Method
Question → evidence → boundary → next evidence layer.
EP Diagnostics stops when evidence is sufficient and continues only when a legitimate unresolved question remains.
- Observe public behaviour. Use bounded, read-only requests and public evidence minimization.
- Separate fact from interpretation. Report what was observed and what remains unknown.
- Stop at the public boundary. Do not reconstruct internal architecture merely because fragments are publicly obtainable.
- Request site-side evidence only when necessary. The owner reviews and authorizes the next layer.
- Keep the investigation read-only. EP reports; a human decides what to change.
- Re-test externally. Verify whether the public behaviour changed after a human correction.
