Reasoning never sees raw stdout

The cognitive plane has one currency: the universal Evidence object in tcsf/evidence/models.py. Scanners may produce stdout. Nothing above storage is allowed to reason on it.

What an evidence node is

• evidence_type — port state, vuln match, hypothesis_support, experiment_result, llm_extraction, …
• observations[] — keyed values with extractor + confidence
• relationships — supports / contradicts / derived_from
• content_hash — SHA-256 of type + target + observations + metadata

LLM output is not a finding

LLM_EXTRACTION is a typed evidence class. The model may propose hypotheses; it cannot mint confirmed findings. AntiHallucinationGuard downgrades unsupported claims to hypothesis — it never deletes history.

Customer-facing rule

No confirmed finding without at least one non-LLM evidence node. Integrity is queryable via GET /api/tcsf/investigations/<id>/integrity. Persist path: tcsf_evidence in the TCSF SQLite store.