tested
A direct local test exists on a structurally simple surface.
Evidence graph (v6)
What is proven, what is unresolved, surface by surface.
arkheionx evidence-graph classifies every important review surface into one
evidence state, with an evidence strength, the missing-evidence gaps, and a next local test
direction. It distinguishes "the file is referenced" from "the right edge is actually
tested". An evidence state is not a vulnerability claim.
needs-human-review
A test references the surface but coverage is shallow (often file-level) on a high-impact surface — the "looks tested" trap.
unresolved
A high-impact surface with weak, missing, or unclear local evidence. Not vulnerable — just unproven.
insufficient-evidence
Tests exist but do not prove the relevant assumption or counterfactual.
rejected-with-evidence
A local hypothesis log records this as tested and rejected with evidence.
confirmed-candidate
Local memory marks a candidate. A review candidate, not a confirmed vulnerability.
Run it
Classify the surface, see what is missing.
arkheionx evidence-graph .
arkheionx evidence-graph . --json
arkheionx evidence-graph . --out .arkheionx/evidence-graph
arkheionx evidence-graph . --only-unresolvedBoundary
An evidence state, not a verdict.
Evidence strength is a heuristic. A confirmed-candidate is not a confirmed vulnerability,
and the two strongest states are only ever assigned from explicit local research memory.
ArkheionX does not confirm vulnerabilities. Human review is required. See
docs/EVIDENCE_GRAPH.md.