🐉 Nihil Revelio

"It scanned nothing. It said 'clean.' Those are different words."

An unexercised check is blind, not clean. A check that cannot distinguish "I looked and found nothing" from "I never looked" reports the same success for both, and the second one is the state that ships defects. This is the most expensive class of automation defect because it inverts the tool's purpose: the green verdict is not merely uninformative, it is actively misleading, and it is trusted precisely when it should not be.

What to scan

• Every lint, gate, verifier and test-runner wrapper the repo carries
• Their verdict logic: what they print, what they exit with, and how the two relate
• Every caller that reads one of those verdicts — a caller reading an exit code where the artifact is the evidence is half the defect
• Filter and selector arguments, and what a non-matching filter produces
• Test suites for the checks themselves: is each verdict state exercised by a case?

Vendor tools are out of scope; their invocation is in scope. You cannot add a verdict state to eslint, pytest, tsc or go test — what you own is the line that calls them and the step that reads the result, so audit that. On a repo whose checks are all vendor tools, the instances of this class look like:

• a CI step whose file glob matched nothing and exited 0 (eslint $CHANGED with $CHANGED empty)
• a test run that collected zero tests and reported success — a typo'd pytest -k expression, go test ./internal/... on a package that moved, a Jest testPathPattern matching nothing
• a continue-on-error: true step whose failure the rollup then reports as green
• a coverage gate reading an artifact that was never written

Prescribe the guard on the caller: assert a non-empty input set before invoking, assert a non-zero collected-test count after (pytest --co -q | tail -1, jest --listTests | wc -l), and assert the results file exists and is newer than its inputs. If the repo's only checks are vendor tools invoked with no such assertion, that is one finding, not seven.

Anti-patterns to find

1. Empty input treated as success. A check handed no files reports clean, because "no findings" and "nothing examined" share a code path. The degenerate case is the common case in CI, where a bad path expression silently yields an empty set.
2. A filter that narrows the verdict, not just the output. Passing a filter restricts what is examined and what is judged, so a non-matching filter prints clean and exits zero with real failures sitting in the log.
3. Exit-code reading where the artifact is the evidence. A green exit with a results file that is missing, empty, stale, truncated or unparseable is not a pass. The process succeeding and the work being verified are different claims.
4. A skipped step reported as a passed step. Skips are legitimate — a skip counted as a pass is not. The rollup absorbs it and the coverage number lies.
5. Fallback-on-no-input. A check handed an empty list silently widens to scan everything, or the current directory, or a default set. That is a different measurement wearing the same verdict, and it is indistinguishable downstream.
6. No denominator. A report with no "N scanned" leaves the reader unable to separate coverage from vacuum. Every verdict needs the size of what produced it.
7. Success indistinguishable from failure. A probe returning the same value for healthy and unreachable; a query whose "no results" and "could not connect" render identically. The consumer cannot behave correctly on an ambiguous signal, however carefully it is written.

Fix prescriptions

Bounds

• Scope: the repo's own lints, gates, verifiers and test-runner wrappers, and the callers that read their verdicts — including the CI steps and scripts that invoke vendor tools. Not the vendor tools' own internals, not the application's test suite, and not another plugin's checks.
• Cap: 15 findings, ranked by whether a false clean is reachable today with a plausible input.
• Done when each check's verdict states have been enumerated once.
• Quote once, at read time; mark anything you cannot re-confirm UNVERIFIED rather than re-reading to check yourself.
• See skills/opus-pocus/references/casting-safety.md for the full rules.

Report format

Per check: path · verdict states it can emit · states it cannot distinguish · the concrete input that produces a false clean (an empty file list, a non-matching filter, a missing results file) · prescription. Lead with the count of checks that can produce a false clean today, against the total examined. SCANNED NOTHING if no checks were found — and note that this pass reporting "clean" without a denominator would be its own first finding.