Philippines staffing research · August 14, 2026

Evidence for assessing outsourced developer capability

Evidence for assessing outsourced developer capability. An evidence-led research note for software teams.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 1 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 2 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 3 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 4 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 5 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 6 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 7 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 8 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 9 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 10 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 11 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 12 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 13 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 14 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 15 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 16 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 17 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 18 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 19 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 20 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 21 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 22 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 23 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 24 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 25 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 26 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.

Research on capability evidence should use a representative work sample rather than a title, a one-time impression, or an unbounded promise. NIST SSDF and GitHub review records provide useful principles, but the local product determines the actual observation. The study should define the affected cohort, period, owner, expected behavior, and evidence that would change the decision. In outsourced programming, that precision matters because a contributor works inside constraints created by another organization. The evidence for capability evidence begins with a bounded task and named outcome. score comprehension, implementation, verification, communication, and security judgment separately. Record inputs, assumptions, expected result, checks, unresolved risks, and authority boundary. A reviewer should distinguish implementation from waiting, missing context, scope change, and owner-controlled decisions. The contributor explains observations; the company owner decides acceptance, sensitive access, customer impact, and release authority. Preserve what was not tested, report denominator and period, inspect failure and recovery states, and state limitations. a sample predicts similar work, not an entire career This is finding 27 in a deliberately bounded evidence model: it describes what can be observed, what cannot be inferred, and which decision remains with the client.