A candidate is not a confirmed finding.
RedDepth treats independent reproduction as a separate job. A testing agent can surface a candidate, but another agent must reproduce it from the evidence alone before the result is called confirmed.
AI output needs a second view.
A candidate finding is a useful lead. It is not yet a safe conclusion. The original testing path may have mistaken an application response, misunderstood a role boundary, lost a prerequisite, or inferred impact that the evidence does not support.
Independent validation creates a deliberate break between discovery and confirmation. The validator sees the recorded evidence and the return contract, not the original agent's confidence or reasoning. That makes the question narrower and more testable: can another process reproduce the condition?
Independent does not mean infallible. It means the same reasoning is not allowed to certify itself.
Four steps from signal to decision.
- Candidate recordedThe testing pass captures the affected asset, request and response context, preconditions, observed behavior, and the proposed impact.
- Evidence isolatedThe validation pass starts from the evidence needed to reproduce the condition. It does not inherit the original explanation as fact.
- Reproduction attemptedA separate agent checks whether the condition can be recreated within the authorized scope and whether the claimed boundary or state transition actually holds.
- Result classifiedThe outcome becomes validated, unresolved, or rejected, with the evidence and limitations preserved for human review.
The summary never replaces the raw record.
A report is only as useful as the path back to what happened. RedDepth links a validated finding to the affected asset, reproduction steps, preconditions, evidence references, impact, remediation direction, and known limitations.
This is especially important for researchers and small teams whose reputation depends on being able to explain a result to a program owner or client. The evidence link makes review possible before anything is submitted, escalated, or handed over.
Validation is a control, not a guarantee.
- Human review still decides whether a finding is appropriate to submit or deliver.
- The tester must still follow the target's rules of engagement and current AI-submission policy.
- A reproduced condition can still be low impact, out of scope, or incorrectly classified; context remains part of the review.
- RedDepth does not claim zero false positives or complete coverage.