# How Evidence-Finding-Path.md Connects with Completion Checklist Requirements

> Discover how evidence-finding-path.md structures data to meet completion checklist requirements for security tasks. Understand the mandatory Evidence Finding Path validation.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-19

---

**The [`evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/evidence-finding-path.md) specification defines the mandatory Evidence → Finding → Path data structures that the completion checklist validates before marking any security task as finished.**

The `reverse-skill` repository uses a rigorous documentation-driven workflow where task completion is gated by a formal checklist. The [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md) file provides the schema and constraints that this checklist enforces, creating a direct link between documentation standards and task readiness.

---

## What the Completion Checklist Requires

In [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), the project establishes a hard rule: **task completion equals all checklist items checked**【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/RULES.md†L221-L224】. The checklist covers multiple dimensions including evidence collection, finding validation, path documentation, and final report generation. No case can advance to the ACT phase until every required element is present and correctly formatted.

---

## How Evidence-Finding-Path.md Satisfies Checklist Items

The specification file breaks down into structural requirements that map directly to checklist gates. Below are the core connections between the document's rules and checklist enforcement.

### Evidence Must Exist and Be Referenced

The checklist requires non-empty evidence for any finding. [`evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/evidence-finding-path.md) codifies this in line 26: **"Finding must reference at least one Evidence"** with the constraint that `evidence_ids` cannot be empty【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L26-L27】. For validated findings specifically, lines 62-63 reinforce that evidence IDs must be populated and confidence ratings cannot be "low" without documented residual risk【L62-L63】.

### Validated Findings Require Sufficient Evidence

The specification distinguishes between draft and validated findings. Lines 25-30 establish the **"Validated sufficiency"** rule: validated findings need **at least two independent pieces of evidence**【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L25-L30】. The checklist references this rule as a **must** condition for upgrading a finding's status from `draft` to `validated`.

### Path Documentation Links Evidence to Outcomes

Every completed task needs at least one Path. Lines 64-87 define the Path schema (`P-{nnn}`) where each step can reference both Evidence (`evidence: E-xxx`) and Finding (`finding: F-yyy`)【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L64-L87】. The checklist enforces this through its **"报告中的位置"** (position in report) requirement, mandating that the final security report contain Evidence, Findings, and at least one Path【L90-L96】.

---

## Runtime Enforcement Through Scripts

The connection between specification and checklist is not merely documentation—it's actively enforced by initialization and verification scripts.

### Case Initialization Embeds the Checklist

The [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) and `case-init.ps1` scripts create new case directories with the checklist structure pre-populated. When a case starts, the checklist is already present in the metadata, ensuring analysts know which evidence-finding-path elements must be completed before the case can proceed.

### Verification Gates Task Completion

Before any case moves to `ready_for_act` status, `skills/scripts/verify-routing-coherence.ps1` validates compliance. Lines 281-351 of this script check that:
- All required Evidence entries exist and are properly referenced
- Findings have sufficient evidence counts for their status level
- At least one Path document connects the evidence to operational outcomes

Failure on any checklist item blocks progression, forcing remediation.

---

## Practical Implementation: Checklist-Compliant Structures

The following markdown structures satisfy the evidence-finding-path requirements when placed in a case's `work/<case>/` directory. These examples demonstrate the exact format the checklist validator expects.

### Evidence Entry (E-001)

```markdown

### E-001

- title: Suspicious PowerShell command
- observed_at: 2026-08-19T10:12Z
- source_type: command
- source_ref: scripts/collect-data.ps1
- content_hash: n/a
- artifact_path: n/a
- repro_command: |
    powershell -File scripts/collect-data.ps1
- raw_excerpt: |
    Get-Process | Where-Object {$_.CPU -gt 100}
- linked_workitem: WI-10
- supersedes: none

```

### Finding Entry (F-001) Referencing Evidence

```markdown

### F-001

- title: Privilege-Escalation via Unrestricted PowerShell
- severity: high
- category: vuln
- status: validated
- evidence_ids: [E-001, E-002]
- location: scripts/collect-data.ps1:12
- impact: Attacker can execute arbitrary commands as SYSTEM
- confidence: high
- repro_steps:
  1. Run the PowerShell script
  2. Observe elevated privileges
- remediation: Restrict PowerShell execution policy
- optional_attack: T1059.001

```

**Note:** A `validated` status requires **two or more evidence IDs** as specified in lines 25-30.

### Path Entry (P-001) Connecting Evidence and Findings

```markdown

### P-001

- title: Exploit Chain – From Data Collection to Privilege Escalation
- path_type: attack
- start: Initial reconnaissance
- goal: Obtain SYSTEM rights
- steps:
  1. action: Execute data-collection script — evidence: E-001 — finding: F-001
  2. action: Escalate via script vulnerability — evidence: E-002 — finding: F-001
- residual_risks: None

```

---

## Reporting Integration

The final security report must contain all three elements in prescribed sections. The [`docs-generator/references/security-report-templates.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs-generator/references/security-report-templates.md) file defines these report structures, ensuring that checklist-compliant documentation automatically produces checklist-compliant reports. This closes the loop: the specification defines the structure, the checklist mandates its presence, and the generator produces the deliverable.

---

## Summary

- **evidence-finding-path.md** provides the schema for Evidence, Finding, and Path documentation that the completion checklist validates.
- **RULES.md** establishes that task completion requires all checklist items to be checked, including evidence chain completeness.
- **Key constraints** include: non-empty `evidence_ids` for all findings, ≥2 evidence items for validated findings, and at least one Path per case.
- **Verification scripts** (`verify-routing-coherence.ps1` lines 281-351) enforce these rules at runtime, blocking progression until compliance is achieved.
- **Report templates** ensure checklist-compliant documentation produces compliant final deliverables.

---

## Frequently Asked Questions

### What happens if a finding references only one piece of evidence?

A finding with only one evidence reference can remain in `draft` status indefinitely. To upgrade to `validated`, the specification requires **at least two independent evidence items** according to the "Validated sufficiency" rule in lines 25-30 of [`evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/evidence-finding-path.md). The checklist enforces this as a hard gate.

### Can a Path exist without linking to specific evidence?

No. While Path creation is required (checklist: "at least one Path"), each step **should** reference relevant Evidence and Finding entries per lines 64-87. The verification script checks for these linkages to ensure the chain of reasoning is reproducible.

### Where does the checklist physically live in a case directory?

The checklist is embedded in case metadata during initialization by [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) or `case-init.ps1`. Analysts interact with it through the case management interface, while automated tools like `verify-routing-coherence.ps1` validate the underlying evidence-finding-path documentation against checklist requirements.