Most of Your Findings Are False

I went back through the ledger of what my verification layer has told me, and the tally is not flattering.

A threat-model audit handed me five findings. I reproduced all five against live code. All five were wrong. A portfolio dossier claimed roughly twelve of my active repos were weak; live re-verification found two, and of a wider list of twenty-three "weak" repos, twenty-one were archived projects miscategorized as active. A panel of seven reviewer agents audited one config file and returned seven false findings, including two reviewers who reached opposite conclusions about the same mechanism, both wrong. My knowledge vault's health checker flagged about forty-six orphaned notes and a hundred and forty broken links; roughly ninety percent were false positives. The receipts for all of these are already published on this site, mostly in the book, where each got told as its own war story.

These are the instruments I built because I don't trust self-reports. Counted honestly, the majority of what they've ever told me was false.

I've written a lot about what checks catch. The retrieval eval that caught a reranker making search worse. The provenance check that caught two months of contaminated model comparisons. The adversarial tournament that caught seventeen guard bypasses. Those stories are true and I stand by every one. But they're the highlight reel, and a highlight reel is a selection effect wearing a trophy. The full ledger says my verification layer's dominant output, by volume, is noise.

I don't think my layer is unusually bad. I think every verification layer looks like this, and almost nobody counts.

Recall gets designed. Precision gets discovered.

When I build a check, I design for recall: what should this catch, what's the attack, what's the defect class. The check earns its place by catching something, ideally in the demo. Then it ships, and its false positives arrive later, one at a time, each dressed as an incident. The orphan report that cried wolf. The reviewer finding I spent an hour refuting. Nobody budgets for these at design time, because at design time the check has never been wrong yet.

So recall is an engineering discipline and precision is a series of surprises. You can see the bias in what gets written down. My own corpus documents every catch with a number attached, and documents the false alarms as war stories about staleness or drift, as if each were weather. Aggregated, they're the operating regime.

The strange part is that I already own the right metric and use it every day, just never on the instruments. OPERANT, my operator-judgment benchmark, scores agents as true-positive rate minus false-positive rate, deliberately, so that an agent that refuses everything scores zero. Blanket suspicion is worthless; the metric prices that in. I built that metric because I believed calibration, not caution, is what makes an agent trustworthy.

And then I graded my guards, auditors, dossiers, and health checks on recall alone. Score the operator, not the worker, I said. Fine. Now score the guard, not just the agent.

Noise is how verification capital depreciates

I've argued that verification machinery compounds: build the check once, it pays out every session. That's the deposit side. The depreciation schedule is the page I never wrote.

An instrument that fires falsely gets one of three treatments, in escalating order of damage. First it gets tolerated: someone reproduces the finding, sighs, moves on. That costs reproduction time, which is bounded. Then it gets discounted: findings from that instrument start arriving pre-shrunk, "the health checker says, but it always says." Now the instrument still runs, still costs compute and attention, and its true positives get the same haircut as its false ones. Finally it gets disabled or routed around, usually quietly, usually without updating the architecture diagram. The coverage is still claimed. The check is still cited. It just doesn't bind anymore.

That last state is the dangerous one, and I've written about its cousin before: the status line that reported a model that hadn't run in weeks. A disabled-but-still-claimed check is the same lie with better intentions. Your map says instrumented; the territory says muted.

I warned about one corner of this in the sermons essay: over-instrumenting taste produces brittle gates that erode trust until someone turns them off. I treated that as a warning about taste. It's actually a general law about false positives, and taste gates are just where the FP rate is highest. Any check, on any subject, with a bad enough precision record, follows the same arc: tolerated, discounted, muted, still claimed.

Which means precision is the survival condition for the check. A check nobody believes has a recall of zero regardless of what it catches, because catches nobody acts on aren't catches.

The counter-argument I actually believe

Now the tension, because there's a rule in my own practice that cuts the other way, and I'm not willing to give it up.

