Finding validation

Checks the findings themselves before anyone acts on them: is there proof, can it happen, is it new, how bad is it, is it in scope.

When: Whenever a reviewer, human or model, produces more findings than people will read, or findings that are often wrong.

VA07 tactic

10 techniques

27 sub-techniques

not detectable from CI configuration; no usage counts

ID	Technique	Description	Sub
`V1042`	Evidence-backed verification	Re-checks each finding against the code before it is shown: look for counterevidence, require proof, and refute or suppress what does not hold.	4
`V1043`	Path reachability check	Decides whether the triggering state can reach the flagged line on this code path, given guards, early returns and types.	2
`V1044`	External contract verification	Checks claims about third-party behaviour (an API can return null, a library throws) against authoritative documentation, and grades how strong that proof is.	2
`V1045`	Finding deduplication	Merges findings that describe the same problem from different reviewers, files or runs into one.	3
`V1046`	Severity scoring	Scores a finding from separate evidence axes (impact, persistence, detectability, reachability, scope, certainty) instead of a single guess.	5
`V1047`	Scope and relevance filtering	Keeps only findings that belong to this change: on changed lines, within the PR's intent, and fixable without reworking unchanged code.	3
`V1048`	Noise budget	A fixed cap on how many findings are posted per change, filled in severity order, so the important ones are read.	2
`V1049`	Confidence calibration	Maps a reviewer's confidence to the observed rate of accepted findings and sets the posting threshold from that curve.	2
`V1050`	Reflection pass	A self-critique step where the reviewer re-reads its own findings with fresh context and keeps, revises or withdraws each.	2
`V1051`	Past discussion check	Compares a finding with earlier review discussions: a repeat of something already decided is suppressed, a regression of a fixed issue is raised.	2