finding-skeptic

Finding skeptic

Challenge each drafted finding before it is shown to the examiner and staged. The examiner then sees only the reviewed version.

There are two parts: the investigator (you, with the investigation's context) and the skeptic (a separate agent that sees only the draft).

Only in an isolated agent

Run the skeptic only as its own agent: a subagent with its own context, or a separate thread. If your client gives you no way to do that, don't challenge the finding. Record it without challenged; the examiner sees "Not challenged". A challenge from the same context that wrote the finding is not a challenge.

The investigator's part

1. Draft the finding: title, observation, interpretation, confidence, the audit ids it cites, and each artifact's extraction command.

2. Hand the skeptic only the draft, not the investigation narrative or your reasoning.

3. Reassess on the skeptic's report. Choose one outcome:

   • stands: nothing in the report changes the finding;
   • revised: you change the finding because of the report;
   • withdrawn: only under the withdrawal rule below.

4. Fill alternatives only with what is meaningful:

   • an alternative that is still possible: status: open, with why it stays open;
   • an alternative the re-run output rules out: status: ruled_out, with that output quoted in evidence and its audit ids in audit_ids.

   If the skeptic found nothing and you agree, leave alternatives out.

5. Set challenged in the finding: outcome (stands, revised or withdrawn) and skeptic_audit_ids, the audit ids of the skeptic's own tool calls. Never the finding's own audit ids.

6. Present the reviewed version to the examiner, get conversational approval, then call record_finding on forensic-mcp.

The withdrawal rule

Withdraw only when re-run output contradicts a fact in the observation: the event is absent, the value differs, the file doesn't exist.