (
     DEFAULT_FINDING_FIELDS,
+    FindingCreate,
     FindingField,
     FindingFields,
     FindingValuesError,
@@ -444,3 +445,45 @@ def test_check_values_required_cascade_skips_a_level_with_no_options() -> None:
     with pytest.raises(FindingValuesError) as error:
         REQUIRED_AREAS.check_values(severity="high", field_values={"area": "chat"})
     assert str(error.value) == "Feature is required."
+
+
+STORED = FindingCreate(title="Leak", severity="sev1", field_values={**VALID, "description": "Old text"})
+
+
+@pytest.mark.parametrize("values", [VALID, {**VALID, "description": " "}])
+def test_apply_edit_keeps_a_retired_value_the_edit_leaves_out_or_blank(values: dict[str, str]) -> None:
+    edit = FindingCreate(title="Edited", severity="sev1", field_values=values)
+    assert CONTOSO.apply_edit(stored=STORED, edit=edit) == FindingCreate(
+        title="Edited", severity="sev1", field_values={**VALID, "description": "Old text"}
+    )
+
+
+def test_apply_edit_removes_a_listed_retired_value() -> None:
+    edit = FindingCreate(title="Leak", severity="sev1", field_values=VALID)
+    assert CONTOSO.apply_edit(stored=STORED, edit=edit, remove_retired_keys=["description"]).field_values == VALID
+
+
+@pytest.mark.parametrize(
+    ("values", "remove_retired_keys", "message"),
+    [
+        pytest.param(VALID, ["steps"], "'steps' is not a retired value of this finding.", id="current key"),
+        pytest.param(VALID, ["nonexistent"], "'nonexistent' is not a retired value of this finding.", id="unknown key"),
+        pytest.param(
+            {**VALID, "description": "Old text"},
+            ["description"],
+            "'description' can't be both sent and removed.",
+            id="sent and removed",
+        ),
+        pytest.param(
+            {**VALID, "description": "New text"},
+            [],
+            "Finding field 'description' is no longer configured, so its saved value can't change.",
+            id="changed retired value",
+        ),
+    ],
+)
+def test_apply_edit_rejects(values: dict[str, str], remove_retired_keys: list[str], message: str) -> None:
+    edit = FindingCreate(title="Leak", severity="sev1", field_values=values)
+    with pytest.raises(FindingValuesError) as error:
+        CONTOSO.apply_edit(stored=STORED, edit=edit, remove_retired_keys=remove_retired_keys)
+    assert str(error.value) == message