Some of my guards are conservative by design, and when one of them false-positives on legitimate work, my standing rule says: do not narrow the guard to kill the false positive. Adapt the work instead. My dispatch-policy hook blocks some perfectly legitimate review dispatches because their prompts pattern-match to cheap lookup work; the documented workaround is to reword the dispatch, not to loosen the matcher. That's a deliberate choice to run a guard at a known, annoying false-positive rate.

Is that a contradiction? Only if you think precision has one price. It doesn't. It's priced by blast radius.

A credential-surface guard that false-positives costs me a retry, maybe a rewording, thirty seconds of mild irritation. A credential-surface guard that false-negatives costs me a key. At that asymmetry, you run the guard hot and you pay the noise tax with a smile. Invert the asymmetry and the pricing inverts: a code-review panel that false-positives costs an hour of refutation per finding, and its false negative costs a bug that tests would likely catch anyway. Running that instrument at ninety percent noise is not rigor. It's rigor theater, billed hourly.

So the design rule that falls out is a pricing rule: every instrument gets an explicit precision budget, set by the cost ratio of its two failure modes, and the budget is written down, and the instrument is measured against it. Hard-deny guards on irreversible surfaces get generous budgets. Advisory instruments that consume human attention get tight ones, because attention is the thing they exist to conserve.

What no instrument gets is what they all currently get: an unmeasured budget, which in practice means an unlimited one.

What this looks like as practice

Concretely, four moves, all of which I can start with machinery I already have.

Give every instrument a confusion ledger. When a check fires, the disposition gets recorded: reproduced-true or refuted-false. I already reproduce findings before acting on them; the reproduction discipline is the whole point of the dossier chapter. The only new work is writing the verdict down next to the instrument's name instead of in the finding's grave. A quarter of dispositions gives every instrument a real precision number.

Score instruments bidirectionally, like agents. The tournament that found seventeen bypasses was a recall measurement for my guards. The hundred-and-five-case matrix I ran afterward checked both directions: bypasses blocked, legitimate operations preserved. That matrix was the right idea appearing once as a special event. It should be the standing format. An instrument's score is its catches minus its false alarms, same as an agent's OCS, and an instrument that flags everything scores zero by construction.

Treat "fired and was wrong" as a defect, not weather. A false positive is a bug in the check, with a root cause, deserving the same five-minute autopsy a false negative would get. The vault health checker's ninety percent noise had specific, fixable causes. So did the reviewer panel's seven phantom findings. Noise almost always has structure; unexamined, it just has volume.

Retire below the waterline, out loud. If an instrument's ledger says it's net-negative, attention consumed against catches delivered, it gets repaired or removed, and the removal gets written down so the coverage claim dies with the check. A muted check that still appears in the architecture docs is a map-territory bug, and I've already written that book.

The honest limits, priced

Where this essay's own evidence is thin, and what it would cost to thicken it.

The tally in the opening paragraph is real but reconstructed: those dispositions were recorded because I happened to write essays about them, which is its own selection effect. It's possible my written-up incidents skew toward interesting failures, and interesting failures skew false. The validating measurement is the confusion ledger itself, run forward, prospectively, for one quarter, on every instrument that fired. That's the number this essay stands or falls on, and as of writing I don't have it. I am asserting the regime from four data points and a pattern; a fifth data point that came back majority-true would force a rewrite.

Second limit: the precision-budget-by-blast-radius rule is stated here as doctrine, and I've flagged before what doctrine without telemetry is worth. The two cost ratios I quoted (a retry versus a key; an hour versus a test-catchable bug) are estimates from lived cases, not measured distributions.

Both limits share a fix, which is the essay's own prescription applied to the essay. That's the only way I know to end one of these honestly: the claim gets a check, the check gets a ledger, and the ledger gets to disagree with me in public.

Score the guard like you score the agent. Everything in the shop eventually sits for the same exam, including the examiners. Including this.

Goes deeper in the book → Chapter 4: The Dossier Was Already Wrong