skeptical-triage

Skeptical Triage

Filter false positives from multi-angle review, security audit, QA regression flags, or any high-stakes judgment before it turns into a blocker.

Three rounds of skeptical self-review + an impartial arbiter, with a confidence score from the vote.

When to invoke

Caller	Finding type	Apply triage?
/review	Angle 2/4/7/9 P0/P1 (security, SQL, privacy, concurrency)	Yes
/review --deep	Any angle P0/P1	Yes
security-officer	CSO audit P0/P1	Yes
security-officer	Secret in source/git, confirmed CVE	No — hard finding
qa-engineer	Flaky-test verdict (is this a regression or flake?)	Yes
architect	ADR trade-off dispute (option A vs. B when both look reasonable)	Yes
Any	P2/advisory	No

The 4-step pattern

Run these sequentially. Each round sees prior reasoning. Arbiter sees all rounds.

Round 1 — Reachability / Premise

Question: is the premise true?

• For security/reliability: can an external attacker reach this code path with untrusted input? Trace input flow backward from the bug site to its origin. If only trusted internal callers → lean INVALID.
• For regressions: does the failing behavior reproduce from a clean state on the target branch?
• For ADR trade-offs: is the constraint that forces the choice actually binding? (e.g. "we need <10ms p99" — is that real or aspirational?)

Output: {round: 1, verdict: VALID|INVALID|UNCERTAIN, reasoning: "...", crux: "single key fact"}

Round 2 — Verify cited defenses / counter-evidence

Question: are claimed defenses real and sufficient?

• Every cited defense → use Grep to find its actual implementation line.
• Resolve constant names to numeric values. MAX_BUF_SIZE is not a verified bound — #define MAX_BUF_SIZE 64 is.
• For regressions: is the cited "test covers this" actually asserting the right invariant?
• For ADR: is the cited benchmark/precedent real (grep for it, read it), or rumored?