How Evidence-Finding-Path.md Connects with Completion Checklist Requirements

The evidence-finding-path.md specification defines the mandatory Evidence → Finding → Path data structures that the completion checklist validates before marking any security task as finished.

The reverse-skill repository uses a rigorous documentation-driven workflow where task completion is gated by a formal checklist. The skills/ops/evidence-finding-path.md file provides the schema and constraints that this checklist enforces, creating a direct link between documentation standards and task readiness.

---

What the Completion Checklist Requires

In RULES.md, the project establishes a hard rule: task completion equals all checklist items checked【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/RULES.md†L221-L224】. The checklist covers multiple dimensions including evidence collection, finding validation, path documentation, and final report generation. No case can advance to the ACT phase until every required element is present and correctly formatted.

---

How Evidence-Finding-Path.md Satisfies Checklist Items

The specification file breaks down into structural requirements that map directly to checklist gates. Below are the core connections between the document's rules and checklist enforcement.

Evidence Must Exist and Be Referenced

The checklist requires non-empty evidence for any finding. evidence-finding-path.md codifies this in line 26: "Finding must reference at least one Evidence" with the constraint that evidence_ids cannot be empty【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L26-L27】. For validated findings specifically, lines 62-63 reinforce that evidence IDs must be populated and confidence ratings cannot be "low" without documented residual risk【L62-L63】.

Validated Findings Require Sufficient Evidence

The specification distinguishes between draft and validated findings. Lines 25-30 establish the "Validated sufficiency" rule: validated findings need at least two independent pieces of evidence【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L25-L30】. The checklist references this rule as a must condition for upgrading a finding's status from draft to validated.

Path Documentation Links Evidence to Outcomes

Every completed task needs at least one Path. Lines 64-87 define the Path schema (P-{nnn}) where each step can reference both Evidence (evidence: E-xxx) and Finding (finding: F-yyy)【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/ops/evidence-finding-path.md†L64-L87】. The checklist enforces this through its "报告中的位置" (position in report) requirement, mandating that the final security report contain Evidence, Findings, and at least one Path【L90-L96】.

---

Runtime Enforcement Through Scripts

The connection between specification and checklist is not merely documentation—it's actively enforced by initialization and verification scripts.

Case Initialization Embeds the Checklist

The skills/scripts/case-init.sh and case-init.ps1 scripts create new case directories with the checklist structure pre-populated. When a case starts, the checklist is already present in the metadata, ensuring analysts know which evidence-finding-path elements must be completed before the case can proceed.

Verification Gates Task Completion

Before any case moves to ready_for_act status, skills/scripts/verify-routing-coherence.ps1 validates compliance. Lines 281-351 of this script check that:

• All required Evidence entries exist and are properly referenced
• Findings have sufficient evidence counts for their status level
• At least one Path document connects the evidence to operational outcomes

Failure on any checklist item blocks progression, forcing remediation.

---

Practical Implementation: Checklist-Compliant Structures

The following markdown structures satisfy the evidence-finding-path requirements when placed in a case's work/<case>/ directory. These examples demonstrate the exact format the checklist validator expects.

Evidence Entry (E-001)

### E-001

- title: Suspicious PowerShell command
- observed_at: 2026-08-19T10:12Z
- source_type: command
- source_ref: scripts/collect-data.ps1
- content_hash: n/a
- artifact_path: n/a
- repro_command: |
    powershell -File scripts/collect-data.ps1
- raw_excerpt: |
    Get-Process | Where-Object {$_.CPU -gt 100}
- linked_workitem: WI-10
- supersedes: none

Finding Entry (F-001) Referencing Evidence

### F-001

- title: Privilege-Escalation via Unrestricted PowerShell
- severity: high
- category: vuln
- status: validated
- evidence_ids: [E-001, E-002]
- location: scripts/collect-data.ps1:12
- impact: Attacker can execute arbitrary commands as SYSTEM
- confidence: high
- repro_steps:
  1. Run the PowerShell script
  2. Observe elevated privileges
- remediation: Restrict PowerShell execution policy
- optional_attack: T1059.001

Note: A validated status requires two or more evidence IDs as specified in lines 25-30.

Path Entry (P-001) Connecting Evidence and Findings

### P-001

- title: Exploit Chain – From Data Collection to Privilege Escalation
- path_type: attack
- start: Initial reconnaissance
- goal: Obtain SYSTEM rights
- steps:
  1. action: Execute data-collection script — evidence: E-001 — finding: F-001
  2. action: Escalate via script vulnerability — evidence: E-002 — finding: F-001
- residual_risks: None

---

Reporting Integration

The final security report must contain all three elements in prescribed sections. The docs-generator/references/security-report-templates.md file defines these report structures, ensuring that checklist-compliant documentation automatically produces checklist-compliant reports. This closes the loop: the specification defines the structure, the checklist mandates its presence, and the generator produces the deliverable.

---

Summary

• evidence-finding-path.md provides the schema for Evidence, Finding, and Path documentation that the completion checklist validates.
• RULES.md establishes that task completion requires all checklist items to be checked, including evidence chain completeness.
• Key constraints include: non-empty evidence_ids for all findings, ≥2 evidence items for validated findings, and at least one Path per case.
• Verification scripts (verify-routing-coherence.ps1 lines 281-351) enforce these rules at runtime, blocking progression until compliance is achieved.
• Report templates ensure checklist-compliant documentation produces compliant final deliverables.

---

Frequently Asked Questions

What happens if a finding references only one piece of evidence?

A finding with only one evidence reference can remain in draft status indefinitely. To upgrade to validated, the specification requires at least two independent evidence items according to the "Validated sufficiency" rule in lines 25-30 of evidence-finding-path.md. The checklist enforces this as a hard gate.

Can a Path exist without linking to specific evidence?

No. While Path creation is required (checklist: "at least one Path"), each step should reference relevant Evidence and Finding entries per lines 64-87. The verification script checks for these linkages to ensure the chain of reasoning is reproducible.

Where does the checklist physically live in a case directory?

The checklist is embedded in case metadata during initialization by skills/scripts/case-init.sh or case-init.ps1. Analysts interact with it through the case management interface, while automated tools like verify-routing-coherence.ps1 validate the underlying evidence-finding-path documentation against checklist requirements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}