Text is fine when a human reads it and useless when software decides on it is the cleanest justification for structured output I have read. The part worth adding is that the schema does more than make parsing convenient - it constrains what the model can even claim. A free-text reviewer can say there may be an issue somewhere in the auth flow; a schema requiring file, line and severity forces a falsifiable statement, and a finding you can check is worth several you cannot. Two practical notes from doing this in CI. Validate rather than trust the mapping: a response that deserialises cleanly can still carry a line number that does not exist in the diff, and a cheap existence check catches the class of confident-but-wrong findings before they become comments on someone's PR. And keep severity out of the model's hands where you can - let it describe the finding and let deterministic rules decide what blocks a merge, otherwise a slightly more verbose model release quietly changes your gate.