Last updated September 18, 2026
4 min read
A fictional pipeline cannot find its integration report and labels the stage green because no failure was parsed. The team reads absence as success. An honest verdict distinguishes complete evidence, detected concern, and insufficient evidence. This is an explicitly fictional composite, not a customer result.
In this article
No report is not a passing report
A missing file, timeout, unsupported platform, or parser error should never collapse into pass. Treat execution failure separately from behavior failure. The former often means the system cannot tell what happened.
NIST AI RMF Core supports the evidence boundary. Voluntary guidance, not certification or endorsement.
| Item | Inspectable value |
|---|---|
| 1 | Verdict 1: evidence complete |
| 2 | Verdict 2: needs attention |
| 3 | Verdict 3: inconclusive |
| 4 | Guarantees: 0 |
Use the table as a diagnostic, not benchmark data. Replace illustrative entries with repository evidence before changing staffing, policy, or release authority.
Verdicts need declared evidence requirements
Define required checks by lane, module, and criterion. Evidence complete confirms presence, freshness, expected tool version, reproducible command, and result interpretation. Needs attention identifies a concrete issue. Inconclusive identifies why no supported judgment is possible.
Sequence matters. When an early input is missing, later activity can look complete while a reviewer inherits the unresolved uncertainty.
Blind spots belong inside the receipt
NIST guidance emphasizes testing, documented limits, traceability, and explicit authority. A receipt should name untested paths, flaky quarantines, advisory model findings, ignored warnings, and assumptions outside execution. The omissions are part of the result.
Reliability of LLM code reviewers, 2026 provides a second check. Small benchmark functions and prompt-sensitive trade-offs; execution did not prove correctness.
The fix is procedural because a procedure can be rehearsed and audited. A warning without ownership rarely survives a busy release week.
The human decides whether the evidence is enough
The final reviewer may accept residual risk, request more evidence, narrow scope, or stop. They need the specification version, changed scope, required and observed evidence, findings, blind spots, and rollback state. A green color alone cannot support that decision.
paqad-ai v1.67.0 was the current public release when this article was verified on July 21, 2026. The repository describes local workflows, risk routing, structured state, checks, documentation sync, and audit records. Those are inspectable mechanisms, not independent proof of a business result.
Use the AI workflow audit guide for current-state mapping, compare the evidence bar with production-ready AI code, and read the AI coding consultant guide when outside support is relevant.
Decision rule: Return inconclusive whenever required evidence is missing or the oracle cannot support the claimed conclusion.
Run the three-verdict evidence receipt in a 45-minute working review with the product owner, module owner, and final reviewer. Do not turn it into a score. Read the decision rule aloud: Return inconclusive whenever required evidence is missing or the oracle cannot support the claimed conclusion. Record disagreements, missing evidence, and the person responsible for the next action. Repeat the review after one real feature so the team can compare whether the artifact reduced ambiguity or only added paperwork.
Frequently Asked Questions
Why avoid pass and fail labels?
You can use them for individual checks. The aggregate feature verdict needs more nuance because checks can be missing or unable to cover the disputed behavior. Bounded wording prevents a green label from implying correctness.
Can evidence complete still contain risk?
Yes. It means the required declared evidence is present and acceptable. Unknown failure modes, weak oracles, and unmodeled product risk can remain. The receipt should state them.
Who chooses required evidence?
Repository policy can set defaults by lane and module. Product, security, and technical owners add feature-specific requirements where consequence or uncertainty demands it.
What next?
Apply the three-verdict evidence receipt to one active feature. If the repository cannot produce the required state and evidence, install paqad-ai and test the workflow locally with a named human decision owner.