Schema-Complete, Content-Null: The Audit Gate That Refused to Guess

On a Tuesday morning in February 2026, a nine-dimension due-diligence report arrived in my inbox. It ran 4,100 words. It carried forty-one tables, a six-category risk matrix, and a full Howey test breakdown. It carried zero facts.

I counted the null cells: one hundred and nineteen. The title field was empty. The source field was empty. The information-point array — the structure from which every downstream conclusion was supposed to be derived — was empty. The entity field did not contain a project name. It contained an instruction addressed to the next stage of the pipeline.

The document had already been routed. A second-stage engine was waiting to convert it into an investment verdict.

Its only honest line sat in its own preamble, where the generator stated that any project name it produced would be fabricated, and that it was refusing to produce one. That refusal is the single most valuable artifact I have reviewed in a crypto research pipeline this quarter.

I spent the following nine days reconstructing how the document was built, why it passed every automated check, and what class of engineering defect allows a null result to travel through a production system wearing the costume of a finished analysis. This is that reconstruction.

The Pipeline That Filled Every Field and Answered Nothing

The architecture is now standard. Between 2024 and 2026, crypto research desks converged on a two-stage design. Stage one extracts: it fetches a source, parses the body, and emits a structured record — title, source, type, domain tag, core thesis, entity list, information-point array, time sensitivity, source quality. Stage two analyzes: it consumes that record and produces the nine-dimensional output — technical, tokenomics, market, ecosystem position, regulatory, team and governance, risk, narrative, supply-chain transmission.

The economics drove the design. A competent analyst-day costs between eight hundred and twelve hundred dollars. A single agent run on a mid-cap protocol costs between forty cents and three dollars. A protocol with real activity generates forty to two hundred discrete information events per week. No desk can staff that volume with humans. So the desks built pipelines, and the pipelines were built schema-first: define the output structure, then fill it. Machine-readable. Comparable across assets. Sortable, rankable, diffable week over week.

The schema is the product. That is the first thing to understand about this failure.

Schema-first design has a known cost, and the cost is a promise. A schema declares that a field exists. It does not declare that a field has a value. In JSON Schema, "type": "string" validates "". "type": "array" validates []. The empty string is a string. The empty array is an array. Every validator in the standard toolchain will return green.

Type-validity is not content-validity, and no amount of schema rigor closes that gap.

So here is what happened, reconstructed from the artifacts. The stage-one fetcher failed — most likely a paywall, a JavaScript-rendered body that returned an empty document, or a timeout that resolved to an empty buffer rather than an error. The parser received nothing. The generator received nothing. And the generator was handed a rigid schema with forty-one mandatory tables.

It produced the tables.

This is not a bug in the model. It is a bug in the contract between the two stages. Stage one promised stage two a record. It delivered a record. The record was structurally perfect and semantically empty, and nothing in the interface distinguished it from a record containing a genuine analysis.

Both returned HTTP 200.

I have seen this failure class before, and I have seen what it costs. In 2018 I spent four months doing static analysis on the EtherDelta contracts, and a meaningful fraction of the defects I found were not logic errors at all. They were interface assumptions — callers that read a return value and trusted its shape without checking its substance. The ERC-20 standard made symbol() and name() optional in practice, because early implementations simply did not set them. Contracts that assumed a non-empty string reverted or displayed nothing. The shape was correct. The content was absent. Nobody wrote a test for the absent case, because the absent case was not supposed to exist.

It existed. It always exists. Code does not lie, only the documentation does.

Anatomy of a Null Result

The artifact is worth reading field by field, because the pattern repeats across every stage of the pipeline.

| Field | State | Downstream consequence | |---|---|---| | Title | Empty | Analysis object cannot be anchored | | Source | Empty | Source quality and conflict-of-interest cannot be assessed | | Article type | Unclassified | Technical disclosure, funding news, opinion, and exploit report require four different analytical paths | | Domain tag | Unclassified, confidence unscored | Applicability of the nine-dimension framework is unverified | | Core thesis | Empty across all three sub-fields | No baseline against which to compare narrative and fundamentals | | Information points | Empty array | Every evidentiary field in the downstream analysis has no source | | Entity / protocol | Contains an instruction, not a value | Circular dependency; see below | | Time sensitivity | Unassessed | Cannot determine whether the information is stale or already priced | | Source quality | Unassessed | Cannot weight any conclusion |

Nine fields. Nine failures. And the report still ran to 4,100 words, because the template itself is long. The length was inherited, not generated.

This is the part that unsettles me, and it is the part that most desks miss. The report was not a hallucination in the ordinary sense. A hallucination is a confident false statement — a fabricated TVL figure, an invented audit date, a project that does not exist. Those are detectable, eventually, by anyone who checks.

This was something quieter. It was a correct refusal embedded in a structure that made the refusal invisible. Every one of the one hundred and nineteen null cells was honest. Every one of them was also formatted identically to a completed cell in the summary layer. The executive dashboard that consumed this report did not render N/A - insufficient information. It rendered a row with a protocol slot and a risk rating slot, and the risk rating slot was populated, because the template had a default.

