# FIND EVIL Final Submission Operator Runbook

This is now an archived last-mile checklist plus post-submit verification record. The account owner completed the Devpost project creation and hosted video step; use this file only to preserve the submitted URLs or to avoid regressions during any post-submit edit.

Public deadline check: the FIND EVIL Devpost page exposes `2026-06-15T23:45:00-04:00`, which is `2026-06-16 11:45 GMT+8`. Do not wait for the final hour.

## One Screen Summary

| Field | Value |
| --- | --- |
| Project name | `EvidenceLock SIFT: Verifier-First Protocol SIFT Triage` |
| Tagline | `Evidence-locked DFIR triage: agent speed with verifier-enforced proof.` |
| Devpost project | `https://devpost.com/software/evidencelock-sift-verifier-first-protocol-triage` |
| Official hosted video | `https://vimeo.com/1200810741` |
| Try it out | `https://ooyxloo.github.io/evidencelock-sift/` |
| Repository | `https://github.com/OOYXLOO/evidencelock-sift` |
| Supporting demo page | `https://ooyxloo.github.io/evidencelock-sift/demo.html` |
| Judge pack | `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_pack.md` |
| Scorecard | `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_scorecard.md` |
| Final submit console | `https://ooyxloo.github.io/evidencelock-sift/final_submit_console.html` |
| Stage One preflight | `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/stage_one_preflight.md` |
| Deck | `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/evidencelock-sift-judge-deck.pptx` |
| Video upload pack | `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/video_upload_pack.md` |

## Gallery Order

1. `docs/proof-card.png`
2. `docs/architecture.png`
3. `docs/accuracy-card.png`

## Video Branch

Official FIND EVIL rules require a demo video that is publicly visible on YouTube, Vimeo, or Youku. Use the MP4 as the preferred upload source:

```text
docs/demo-video/evidencelock-sift-demo.mp4
```

If the host rejects MP4 processing, use the WebM backup:

```text
docs/demo-video/evidencelock-sift-demo.webm
```

Do not use raw GitHub video URLs as the official Devpost video field. Keep them only as backup/source links:

```text
https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/demo-video/evidencelock-sift-demo.mp4
https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/demo-video/evidencelock-sift-demo.webm
```

The submitted official video field is:

```text
https://vimeo.com/1200810741
```

Keep `https://ooyxloo.github.io/evidencelock-sift/demo.html` as a supporting project link.

Use `docs/video_upload_pack.md` for the exact hosted-video title, description, tags, settings, and logged-out playback checks. Do not use a private, silent, still-processing, or raw GitHub-only video URL.

## Additional Info Must Include

Paste the short description and judging hook from `docs/devpost_field_pack.md`, then include these links near the top:

- Judge hub: `https://ooyxloo.github.io/evidencelock-sift/`
- Devpost project: `https://devpost.com/software/evidencelock-sift-verifier-first-protocol-triage`
- Official Vimeo demo: `https://vimeo.com/1200810741`
- Final submit console: `https://ooyxloo.github.io/evidencelock-sift/final_submit_console.html`
- Embedded demo: `https://ooyxloo.github.io/evidencelock-sift/demo.html`
- Judge pack: `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_pack.md`
- Judge scorecard: `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_scorecard.md`
- Smoke proof snapshot: `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/smoke_proof.md`
- Stage One preflight: `https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/stage_one_preflight.md`
- Smoke test: `https://github.com/OOYXLOO/evidencelock-sift/blob/main/tools/judge_smoke_test.py`
- Agent trace: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/agent_trace.md`
- Accuracy report: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/accuracy_report.md`
- Analyst handoff: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/analyst_handoff.md`
- Integrity manifest: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/integrity_manifest.json`
- SIFT compatibility runbook: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/sift_compatibility_runbook.md`
- Fail-closed negative control: `https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/fail_closed_negative_control.md`

## Run Before Final Submit

From the repo root:

Linux / SIFT workstation shell:

```bash
export PYTHONPATH=src
python3 -m unittest discover -s tests -v
python3 tools/judge_smoke_test.py
python3 -m evidencelock_sift.cli verify-manifest --manifest reports/integrity_manifest.json --repo-root .
```

Windows PowerShell:

```powershell
$env:PYTHONPATH="src"
python -m unittest discover -s tests -v
python tools/judge_smoke_test.py
python -m evidencelock_sift.cli verify-manifest --manifest reports/integrity_manifest.json --repo-root .
```

Expected smoke highlights:

- `draft_rejected_with_three_issues: true`
- `final_verifier_zero_issues: true`
- `manifest_ok: true`
- `negative_control_downgrades_to_unresolved: true`
- `negative_manifest_ok: true`
- `F-001`: `windows_triage_events:1024` plus `cmd-0003 search_events`
- `F-002`: `windows_triage_events:2048` plus `cmd-0004 search_events`

## Final No-Go Gate

Do not press final submit if any item is true:

- The project URL is not under FIND EVIL.
- The project was imported from `prizepilot-qwen-cloud`.
- The project page is `https://devpost.com/software/evidence-locked-dfir-agent`; that is a competitor project, not this submission.
- The video field is empty, private, silent, raw-GitHub-only, or not hosted on YouTube, Vimeo, or Youku.
- The hosted video is still processing or fails in a logged-out browser.
- The repo is private or the MIT license is not visible.
- Additional info omits the judge pack, scorecard, smoke test, Stage One preflight, or honest scope boundary.
- The text claims live full-disk SIFT execution, real victim data, or live external LLM/API usage.
- Any password, OTP, API key, private log, payout, bank, tax, KYC, or identity document is present.

## Final Success Signal

Submitted URLs have been saved above. The money goal is still not complete until a prize, bounty, or claimable payout is verified.