How the evidence works

Start with a bounded case

A case describes an event or demonstration, the systems involved, the attack or failure path, and what remains unknown. Claims inside it are narrower assertions. Each claim records its basis, assessment, scope and any source links that support, contradict or contextualize it.

Read an assessment as separate dimensions

Method diggingbeagle.assessment/1 keeps setting, exploitation, consequence, evidence, remediation and AI role separate. These values are not combined into a threat score. An unassessed dimension stays unknown; a demonstration does not establish exploitation in production.

Setting and exploitation

Setting identifies production, a controlled live system, an evaluation, a research demonstration, a simulation, an allegation, or an unknown environment. Exploit status separately identifies confirmed in-the-wild exploitation, live observation, a demonstration, an outcome not established by the evidence, or an unknown status.

Impact: a bounded consequence, not likelihood

A published impact band is an ordinal value from 0 to 4, with a mandatory, inspectable textual basis. It describes consequence within the Case’s documented boundary, not probability or an assurance of safety. Compare records only after reading their boundaries and impact bases. No band is assigned automatically, and a missing band is not zero.

0

No meaningful external effect established within the documented boundary.

1

A bounded local or task-level effect.

2

A meaningful system or account-level effect.

3

A privileged or cross-boundary effect.

4

A broad or irreversible material consequence.

The textual basis must identify the demonstrated or credibly supported consequence and its limits. Band 0 is not a statement that the system is safe.

Evidence grade

A

Primary evidence or artifact with direct technical support.

B

Strong primary reporting or reproducible secondary corroboration.

C

Credible but incomplete or indirect evidence.

D

Weak, disputed or predominantly testimonial support.

U

Insufficiently assessed.

The grade describes the evidence basis, not the drama of the event or the number of Sources. Every assessed profile records the method, assessment date, canonical Claim/Source references and a readable explanation.

Remediation and AI role

Mitigation available, patch available, a reported fix and an independently verified fix are different states. “None known” and “unknown” do not mean that no fix exists. A Case may involve more than one AI role.

Dates and chronology

Occurrence, discovery, notification, patch, release and disclosure dates describe different events. A month-only date remains a month; unknown days are not invented. An older generic “first seen” field is retained as legacy metadata without being relabelled as an occurrence or disclosure. The material-update rail uses changes to public projections across activated Releases. A newly included canonical change is labelled with its canonical revision time when its future activation time is not yet known; the site build time is never used as an event date.

Keep evidence types separate

A reported finding is attributed to a source. A direct observation is documented in the investigation. An allegation needs its attribution. An inference is our reading of other evidence. A simulation is not evidence that the same sequence occurred in an incident. These labels prevent a useful experiment from becoming an invented event.

Make sources checkable

Source records retain publisher, date, version and a useful locator when available. A link from a claim to a source states the source's role for that claim. It does not endorse an entire dossier. The source library lets readers move back from a citation to the material and see where it was used.

Preserve limits and corrections

Dates name the event or publication field they describe. A site rebuild is not a research update. Measurements keep their method and units. Missing evidence remains an unknown, while conflicting evidence stays visible. Corrections and later responses appear as dated records linked to the affected work.

Publish through review

A proposed research change and public publication are separate decisions. A human operator reviews the canonical record, and eligible material is reviewed again before an immutable public Release is activated. A current restriction takes priority over a previously published snapshot.