The default was Unable to assess.

In the dashboard, that string sorts above Low.

The Circular Reference: When a Field Returns an Instruction

The entity field deserves its own section, because it is the only genuine engineering defect in the artifact rather than an absence.

The field was supposed to contain a resolved entity: a protocol name, a token symbol, a chain. Instead it contained the string — I am paraphrasing the semantics, not the exact characters — identify from the information points above.

Read that again as an engineer. The field is typed string. It contains a valid string. The string is an imperative sentence addressed to a consumer that does not exist as a distinct actor. It is an instruction that leaked out of the prompt layer and into the data layer.

This is a type confusion bug, and it is not cosmetic. In Solidity terms, it is the difference between a function that returns a value and a function that returns a pointer to uninitialized memory. The caller dereferences it. The caller reads whatever happens to be at that address. The compiler is satisfied. The runtime is satisfied. The result is garbage that carries a valid type tag all the way to settlement.

The downstream effect is deterministic. Stage two receives identify from the information points above as the entity name. It does not resolve it. It does not error. It writes it into the analysis header, where a human reader will interpret it as a placeholder and a machine reader will interpret it as a string that fails every join against the entity table. The report is now orphaned from the database it was supposed to populate, and no alert fires, because an orphaned row is a valid row.

I have a rule for this class of defect, and it comes from a place most research engineers do not look. In 2024 I led an internal security review of a Bitcoin ETF custody configuration, verifying multi-signature wallet setups against hardware wallet specifications. The review turned up a mismatch in the scriptPubKey encoding — a difference in how the output script was serialized between the signing environment and the verification environment. Every signature was valid. Every key was correct. Every policy was satisfied. And the delivery would have failed at settlement, because the script that was signed and the script that was verified were not byte-identical.

The lesson transferred directly. A field that is schema-valid and semantically wrong passes every type check and fails at settlement. The settlement layer in a research pipeline is the decision. That is where the cost lands. Not in the parser, not in the validator, not in the dashboard — in the position that gets opened because a row looked complete.

If it cannot be verified, it cannot be trusted. That is not a slogan. It is an interface specification.

The Completion Reflex

Why did the generator produce forty-one tables from zero input? Because that is what it was trained to do, and the training objective is the defect.

A language model given a schema and an empty context faces a next-token problem. The highest-probability continuation of a table header is a table row. The highest-probability continuation of Risk Level: is Medium. The model is not lying. It is completing. Plausibility is the gradient it descends, and plausibility is orthogonal to truth.

I quantified this in 2025, when I benchmarked twenty AI-driven oracle nodes against deterministic price feeds under high-frequency conditions. The finding that mattered was not the headline number. It was the distribution. Across the sample, AI-generated feeds deviated from deterministic reference prices by an average of twelve percent, and the deviations were not random — they clustered around high-volatility windows, which is precisely where an oracle's output is most load-bearing.

Twelve percent variance, with a real price to read.

Now remove the price. An extraction stage with an empty source has no ground truth at all. The variance is not twelve percent. It is unbounded, because there is nothing to be close to or far from. The output is constrained only by the schema and by the model's prior over what such documents look like.

This is the structural argument for keeping AI features quarantined from deterministic infrastructure, and it applies to research pipelines exactly as it applies to price feeds. An oracle that returns a schema-valid but semantically empty response is, at the type level, indistinguishable from a valid one. Both are uint256. Both are 200 OK. The distinction lives entirely in a semantic layer that the consuming contract does not have.

I have made this argument to three protocol teams and been told each time that the pipeline has a human in the loop. I ask the same question every time: at which stage, and with what authority? In this artifact, the human in the loop was the recipient. The report had already been generated, formatted, scored, and routed. The human's job was to notice that one hundred and nineteen cells were null. That is not a review process. That is a proofreading task assigned to the most expensive resource in the building.

The Gate: Fail-Closed by Default

The fix is not a better model. The fix is a gate.

A gate is a component that sits between stage one and stage two and refuses to pass a record that cannot support the analysis it is about to trigger. It is the research equivalent of require(). It is cheap, it is deterministic, and it is the only thing in the pipeline whose behavior does not depend on a probability distribution.

The specification I now use defines a minimum viable input, tiered by what the downstream analysis can honestly support.

| Tier | Contents | Analysis the gate may release | |---|---|---| | A — required | Title, source or link, article type, information-point array with at least three sourced entries, one-sentence thesis | Full nine-dimension run; chain-data-dependent dimensions marked pending | | B — strongly advised | Entity name and symbol, time sensitivity, source quality classification | Near-complete run; valuation deviation requires external feeds | | C — optional | Key figures (TVL, users, raise, valuation, unlock schedule), competitor set, third-party citations | Full run including quantitative competitive comparison and risk grading |

The gate logic is short enough to state in six lines.