Every attached evidence reference must resolve to a real object in the ledger or an upstream service. Unresolved references are reported, never assumed present.

Relationships and chains are deterministic derivations, but they cannot fully verify an incident claim without a resolved observation or artifact.

ATT&CK and other external knowledge may enrich a claim, but cannot independently establish that incident behavior occurred.

Named hosts, users, IPs, files, buckets, byte counts, timestamps, and recognized behavioral predicates must occur in the cited incident evidence.

A claim that requires an absent telemetry class is constrained and records the missing source as a coverage gap.

A claim requires at least one resolved supporting reference. A claim with no resolvable support cannot be SUPPORTED.

Support may not depend on references that cannot be produced. Unresolved supporting references are demoted, and their absence is surfaced as a coverage gap.

Any resolved contradicting reference forces a CONTRADICTED verdict regardless of supporting evidence.

The claim's classification must match its evidence. An OBSERVED claim with no resolved observation is flagged as inconsistent.

Timestamps carried on references, where present, must be well-formed and internally consistent.