ReferenceCarried through every stage301 · Tooled judgment

The workbench.

Eight classes of AI mistake, each with the checks that can examine it, what their evidence supports and what they structurally cannot decide.

01 · Doctrine

Three rules that decide the order

The classes below tell you what reaches a failure mode. These rules tell you where in the workflow to put it, and they survive a change of toolchain.

Rule 1

Cheapest deterministic first

Order a validation workflow by cost and precision. Compile, scan and scope-guard first, then spend stochastic checks on whatever surface survives. A workflow that opens with three agents has already spent its budget.

Rule 2

Never send an agent where a hook will do

If a class is decidable, decide it. An agent asked to look for PANs is slower, costlier and less complete than a Luhn-aware scan. It can also be talked out of its finding.

Rule 3

Independence is configured, not hoped for

Independence comes from fresh context, a separate provider, no access to the author’s rationale, or no opinion at all. A check that shares the author’s premises inherits the author’s blind spot.

02 · Classes

Failure mode to check

Ordered by how completely the tooling covers them, cheapest and most decidable first. F8 is last because it is the one reserved for you.

Hallucinated API, config key or dependency

Fully mechanized

Looks likestripe.refunds.reverse()

A method that has never existed. Also an invented environment variable, or a package name one character off a real one.

hook

Typecheck / compileRuns first, always. Costs seconds and removes a whole class.

hook

Dependency provenance guardPackage exists, is not newly registered, matches the lockfile. Catches slopsquatting.

Proves

The named surface exists and resolves.

Cannot

Say whether the surface that does exist is the right one to call.

Evidence

Proof

Residual

No residual. This class is fully decidable.

Cardholder data leakage

Fully mechanized

Looks likelogger.debug("auth failed for " + card.pan)

A full PAN into stdout. Also a PAN echoed in a webhook error body, a real-looking PAN committed as a fixture, or a CVV retained past authorization.

hook

PAN scanLuhn-valid card numbers outside the fixture allowlist, anywhere in the source tree.

hook

Taint / dataflow analysisPAN-typed source to log, telemetry, error or serialisation sink. Catches the leak a regex misses because the value was reassigned.

hook

Secret and entropy scanKeys, tokens and credentials in the same pass.

Proves

Absence within the ruleset. It is complete over the sinks the rules model.

Cannot

See a leak through a channel not modelled as a sink, or a PAN that was encoded before it left.

Evidence

Proof

Residual

No residual while the sink inventory is current. Reviewing that inventory is the standing human job.

Weak test that passes and proves nothing

Mechanized, needs judgment

Looks likeexpect(res.status).toBe(201)

With expect(ledger.length).toBe(2) underneath. Passes against a balance that never moved, a sign that is inverted, and an unauthorised caller.

cmd

MutationChanges code over the current diff; a surviving non-equivalent mutant shows that the suite cannot see the change.

Proves

A surviving mutant is decisive: this test cannot distinguish correct from broken.

Cannot

Distinguish a real gap from a mutant that should survive, such as an equivalent one or behavior the spec never constrained.

Evidence

Counterexample

Residual

Triaging survivors. This is the judgment the class exists to teach.

Broken invariant under generated sequences or retry

Mechanized, statistical

Looks liketwo captures, one idempotency key

The ledger nets to -2500 instead of 0. Non-atomic two-record writes, lost updates, a refund that applies twice on retry.

cmd

InvariantChecks the four named payment and ledger invariants after a fixed scenario.

cmd

PropertyChecks the invariants after generated operation sequences, including retries.

Proves

A found counterexample is decisive. A clean run is statistical: N cases, no violation.

Cannot

Establish production isolation behavior from an in-memory database.

Evidence

Statistical

Residual

Deciding whether N was large enough, and whether the generator explored the shapes that matter.

Sycophantic self-approval

Needs engineered independence

Looks like"I have verified the implementation is correct."

The agent wrote the code, wrote the tests, ran them, and reported success. Nothing in that chain was independent of the author.

skill

Zero-context reviewFresh session given the diff and requirement only. It never sees the authoring rationale.

skill

Red teamLooks for a counterexample rather than assessing whether the change seems correct.

Proves

One reviewer is a single opinion. Two genuinely independent reviewers agreeing is corroboration.

Cannot

Be trusted if context leaks. A reviewer handed the author’s summary is not a second opinion, it is an echo.

Evidence

Single opinion

Residual

Verifying that the independence actually held, by reading the reviewer’s input manifest.

Wrong problem, scope creep, over-engineering

Partly mechanized

Looks likeasked: fix refund rounding

Delivered: a RefundStrategy factory across 14 files. Plausible, tidy, tested, and not what anyone requested.

hook

Scope guardCompares changed files with workbench/allowed-paths.json when that manifest is present.

skill

Intent conformanceCompares the implementation with the stated requirement and reports behavior the requirement did not authorize.

Proves

Scope violations, mechanically.

Cannot

Know that the requirement itself was the wrong requirement. That is F8.

Evidence

Proof

Residual

Deciding whether an out-of-scope change is nonetheless right, and re-scoping if so.

Silent regression in untouched behavior

Mechanized

Looks likepartial-capture rounding shifts by 1 cent

The refund fix ships and something nobody was looking at changes. No test covered it, so no test failed.

cmd

DifferentialReplays the golden corpus and compares responses and ledger state.

Proves

Behavioral equivalence over the replayed corpus.

Cannot

Speak to traffic shapes the corpus does not contain. The corpus is the claim’s boundary.

Evidence

Statistical

Residual

Judging whether the corpus resembles production. Corpus drift is a standing risk.

Specification gap, where the defect is what nobody specified

Human-reserved by design

Looks likethe spec is silent on refund idempotency

So a double refund is "correct". Every check passes. The code matches the requirement. The requirement was incomplete.

skill

Requirements coverageNarrows the surface a human must inspect. It declares no class coverage because it cannot choose policy.

Proves

Nothing on its own. It narrows the surface a human must read.

Cannot

Decide whether a missing policy matters. That judgment is reserved and owned.

Evidence

Silence

Residual

A named role. The residual is escalated, never absorbed.

03 · Evidence

Six types, and what each will not support

A release claim can be no stronger than its weakest supporting type. Learning to type a finding before weighing it is the habit stage 4 drills.

Type	Produced by	Supports the claim	Characteristic misreading
Counterexample	Surviving mutant · failing property · shrunk reproducer	Decisively, in the negative. It is the strongest result any check returns.	Dismissing it as unrealistic without checking whether the specification permits it.
Proof	Typechecker · PAN and secret scanner · scope guard	Absence, within the ruleset. Complete over what the rules model.	Reading it as absence in general. The ruleset is the boundary of the claim.
Statistical	Property run over N cases · replay over a corpus	No violation found in what was explored. Strength scales with N and generator quality.	Quoting the pass without the corpus or the case count.
Corroborated opinion	Two or more genuinely independent reviewers agreeing	Raises the prior without settling anything. Useful for prioritizing human attention.	Treating agreement as proof when the independence was never verified.
Single opinion	One agent review, unreplicated	A lead, showing where to point a real check.	Shipping on it because it was fluent and cited line numbers.
Silence	No check examined this class	Nothing whatsoever.	The one that ships incidents. Silence rendered as a green row on a dashboard.