FIND EVIL final submit console

EvidenceLock SIFT copy deck for the last Devpost pass.

Use this as a post-submit edit console for the submitted FIND EVIL Devpost project. It keeps the live project URL, hosted Vimeo demo, judge links, and no-go checks in one place.

SubmittedDevpost project: devpost.com/software/evidencelock-sift-verifier-first-protocol-triage.

Hosted videoOfficial Vimeo demo: vimeo.com/1200810741.

Deadline2026-06-15 23:45 EDT / 2026-06-16 11:45 GMT+8.

Project Name

EvidenceLock SIFT: Verifier-First Protocol SIFT Triage

Tagline

Evidence-locked DFIR triage: agent speed with verifier-enforced proof.

Built With

Python, Protocol SIFT design pattern, MCP-style typed tools, Windows event triage, SHA-256 integrity manifest, Sleuth Kit wrapper pattern, HTML/CSS demo recording, browser MediaRecorder, narrated MP4/WebM upload sources.

Try It Out

https://ooyxloo.github.io/evidencelock-sift/

Short Description

EvidenceLock SIFT is a verifier-first incident-response agent pattern for SANS SIFT / Protocol SIFT workflows. It lets an agent move quickly through evidence collection and report drafting, but blocks the dangerous part: confident conclusions that are not tied to reproducible evidence.

Judge fast path: run one command, watch the first verifier pass reject an unsafe confirmed claim, inspect the corrected pass and proof_trace IDs, then verify the report hashes with the integrity manifest.

The demo runs a complete vertical slice on a synthetic Windows EVTX-style mini-case: hash evidence, parse/search normalized Windows event records, draft findings, reject unsupported confirmed claims, repair the report with evidence IDs and tool-call IDs, and emit an investigation report, timeline report, accuracy report, execution log, and integrity manifest.

Judging Hook

The first report draft intentionally fails verification. The final report only keeps confirmed findings when they include evidence references and reproducible tool references. The proof-card image shows the whole chain: finding F-001 -> event record 1024 -> cmd-0003 search_events -> failed verifier pass cmd-0005 -> corrected verifier pass cmd-0006 -> SHA-256 integrity manifest.

Expected smoke-test highlights: draft_rejected_with_three_issues: true, final_verifier_zero_issues: true, manifest_ok: true, negative_control_downgrades_to_unresolved: true, negative_manifest_ok: true, and exact proof traces for F-001 (windows_triage_events:1024 + cmd-0003 search_events) and F-002 (windows_triage_events:2048 + cmd-0004 search_events).

Project Links

Devpost project: https://devpost.com/software/evidencelock-sift-verifier-first-protocol-triage
Repository: https://github.com/OOYXLOO/evidencelock-sift
Judge hub: https://ooyxloo.github.io/evidencelock-sift/
Final submit console: https://ooyxloo.github.io/evidencelock-sift/final_submit_console.html
Official hosted demo video: https://vimeo.com/1200810741
Embedded demo: https://ooyxloo.github.io/evidencelock-sift/demo.html
Preferred MP4 upload source: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/demo-video/evidencelock-sift-demo.mp4
WebM backup upload source: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/demo-video/evidencelock-sift-demo.webm
Judge pack: https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_pack.md
Scorecard: https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/judge_scorecard.md
Smoke proof snapshot: https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/smoke_proof.md
Smoke test: https://github.com/OOYXLOO/evidencelock-sift/blob/main/tools/judge_smoke_test.py
Stage One preflight: https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/stage_one_preflight.md
Final runbook: https://github.com/OOYXLOO/evidencelock-sift/blob/main/docs/final_submission_operator_runbook.md
SIFT compatibility runbook: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/sift_compatibility_runbook.md
Fail-closed negative control: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/fail_closed_negative_control.md
Accuracy report: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/accuracy_report.md
Agent trace: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/agent_trace.md
Integrity manifest: https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/reports/integrity_manifest.json

Gallery Order

1. docs/proof-card.png
2. docs/architecture.png
3. docs/accuracy-card.png

Raw image links:
https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/proof-card.png
https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/architecture.png
https://raw.githubusercontent.com/OOYXLOO/evidencelock-sift/main/docs/accuracy-card.png

Video Field Rule

Official FIND EVIL rules allow a public YouTube, Vimeo, or Youku video with audio narration; this submitted project uses Vimeo. Keep https://vimeo.com/1200810741 in the official Devpost video field. Keep https://ooyxloo.github.io/evidencelock-sift/demo.html as a supporting project link. Use docs/demo-video/evidencelock-sift-demo.mp4 or docs/demo-video/evidencelock-sift-demo.webm only if a future edit requires re-uploading. Do not use a raw GitHub video URL as the official Devpost video field.

No-Go Gate

Do not press final submit if any item is true:
- The project URL is not under FIND EVIL.
- The project was imported from prizepilot-qwen-cloud.
- The project page is https://devpost.com/software/evidence-locked-dfir-agent; that is a competitor project, not this submission.
- The video field is empty, private, silent, raw-GitHub-only, or no longer points to https://vimeo.com/1200810741.
- The hosted video is still processing or fails in a logged-out browser.
- The repo is private or the MIT license is not visible.
- Additional info omits the judge pack, scorecard, smoke test, Stage One preflight, or honest scope boundary.
- The text claims live full-disk SIFT execution, real victim data, or live external LLM/API usage.
- Any password, OTP, API key, private log, payout, bank, tax, KYC, or identity document is present.

Before Final Submit

Hosted Vimeo opens logged-out and has audible narration.
Devpost project is for FIND EVIL, not Qwen or a competitor page.
Gallery images follow the proof, architecture, accuracy order.
Run the Stage One preflight.
Run or cite the smoke-test proof if reports were regenerated.

Expected Proof Signals

draft_rejected_with_three_issues: true
final_verifier_zero_issues: true
manifest_ok: true
F-001: windows_triage_events:1024 + cmd-0003 search_events
F-002: windows_triage_events:2048 + cmd-0004 search_events