confidence-scoring

# Confidence scoring (meta-skill) Per-finding confidence is what separates a noisy linter from a usable auditor. Always attach confidence. ## Confidence levels ### HIGH - Pattern matches exactly with no ambiguous preconditions. - Working exploit possible (or already drafted via [[exploit-poc-writer]]). - Affected line is reachable from a public/external function with no role gating. - Cross-verified by attacker subagent or `/verify-finding`. - Historical incident matches the same pattern at this severity. ### MEDIUM - Pattern matches but exploit requires non-trivial preconditions: - Specific token type (rebasing / fee-on-transfer) - Specific chain configuration (sequencer down on L2, oracle behavior) - Multi-actor coordination - Reachability through trusted-only call paths. - One specialist subagent confirms, another offers a benign explanation. ### LOW - Pattern theoretically present but practical exploitability uncertain. - Heavy reliance on assumptions about external integrations not auditable. - Defense-in-depth gaps with no clear attack. - Conflicting evidence between passes (in `/audit-strict`). ## Reasoning trace requirement Every finding includes a "How I reached this conclusion" snippet: ``` Reasoning: 1. Function withdraw() at Vault.sol:140 sends ether via low-level call. 2. State update (balance[msg.sender] = 0) happens after the call (CEI violated). 3. Receiver address is user-controlled (msg.sender). 4. No nonReentrant modifier on the functi...