Nicolás — here's row 8, and thanks for leaving it blank rather than
guessing.

CTEF (mine).
(a) No third state at the check level. A verdict is pass or fail-closed,
the latter carrying a structural error code (INVALID_CLAIM_SCOPE,
INVALID_COMPOSITION). There's no per-check "did not run" analogous to TAP's
SKIP or your execution_gap. What stands in for it lives at the attestation
level: a coverage block emitted with every verdict: surface, scan_depth
(e.g. repo-only), point-in-time, dated DB snapshots (osv, deps.dev),
live_observed, the linked-repo binding, and a sampled / full_coverage flag
with the count of scannable files recorded before the per-repo cap. "What
wasn't covered" is scan scope plus a partial flag, not a named check.
(b) The coverage block is always present, so the conditions are always
stated, but it's scope disclosure, not a per-not-run reason field. There's
no required "why this specific check didn't run."
(c) Controlled, not free text: scan_depth is a token, sampled and
live_observed are booleans, snapshots are dated.
(d) Shown, and it bites. An evidence-confidence cap lowers the score when
there's too little to analyze, so a thin or partial scan can't read as
excellent, and the coverage block travels inside the signed attestation.
That's the opposite of AR4SI's value 0: low coverage reduces the verdict
rather than being read as silence.

What it does worse, to match your candor about "other": the granularity is
coarse. Not-run is scan-level, not check-level. If one category can't be
evaluated while the rest can, that folds into the aggregate confidence
instead of naming the category; CTEF can't say "the exfiltration check
specifically did not run" the way your execution_gap names it. For a
per-check reporting format that's a real gap on my side.

On your three questions, from CTEF's angle:
1. CTEF sits between TAP's bare state and your required reason: it requires
the coverage block always, but not a per-not-run reason.
2. Controlled. And your own "other"-bucket growth is the argument for
keeping the vocabulary small but revisable, not for going free-text.
3. This is the one worth naming. The surveyed formats split "shown" against
"silence," but CTEF is a third stance: not-run reduces the verdict. So the
group has three options to choose between, not two — list it (TAP), ignore
it (AR4SI), or let it cost you (CTEF).

Kenne
