UNKNOWN Is Not PASS
The most expensive audit failure is not a wrong verdict — it's a missing verdict silently rendered as a green check. This skill installs one reflex: every claim in a report must carry evidence class: PASS, FAIL, or UNKNOWN. Anything else is a finding.
The reflex
Before accepting ANY audit/scan/review conclusion, reclassify every line:
| Report says | Actually is |
|---|---|
| "No issues found" | PASS only if the check RAN and had data |
| "N/A" or blank | UNKNOWN — treated as a WARN-level finding |
| Check errored / timed out | UNKNOWN — the tool's silence is not the system's innocence |
| Check skipped "by policy" | UNKNOWN — who decided, and is that recorded? |
| Data older than the window | UNKNOWN (staleness = no evidence) |
Procedure
- List every check the report CLAIMS to have run.
- For each: did it produce a machine-readable result, or a summary assertion?
- Reclassify all non-evidenced lines to UNKNOWN; re-render the score with
UNKNOWNshown next toFAIL— never collapsed into "other". - Re-state the verdict:
PASS: X / FAIL: Y / UNKNOWN: Z. If Z > 20% of checks, the audit is INCONCLUSIVE regardless of X. - For each UNKNOWN: name the ONE artifact that would resolve it (log file, provenance artifact, screenshot, tx hash).
Rules
- A green dashboard with 30% UNKNOWN is a red dashboard.
- Refusal to classify = the auditor didn't run the check.
- This applies to YOUR OWN reports too — the convenient UNKNOWN is the one you skip.
Not for
- Continuous monitoring (that's a pipeline, not a report review).
- Deciding risk appetite — this classifies evidence, it doesn't accept it.
Example
Ask: "Security scan came back clean — are we good?" Before: 214 checks, "0 findings", ship it. After: 186 PASS, 12 FAIL (suppressed as informational), 16 UNKNOWN (scanner credentialed to 2 of 5 accounts). Real verdict: INCONCLUSIVE — fix scope first.
Version
1.0.0 — DDG starter series (ops IP from running a paid x402 audit edge).