FIND EVIL judge hub

EvidenceLock SIFT is a verifier-first MCP-style boundary for Protocol SIFT triage.

The demo proves a narrow, auditable DFIR loop: an unsupported confirmed claim fails, the agent corrects it with evidence and tool-call IDs, and published reports are checked against a SHA-256 integrity manifest.

Submitted on DevpostProject page is live at devpost.com/software/evidencelock-sift-verifier-first-protocol-triage.
Hosted Video LiveOfficial Vimeo demo is public at vimeo.com/1200810741, with local MP4/WebM backups retained.
Honest scopeSynthetic Windows EVTX-style vertical slice; no live victim data or full-disk SIFT claim.
SIFT concernAgents can summarize forensic output faster than humans can verify it.
EvidenceLock proofConfirmed findings must cite evidence IDs, tool-call IDs, verifier correction, and SHA-256 manifests.
Not claimedNo broad forensic coverage, live victim data, full-disk SIFT execution, or endpoint containment claim.
Implemented nowNormalized EVTX-style mini-case, typed read-only tools, verifier enforcement, proof trace, negative control, LF-stable manifest, and judge smoke test.
Not yet claimedLive SIFT workstation execution, full disk image processing, endpoint containment, public corpus benchmark, or real victim data handling.
3draft verifier issues caught
0final verifier issues
2exact finding proof traces
4guardrail and bypass checks

Proof Trace

EvidenceLock proof trace from finding to evidence, tool call, correction, and hash

Accuracy Summary

EvidenceLock accuracy and guardrail summary

Scope note: mini-case N=3 synthetic Windows events plus a negative control; this is verifier-boundary evidence, not corpus-level DFIR accuracy.

Two-Minute Review

  1. Watch the embedded demo.
  2. Open the judge pack.
  3. Open the 5-slide judge deck.
  4. Scan the checked-in smoke proof.
  5. Scan the judging criteria scorecard.
  6. Run the smoke test.
  7. Read the before/after claim table.
  8. Check the fail-closed negative control.
  9. Read the SIFT compatibility runbook.
  10. Open the annotated agent trace.
  11. Inspect the execution log.
  12. Verify the integrity manifest.

Submission Record

The Devpost project and hosted Vimeo demo are live. These records preserve the exact submitted URLs and prevent post-submit edits from drifting into the wrong project or raw-video path.

Open the submitted Devpost project

Open the hosted Vimeo demo

Open the archived final submission runbook

Open the final submit console

Open the one-minute submission gate pack

Open the hosted-video upload pack

Open the Stage One preflight

Criteria Fit

EvidenceLock maps directly to autonomous execution quality, IR accuracy, depth, constraint implementation, audit trail quality, and usability.

Open the scorecard

Fail-Closed Control

A negative-control mini-case proves that unsupported draft `F-001` downgrades to `unresolved` instead of becoming a false positive, with no evidence refs or tool refs.

Open the negative control

Smoke-Test Proof

The smoke test only returns ok: true after the unsafe draft is rejected, the final verifier has zero issues, the manifest verifies, and both confirmed findings have exact proof traces produced by matching successful tool calls.

  • F-001: windows_triage_events:1024 -> cmd-0003 search_events.
  • F-002: windows_triage_events:2048 -> cmd-0004 search_events.
  • proof_trace_tool_results_match: true: cited commands returned the cited evidence IDs.
  • negative_control_downgrades_to_unresolved: true and negative_manifest_ok: true.

Open expected smoke-test highlights

Terminal Proof

The terminal proof page shows the observed command outputs behind the demo: 15 passing tests, judge smoke ok: true, manifest verification ok: true, and compileall exit code 0.

Open terminal proof

Reproduce Locally

Clone the repo and run the verifier. The smoke test prints a `proof_trace` that locks each confirmed finding to its evidence ID and tool-call ID.

git clone https://github.com/OOYXLOO/evidencelock-sift cd evidencelock-sift $env:PYTHONPATH="src" python -m unittest discover -s tests -v python tools/judge_smoke_test.py python -m evidencelock_sift.cli verify-manifest --manifest reports/integrity_manifest.json --repo-root .

Honest Boundary

This package demonstrates a normalized Windows EVTX-style vertical slice with verifier correction and hash checks.

It does not claim live SIFT workstation execution, full-disk processing, real victim data, or automated endpoint isolation.

Core Artifacts

Architecture

Typed tools and verifier gates are the control boundary.

Architecture notes | MCP-style tool schema | SIFT runbook | Presentation deck

Benchmark Path

The current mini-case is deliberately small and reproducible. The public-data extension path is documented for EVTX-ATTACK-SAMPLES, NIST CFReDS, and Digital Corpora-style evaluations.

Public dataset appendix