Retest and Delta

Retest and delta

After a fix

pandaward retest --changed

Pandaward lists the files changed since the last assessment and works out which controls they can affect. Only the adapters behind those controls run again. The others are reported as CARRIED and keep their previous decisions, so a one-line fix does not cost a full scan.

Changed files come from two sources:

• edits made through Claude Code, recorded by the PostToolUse hook
• content hashes, so edits made in another editor or by git pull are found too

retest always compares hashes. Only the short summary that the plugin shows at session start limits the time it spends hashing; when it stops early it says so and points to pandaward status.

Run pandaward retest without --changed for a full re-scan.

In Claude Code

You do not need to run it. When Claude finishes a turn that edited files, the Stop hook runs the same changed-only retest, bounded at 40 seconds, and hands new or reopened findings back to Claude, which explains them and offers a fix. A clean retest stays silent. Claude also retests after each step it applies from the fix plan. /pandaward:retest is still there for a retest on request. See Claude Code Plugin for the limits and hooks.auto_retest in Configuration to turn it off.

What counts as fixed

A finding becomes REMEDIATED only when the adapter that found it ran again successfully and no longer sees it. If that adapter was skipped, failed or timed out, the finding stays open and is marked STALE. See Findings Lifecycle.

Delta between assessments

pandaward diff                 # previous assessment -> latest
pandaward diff asmt_0003 asmt_0007
pandaward diff --json

Category	Meaning
new	observed in the later assessment and never before
reopened	observed in the later assessment, not in the earlier one, but seen at some point before it
remediated	observed in the earlier assessment; its check completed in the later one and no longer sees it
stale	observed in the earlier assessment; its check did not complete in the later one, so nothing is known
waived	marked false positive or accepted risk between the two assessments
unchanged	observed in both

Findings are matched by fingerprint (rule, file, stable key and the normalized redacted line), so moving code does not show up as one fix and one new finding.