The question is correctly aimed, but it is still one layer too late.
The framework should not merely attach a confidence label to each recommendation. It should define which evidence state is admissible for which governance action.
A scalar confidence score is not an evidence model. It compresses different epistemic conditions into one number and therefore hides the exact distinction the framework needs to preserve.
“Observed,” “mechanistically explained,” “historically traced,” and “authorization-proven” are not stronger and weaker versions of the same fact. They are orthogonal dimensions.
A current state may be fully observed while its causal path remains unexplained.
A historical transition may be reconstructed while the authority behind it remains unproven.
An oracle value may be source-authentic while its economic interpretation remains partial.
A recommendation may be directionally correct while still resting on an incomplete transition history.
The correct object is therefore not a confidence label but an evidence vector.
For every material recommendation, parameter path, oracle path, freeze, unfreeze, cap change, or deprecation decision, the record should separately state:
- Observed state — what is directly present in the current on-chain or externally attested state.
- Mechanistic explanation — which contract path, accounting rule, oracle transformation, bridge route, or administrative process produced that state.
- Historical trace — whether the relevant transition sequence has been reconstructed rather than inferred from the terminal state.
- Authorization proof — whether the actor, quorum, timelock, role, mandate, or governance path that caused the transition is proven.
- Provenance — which source produced each fact, whether sources are independent, and whether the evidence is primary or derivative.
- Freshness — whether the evidence still describes the state on which the recommendation will act.
- Counterfactual and path-equivalence status — whether materially different execution paths can reach superficially similar terminal states while allocating risk or value differently.
- Unknown boundary — what remains unavailable, unresolved, contradictory, or not testable.
Each dimension should use explicit states such as:
Verified / Reproduced / Partial / Unknown / Contradicted / Not Applicable
“Unknown” must not be treated as zero risk.
“Not observed” must not be treated as “did not occur.”
“Not applicable” must not be merged with “unproven.”
“Contradicted” must remain distinct from “incomplete.”
The next requirement is an action-admissibility rule.
The evidence required should depend on the reversibility, blast radius, time sensitivity, and distributional effect of the action.
A defensive, one-directional cap reduction may be admissible from a fresh, source-authentic adverse signal because delay itself creates risk and the action only constrains exposure.
An unfreeze, cap expansion, collateral enablement, oracle replacement, or deprecation decision requires a stronger surface: current state, causal mechanism, historical transition, authorization, provenance, and explicit treatment of unresolved evidence.
An irreversible or participant-specific consequence requires more again: address-level evidence, alternative explanations, reproducibility, and a contestable review path.
This is where the framework’s current four-layer structure needs a lower layer beneath it.
Asset Risk, Bridging Risk, Monitoring / Automated Risk Oracles, and Chain Risk describe what classes of risk are governed.
The evidence layer must define what may be claimed, what may be inferred, and what action is justified from the available proof.
A controlled liquidation-path example shows why this distinction is operational rather than philosophical.
Two executions can begin from the same state, cover the same total debt, end with the same borrower debt, and conserve the same total collateral, while distributing value materially differently because the amount was partitioned across calls.
A terminal-state view can therefore be correct and still be explanatorily incomplete.
In that case:
- the final state is observed;
- conservation is verified;
- the transition path must be reconstructed;
- path equivalence must be tested;
- the allocation mechanism must be explained;
- the broader systemic consequence may remain partial.
Collapsing those conditions into “high confidence” would erase the most important fact: state equivalence does not imply route equivalence.
The same problem appears across the proposed framework:
- a bridge balance can reconcile while verifier authorization remains uncertain;
- an oracle value can be fresh while the adapter path is historically divergent;
- a freeze trigger can be valid while the source dependency is not independent;
- a deprecation recommendation can be economically reasonable while the wallet-level distribution of loss remains unexamined;
- a chain can satisfy current availability metrics while its recovery authority remains concentrated.
For that reason, every material risk recommendation should carry a compact evidence record with at least:
- the exact claim being made;
- the evidence vector;
- the source and timestamp of every material fact;
- the transition path, where relevant;
- the authorization path, where relevant;
- the unresolved and contradictory evidence;
- the action class the evidence is permitted to support;
- the conditions that would invalidate or reopen the recommendation;
- the review and appeal surface.
The central governance question is therefore not:
How confident is the recommendation?
It is:
Which parts of the recommendation are observed, explained, historically reconstructed, authorization-proven, counterfactually tested, and still unresolved — and what action is admissible from that exact evidence state?
If the framework formalizes that mapping, it becomes more than a taxonomy of risks.
It becomes a decision system in which no recommendation can silently claim more epistemic authority than its evidence actually contains.