Proof Center · Severity governance
How we refuse to overclaim.
The value of a finding is what it proves, not what it asserts. QScout runs a governance layer that adds a proof-state to every High and Critical signal so a report can flag urgent risk in sensitive sectors without overstating it as confirmed exploitation. A finding is only promoted when the evidence clears a fixed bar — and the engine demotes anything that does not.
The rules on this page are the current rules the engine enforces, mirrored from its source (qscout/core/severity_governance.py), and covered by 12 passing governance tests.
Every finding carries a proof-state
This layer does not replace CVSS or module severity. It records how much the evidence actually supports the claim.
Confirmed
A validation module set a structured positive-result marker, or a sealed canary event proved the exploit path. Direct proof — not a self-asserted count.
Strong indicator
A High or Critical signal is present, but it is demoted from confirmed because proof-grade corroboration is missing.
Not proven
Severity was claimed at High, but the proof-grade anchor floor was not met.
Rejected false positive
The finding failed the six-pattern false-positive filter and is not reported as a finding.
Medium / hardening
Real, but non-material. Reported as hardening rather than urgent risk.
Two ordered gates stand before promotion
- 01
False-positive filter
A six-pattern false-positive killer runs first. Prose-only or FP-shaped High/Critical findings are demoted before any promotion is considered.
- 02
Proof-grade anchor gate
The anchor gate consumes proof_grade_anchor_count — the number of corroborated, evidence-backed anchors — never a self-asserted anchor_count scalar.
The severity floors
| Severity | Min proof-grade anchors | Requirement to hold the severity |
|---|---|---|
| Critical | 2 | At least 2 independent public anchors AND proof_of_access, OR a trust-system failure. A self-asserted count without captured evidence does not qualify. |
| High | 1 | At least 1 strong proof-grade anchor. A self-asserted scalar without captured evidence does not qualify. |
The gate consumes proof_grade_anchor_count — the corroborated count — not a self-asserted scalar. A bare count with no captured evidence never promotes a finding.
What counts as proof — and what never does
Accepted as proof
- A validation module that SETS a structured positive-result marker with a value of exactly true.
- A module-asserted anchor list with concrete references that an independent derivation agrees with.
- A sealed, asset-bound, source-verified canary event, independently validated and hashed by the canary broker — non-destructive: no protected data touched and no state mutated.
Never accepted as proof
- Free-text or natural-language proof: boilerplate keywords, a marker key whose value is ignored, or affirmative verbs inside hypothetical clauses.
- A self-asserted anchor_count scalar with no captured evidence behind it.
- An observed configuration value — it is an anchor for SEVERITY, but never proof of a material OUTCOME.
Confirmation comes from active validation that sets a marker, not from how a finding is described.
How you can check this is real
These rules are not marketing copy about the engine — they are mirrored from the engine and pinned to its source. The governance logic is covered by 12 passing tests in tests/unit/test_severity_governance.py, and every rule above is checked against this page in continuous integration so the two cannot drift.
- Source
- qscout/core/severity_governance.py
- Source revision
- b6ad40a2
- Governance tests
- 12 passing