How to Use the Evidence-Finding-Path Chain for Documentation in Reverse-Skill

The Evidence-Finding-Path (E-F-P) chain enforces an auditable documentation trail by linking immutable observations (Evidence) to analytical conclusions (Finding) and narrative flow (Path), ensuring every report in reverse-skill is traceable and reproducible.

The reverse-skill framework requires rigorous documentation standards for security assessments and reverse-engineering projects. The Evidence-Finding-Path chain serves as the backbone of every generated report, establishing a contractual relationship between raw data and final conclusions as defined in skills/ops/evidence-finding-path.md. By following this specification, teams create automatically auditable documentation that satisfies compliance requirements.

Understanding the Three Components of the E-F-P Chain

Evidence: Immutable Observations

Evidence records capture raw observations as Markdown files with specific required fields. Each entry must include a title, timestamp, source type (such as command, screenshot, file, or log), a reproducible command, a content hash for integrity verification, and optional links to work-items. According to the contract in skills/ops/evidence-finding-path.md, Evidence entries must remain immutable once recorded to preserve the integrity of the audit trail.

Finding: Analytical Conclusions

Findings represent the security or reverse-engineering conclusions derived from Evidence. Each Finding must reference at least one Evidence ID through the evidence_ids field and cannot be marked validated when confidence is low unless a residual risk is explicitly noted. Required fields include severity level, category, status, confidence rating, location, and remediation guidance.

Path: Narrative Flow

The Path component provides the ordered steps that explain how Evidence and Findings combine into an attack vector, call-flow, or solution narrative. Each step may reference specific Evidence and Finding IDs, allowing readers to trace the logical progression from initial observation to final outcome. Paths support types such as attack or solution depending on the documentation context.

Creating Evidence Records

Use the PowerShell helper script to append new Evidence entries while ensuring all required metadata is captured:

powershell -File skills/scripts/append-evidence.ps1 `
  -CaseRoot work/MyCase `
  -Id E-001 -Title "nmap scan of 10.10.10.5" `
  -ReproCommand "nmap -sV -p- 10.10.10.5" `
  -Severity info -Status observed

The script located at skills/scripts/append-evidence.ps1 automatically generates the content hash and timestamp, storing the record in the case directory structure.

Linking Findings to Evidence

Create Finding entries that explicitly cite their supporting Evidence through the evidence_ids array:

### F-001

- title: Open service on port 445
- severity: high
- category: misconfig
- status: validated
- evidence_ids: [E-001]
- location: 10.10.10.5:445
- impact: Allows SMB enumeration
- confidence: high
- remediation: Restrict SMB to trusted hosts

As specified in skills/ops/evidence-finding-path.md, every Finding must cite at least one Evidence ID, creating the mandatory bi-directional link that auditors require.

Building the Path Narrative

Construct Path records that map the logical flow between your Evidence and Findings:

### P-001

- title: Lateral movement via SMB
- path_type: attack
- start: Initial foothold
- goal: Access internal file share
- steps:
  1. action: nmap scan — evidence: E-001 — finding: F-001 | none
  2. action: Pass-the-Hash — evidence: E-002 — finding: F-002 | none

Each step references specific Evidence and Finding IDs using the pipe-delimited format, enabling granular traceability through the narrative.

Report Generation Requirements

The security report templates in skills/docs-generator/references/security-report-templates.md enforce strict inclusion of the E-F-P chain. Generated reports must follow this exact sequence:

1. Scope summary – Links to work/<case>/scope.md
2. Evidence table – Contains at least one Evidence record
3. Findings list – Each entry displays its associated Evidence IDs
4. Path – At least one Path record describing the attack or solution flow
5. Optional Timeline – Summary of key events (linked via skills/ops/timeline-workitem.md)

Generate the final report using the CLI:

# Assuming you have completed the case under work/MyCase

generate-report --case work/MyCase --type pentest

Integration with Field-Journal Subsystem

The E-F-P chain integrates with the field-journal subsystem to create de-identified journal entries. The system extracts up to three headline Evidence IDs, one core Finding, and a concise Path sentence for inclusion in the journal, maintaining privacy while preserving analytical structure.

Summary

• The Evidence-Finding-Path chain in reverse-skill creates an immutable audit trail from raw data to final conclusions.
• Evidence records require timestamps, source types, reproducible commands, and content hashes as defined in skills/ops/evidence-finding-path.md.
• Findings must reference at least one Evidence ID via evidence_ids and cannot be validated with low confidence without noting residual risk.
• Paths provide ordered narrative steps that explicitly link Evidence and Finding IDs for full traceability.
• Report templates enforce the inclusion of all three components in the specific order: Scope, Evidence, Findings, Path, Timeline.

Frequently Asked Questions

What is the minimum required Evidence for a Finding?

A Finding must cite at least one Evidence ID in its evidence_ids field. According to the contract in skills/ops/evidence-finding-path.md, Findings without supporting Evidence references violate the schema and will fail validation during report generation.

Can a Path reference multiple Findings in a single step?

Yes. Each step in a Path can reference both an Evidence ID and a Finding ID using the format evidence: <ID> — finding: <ID> | none. This allows complex attack chains where multiple observations support a single conclusion, or where one Finding depends on several pieces of Evidence.

How does the system prevent tampering with Evidence records?

Evidence entries include a content hash and are designed to be immutable once created. The skills/scripts/append-evidence.ps1 helper calculates the hash automatically, and the specification treats any modification after creation as a violation of the audit contract.

Where does the E-F-P chain fit in the overall reverse-skill workflow?

The skills/ops/role-map.md file maps specific workflow steps to required Evidence, Finding, and Path creation. The chain also integrates with skills/ops/timeline-workitem.md to link timeline entries to Evidence, ensuring complete chronological and logical coverage across the entire engagement.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}