# How to Use the Evidence-Finding-Path Chain for Documentation in Reverse-Skill

> Learn to use the Evidence-Finding-Path chain for auditable documentation in reverse-skill. Link observations to conclusions and narrative for traceable, reproducible reports. Enhance your documentation now.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-02

---

**The Evidence-Finding-Path (E-F-P) chain enforces an auditable documentation trail by linking immutable observations (Evidence) to analytical conclusions (Finding) and narrative flow (Path), ensuring every report in reverse-skill is traceable and reproducible.**

The reverse-skill framework requires rigorous documentation standards for security assessments and reverse-engineering projects. The Evidence-Finding-Path chain serves as the backbone of every generated report, establishing a contractual relationship between raw data and final conclusions as defined in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md). By following this specification, teams create automatically auditable documentation that satisfies compliance requirements.

## Understanding the Three Components of the E-F-P Chain

### Evidence: Immutable Observations

Evidence records capture raw observations as Markdown files with specific required fields. Each entry must include a title, timestamp, source type (such as command, screenshot, file, or log), a reproducible command, a content hash for integrity verification, and optional links to work-items. According to the contract in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md), Evidence entries must remain immutable once recorded to preserve the integrity of the audit trail.

### Finding: Analytical Conclusions

Findings represent the security or reverse-engineering conclusions derived from Evidence. Each Finding must reference at least one Evidence ID through the `evidence_ids` field and cannot be marked *validated* when confidence is low unless a residual risk is explicitly noted. Required fields include severity level, category, status, confidence rating, location, and remediation guidance.

### Path: Narrative Flow

The Path component provides the ordered steps that explain how Evidence and Findings combine into an attack vector, call-flow, or solution narrative. Each step may reference specific Evidence and Finding IDs, allowing readers to trace the logical progression from initial observation to final outcome. Paths support types such as `attack` or `solution` depending on the documentation context.

## Creating Evidence Records

Use the PowerShell helper script to append new Evidence entries while ensuring all required metadata is captured:

```powershell
powershell -File skills/scripts/append-evidence.ps1 `
  -CaseRoot work/MyCase `
  -Id E-001 -Title "nmap scan of 10.10.10.5" `
  -ReproCommand "nmap -sV -p- 10.10.10.5" `
  -Severity info -Status observed

```

The script located at `skills/scripts/append-evidence.ps1` automatically generates the content hash and timestamp, storing the record in the case directory structure.

## Linking Findings to Evidence

Create Finding entries that explicitly cite their supporting Evidence through the `evidence_ids` array:

```markdown

### F-001

- title: Open service on port 445
- severity: high
- category: misconfig
- status: validated
- evidence_ids: [E-001]
- location: 10.10.10.5:445
- impact: Allows SMB enumeration
- confidence: high
- remediation: Restrict SMB to trusted hosts

```

As specified in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md), every Finding must cite at least one Evidence ID, creating the mandatory bi-directional link that auditors require.

## Building the Path Narrative

Construct Path records that map the logical flow between your Evidence and Findings:

```markdown

### P-001

- title: Lateral movement via SMB
- path_type: attack
- start: Initial foothold
- goal: Access internal file share
- steps:
  1. action: nmap scan — evidence: E-001 — finding: F-001 | none
  2. action: Pass-the-Hash — evidence: E-002 — finding: F-002 | none

```

Each step references specific Evidence and Finding IDs using the pipe-delimited format, enabling granular traceability through the narrative.

## Report Generation Requirements

The security report templates in [`skills/docs-generator/references/security-report-templates.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/references/security-report-templates.md) enforce strict inclusion of the E-F-P chain. Generated reports must follow this exact sequence:

1. **Scope summary** – Links to `work/<case>/scope.md`
2. **Evidence table** – Contains at least one Evidence record
3. **Findings list** – Each entry displays its associated Evidence IDs
4. **Path** – At least one Path record describing the attack or solution flow
5. **Optional Timeline** – Summary of key events (linked via [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md))

Generate the final report using the CLI:

```bash

# Assuming you have completed the case under work/MyCase

generate-report --case work/MyCase --type pentest

```

## Integration with Field-Journal Subsystem

The E-F-P chain integrates with the field-journal subsystem to create de-identified journal entries. The system extracts up to three headline Evidence IDs, one core Finding, and a concise Path sentence for inclusion in the journal, maintaining privacy while preserving analytical structure.

## Summary

- The Evidence-Finding-Path chain in reverse-skill creates an immutable audit trail from raw data to final conclusions.
- Evidence records require timestamps, source types, reproducible commands, and content hashes as defined in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md).
- Findings must reference at least one Evidence ID via `evidence_ids` and cannot be validated with low confidence without noting residual risk.
- Paths provide ordered narrative steps that explicitly link Evidence and Finding IDs for full traceability.
- Report templates enforce the inclusion of all three components in the specific order: Scope, Evidence, Findings, Path, Timeline.

## Frequently Asked Questions

### What is the minimum required Evidence for a Finding?

A Finding must cite at least one Evidence ID in its `evidence_ids` field. According to the contract in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md), Findings without supporting Evidence references violate the schema and will fail validation during report generation.

### Can a Path reference multiple Findings in a single step?

Yes. Each step in a Path can reference both an Evidence ID and a Finding ID using the format `evidence: <ID> — finding: <ID> | none`. This allows complex attack chains where multiple observations support a single conclusion, or where one Finding depends on several pieces of Evidence.

### How does the system prevent tampering with Evidence records?

Evidence entries include a content hash and are designed to be immutable once created. The `skills/scripts/append-evidence.ps1` helper calculates the hash automatically, and the specification treats any modification after creation as a violation of the audit contract.

### Where does the E-F-P chain fit in the overall reverse-skill workflow?

The [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) file maps specific workflow steps to required Evidence, Finding, and Path creation. The chain also integrates with [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) to link timeline entries to Evidence, ensuring complete chronological and logical coverage across the entire engagement.