Ground high-stakes findings in a reproducer

What the check reads

The default-on verify-stage error covers high or critical severity and cve_surface values possible, likely or confirmed. It requires severity_basis: reproducer, resolving evidence_manifests and a tripwire_mutation. When affected_api names an identifiable symbol, a resolving reproducer must reference it. Evidence-profile manifests must record command, executed_at and freshness_hashes. Low or medium issues marked unlikely or not_assessed are outside the security trigger.

proof audit --check high_severity_reproducer_grade

An illustrative case

Illustrative case: a finding claims an authentication bypass, but its attached test only demonstrates that a parser accepts an empty string. The file may resolve and reference the target while never exercising protected access. The structural check cannot turn that intermediate observation into evidence for the headline. Strengthen the reproducer or narrow the claim to the behavior actually observed.

Resolve the finding

1. Inspect the failing issue and identify each missing evidence field or unresolved path.
2. Create a runnable, discriminating reproducer that reaches the affected behavior; record the product edit expected to change its result.
3. Run it under stated conditions, retain the evidence record and review whether the observed impact supports the severity. Rerun the audit.

What a clear result means

A run-shaped manifest is not independent proof that execution occurred or that the result supports the claim. Review retained output and provenance. An audit error only prevents delivery when the project runs and enforces that result at the relevant revision.

Continue with one real issue

Known issue complete · Poc quality checked

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.