Observed
Directly supported by a preserved source or authorized measurement
Files 00 and 03
Evidence, truth labels and what you may say
A source is not a finding. Preserve the URL, the publication and retrieval times, the excerpt, and the hash — then say exactly how well the resulting claim is known, and what that permits you to do with it.
Six truth labels
Calculated
Deterministic transformation of cited inputs
Inferred
Best explanation supported by evidence but not directly observed
Hypothesized
Testable possibility; not yet supported enough to prefer
Unknown
Necessary information is unavailable or inaccessible
Contradicted
Credible evidence conflicts with the claim
Evidence states E0-E5
| Level | Name | Minimum condition | Allowed use |
|---|---|---|---|
| E0 | No evidence | no preserved support | backlog only |
| E1 | Lead | snippet, unverified mention, weakly resolved source | research lead; not report fact |
| E2 | Single-source support | accessible source with extract and time, but secondary, user-generated, or not corroborated | bounded observation with caveat |
| E3 | Current official reference snapshot | current official page, filing, registry, API, policy, repository, or first-party platform record preserved with provenance | direct claim about what source shows |
| E4 | Corroborated official evidence | E3 plus independent primary/authoritative corroboration or an authorized reproducible local measurement/registry | material finding and model input |
| E5 | Confirmed/audited evidence | E4 support plus audited/reconciled target data or a valid controlled test that directly addresses the scoped claim | high-confidence decision input |
Separation of layers
| Layer | Question | Examples |
|---|---|---|
| Source | Where did the material come from? | filing, company page, review, official API |
| Observation | What can a reviewer directly inspect? | page lacks a visible CTA; filing reports revenue |
| Calculation | What follows arithmetically? | growth rate; ad frequency; SOV count |
| Inference | What explanation is supported but not proven? | unclear positioning may contribute to low conversion |
| Hypothesis | What should be tested? | a shorter form may increase completion |
| Recommendation | What intervention best balances value and risk? | instrument the form and run a controlled test |
| Outreach | What is relevant and appropriate to tell the executive? | one observation, its business implication, a low-friction next step |
What each claim type may be used for
Report use and outreach use are separate permissions. A claim strong enough for an internal ledger is not automatically fit to put in front of an executive.
| Claim type | Report use | Outreach use |
|---|---|---|
Official/company fact [O] | Current E3; E4/E5 for material decisions | Current E3+ with exact scope and role relevance |
Reproducible public-corpus measure [C] | Material source items E2+ from at least two independent origins; declared query, window, denominator, dedupe, sampling limits, and reproducible calculation | Allowed as a calculated sample observation after human validation and defamation/privacy review; wording must describe the collected sample, not the population |
Deterministic historical calculation [C][DETERMINISTIC_CALCULATION] | Reconciled inputs and formula; input evidence governs confidence | Allowed when inputs and scope are current/relevant; never imply causality |
Financial projection [C][ESTIMATE or SCENARIO] | Tagged inputs, formula, range, sensitivity, overlap, and limitations | Only as a labeled scenario or break-even threshold anchored to an eligible factual/calculated hook |
Inference [I] | Supported claims, mechanism, strongest alternative, and disconfirming check | Only adjacent to an eligible hook, explicitly bounded, and never as the subject-line fact |
Hypothesis [H] | Testable, falsifiable, metric/guardrail/stop rule | Only as a permission-based diagnostic question anchored to an eligible hook |
| Complaint/allegation | E2 bounded experience/allegation or a reviewed aggregate calculation; never adjudicated fact | Individual allegations are excluded; aggregate themes require the public-corpus rule and must not be weaponized |
| Security signal | Narrow passive observation with technical sensitivity controls | Excluded from sales outreach; use a separate responsible-disclosure route when warranted |
Unknown [U] or contradicted [X] | State explicitly; preserve reason/evidence | Never a factual hook |
Saying security findings safely
A passive signal is not a vulnerability, and an outreach email is never the place to raise one. Route material security observations to a published security contact or a responsible-disclosure process.
| Unsafe claim | Evidence-safe version |
|---|---|
| “They were breached” | “The domain appears in an authorized breach-notification result as of [date]; scope and current risk are unconfirmed.” |
| “They have no MFA” | “MFA status is not publicly verifiable.” |
| “This version is vulnerable” | “A passive fingerprint suggests version X; the version and exploitability were not validated.” |
| “Their endpoint is exposed” | “A passive index listed service Y at time Z; no active connection was attempted.” |
| “Employee credentials are on the dark web” | Do not make or store this claim from unverified dumps. Use an authorized domain-monitoring process. |