Technology
Implemented8 minEvidence, not opinion: PROVEN, NOT PROVEN, UNKNOWN
A model saying "this looks vulnerable" must never become a reported fact. ROOTVIEL separates who proposes from who verifies from who decides what crosses — and keeps "unknown" visibly distinct from "fine".
The kinds of evidence object
Two different things share the word "ladder", so be precise. The investigation follows a process — the epistemic ladder shown on the home page and in Technology: Observation → Hypothesis → Experiment → Evidence → Verification → Finding. This section is not that sequence; it names the four kinds of object that process produces and reasons over. One is a sequence of steps; the other is a taxonomy of artifacts.
Every claim is built from four kinds of object, and nothing is treated as more than what it is.
- Observation
- What a source just said — a scanner line, a model suggestion, a tool result.
- Evidence
- A normalized datum with provenance: where it came from and how it was produced.
- Hypothesis / Claim
- A candidate explanation, still unproven.
- Verdict
- A deterministic verifier’s PASS / FAIL / UNKNOWN / NOT_APPLICABLE.
The language model lives entirely on the first two rungs. It is the untrusted proposer: it authorizes nothing and confirms nothing. The trusted layer — policy, grants, the tool gate, the deterministic verifiers, the membrane — is where authority and truth are decided.
The membrane: a decision frontier, not a reasoner
Promotion from hypothesis to finding happens only when a verifier returns a FAIL backed by evidence. The component that performs this promotion is called the membrane, and its defining property is that it does not reason. It is a frontier, not a thinker: it reads verifier verdicts and belief states and decides what is allowed to cross into a reported finding.
It can CONFIRM, SUPPORT, REFUTE, or return UNKNOWN. A REFUTE comes from a contradicting observation lowering a belief to DISPROVED; the membrane reads that outcome but never produces it. The hypothesis lifecycle — OPEN, INVESTIGATING, SUPPORTED, CONFIRMED — only reaches CONFIRMED via a verifier verdict, and for exploitable classes, an exploit-to-proof.
Adversarial verifiers and stated invariants
Truth is settled by deterministic verifiers against stated security invariants — properties expressed as "this must never happen", for example "tainted data must not reach a sensitive tool". A verifier that cannot settle an invariant returns UNKNOWN, which is unpromotable; it never guesses a finding into existence.
Honesty is coded in even here: a catalogued invariant with no wired verifier is flagged as unverified-by-membrane. A stated goal is not a settleable property until a verifier makes it one — and the system says which is which.
Three honest states
- PROVEN
- Reproduced; the evidence exists and can be re-derived.
- NOT PROVEN
- Tested, and it did not hold. This is not the same as "safe".
- UNKNOWN
- Could not be established. Declared out loud, never hidden behind a green checkmark.
The trace of an assessment carries the same discipline: an affirmative node cannot be constructed without an evidence reference, and anything the control plane never received is drawn as "not available" with the reason written in — not as a grey box pretending to be a completed step. "Unverifiable" must never look like "fine".
A synthetic illustration, not a measured run. Each rung produces an object, not a verdict: a claim is still a claim, and a signature only proves a record is authentic and unaltered — never that its conclusion holds. The violation is confirmed only when a deterministic verifier settles a stated property over the evidence; an inconclusive check stays UNKNOWN.
References
- [1]Toulmin, The Uses of Argument (claim → evidence → warrant)
- [2]NIST Secure Software Development Framework (assurance thinking)
- [3]OWASP verification mindset
References point to public, well-known technical sources for further study.
Related articles