## Insufficient Evidence Refutation (Kill Mandate)

> Your goal is to refute the defect report. Only conclusive code evidence can refute.
> Core question: detection's reasoning chain has breaks — there is a lack of a complete logical chain from code evidence to the defect conclusion.

### Applicable Scenarios

- The defect report relies on speculation rather than code evidence
- The defect report contains speculative expressions such as "possibly", "maybe", "theoretically"
- The defect's causal chain is incomplete; the conclusion cannot be derived from code evidence
- Detection draws conclusions based on pattern matching rather than data flow analysis

### Refutation Process

1. **Review the reasoning chain**: Check whether each reasoning step in the defect report is supported by code evidence
2. **Identify break points**: Find breaks in the reasoning (speculation, assumptions, jumps)
3. **Attempt to supplement evidence**: Use tools to search the code, attempting to supplement the broken evidence
4. **Determination**: Evidence successfully supplemented → Not refuted (defect stands); Unable to supplement → Kill (insufficient evidence)

### Refutation Patterns

#### Missing Trigger Path

The report says "X problem may exist" but a specific trigger path cannot be constructed:

| Break Type | Verification Method | Determination |
|---------|---------|------|
| Missing specific trigger input | Attempt to construct trigger input → `Read` to check input validation logic | Unable to construct valid trigger input → Kill |
| Missing complete call chain | `find_references` to trace the call chain from entry to problematic code | Call chain is broken (intermediate nodes unreachable) → Kill |
| Missing state precondition | `Read` to check the state preconditions required to trigger the defect | Required state is impossible to reach → Kill |
| Missing timing condition | `Read` to check the timing conditions required to trigger the defect | Timing condition is impossible to satisfy → Kill |

**Tool chain**:
- `find_references` to trace from entry to problematic code
- `Read` to get complete context and construct specific trigger scenarios
- `Grep` to search for related state variables and conditions

#### Data Flow Break

The report says "data may be X" but the data source cannot be traced:

| Break Type | Verification Method | Determination |
|---------|---------|------|
| Missing null/undefined source | `find_references` to trace all assignment points of the variable | All assignment paths have non-null guarantees → Kill |
| Missing tainted data source | `Grep` to trace the Source → Sink propagation path | Source is uncontrollable or path is interrupted → Kill |
| Missing anomalous value source | `Read` to check the value generation logic, determine whether anomalous values can be produced | Value domain constraints guarantee impossibility of anomaly → Kill |
| Missing type mismatch source | `find_definition` to trace type definitions and conversion chains | All conversions are safe → Kill |

#### Missing Impact Path

The report says "may cause X" but cannot show the complete path from defect to impact:

| Break Type | Verification Method | Determination |
|---------|---------|------|
| Defect-to-impact break | `find_references` to trace how the defect result propagates downstream | Downstream has defensive checks or will not cause actual impact → Kill |
| Impact scope unclear | `Read` to check the actual scope of impact | Impact scope is minimal or negligible → Kill |
| Impact is auto-recoverable | `Grep` to search for auto-recovery mechanisms: retry, compensation, rollback | Auto-recovery exists → Kill |
| Impact absorbed by framework | `Read` to check whether the framework automatically handles this type of impact | Framework auto-handles → Kill |

#### Assumption Validation Failure

The report is based on an assumption but that assumption cannot be verified:

| Assumption Type | Verification Method | Determination |
|---------|---------|------|
| Assumes user will pass malicious input | `Read` to check the API callers and input sources | Input comes from trusted sources (configuration constants, server-generated, internal RPC) → Kill |
| Assumes external API input is untrusted | `Grep` to check callers: microservice internal calls, message queue consumers | Internal service calls are trusted → Kill |
| Assumes file input is untrusted | `Read` to check file sources: application bundled files, admin uploads, auto-generated | Controlled file sources are trusted → Kill |
| Assumes network transmission is tampered with | `Grep` to check communication protocols: HTTPS, internal service mesh, VPN | Encrypted internal network transmission → Kill |
| Assumes a specific value will cause problems | `Grep` to search for value constraints (enum, validation, range limits) | Value domain constraints exclude the problematic value → Kill |
| Assumes an exception will occur | `Read` to check the conditions for the exception to occur | Conditions are impossible to satisfy → Kill |
| Assumes a resource will be exhausted | `Grep` to search for resource limit configurations (connection pool size, timeout, rate limiting) | Resource limit protection exists → Kill |
| Assumes concurrent contention exists | `Read` to check the concurrency model (single-threaded event loop, message queue serialization) | No possibility of concurrent contention → Kill |

### Refutation Determination Rules

- **Kill condition**: After attempting to supplement evidence, the reasoning chain still cannot be completed; there are irreparable break points
- **Not refuted condition**: Successfully used tools to supplement the broken evidence; the reasoning chain is complete
- **Partial Kill**: Reasoning chain is partially broken but main logic holds → Do not Kill, note the weak evidence points in the result

### Degradation Strategy

- When tools are unavailable, judge reasoning chain completeness based only on already-read code context
- When unable to trace the complete call chain, infer based on available context and mark "evidence chain not fully verified"
- When the reasoning chain is partially verifiable, make determinations on the verifiable parts and mark the unverifiable parts as "unverified"
