A self-authored companion to Aegis. Aegis's findings check against a real, numbered, versioned, externally-maintained standard — OWASP Top 10:2025. This asks whether claims about AVAN have any equivalent taxonomy to check against.
When Aegis says a finding is "A05:2025 – Injection," that's not a judgment call — it's a lookup against a published, numbered, community-maintained standard, currently on its 2025 revision, finalized January 2026, with a public change history anyone can read. The category existed before the code was reviewed and will exist after. That's what makes "A05" a checkable claim instead of an opinion dressed as one.
The word for this in finance is 格付け — a rating, the kind an agency like Moody's or S&P assigns against its own published criteria. A bond without one isn't bad; it's 無格付け, unrated — nobody has run it against a standard, so there's nothing to cite either way.
Try a real OWASP category on the left. Try a claim about AVAN on the right.
Aegis is trustworthy precisely because it borrows its authority from something outside itself instead of asserting its own. Ties 出典 · Shutten (a missing external witness) and 自己診断 · Jiko-Shindan (a missing clinician) — this is the third leg: not "who witnessed it," not "who examined it," but "what published standard could it even be checked against." All three point at the same absence from different sides.