EvidenceLock SIFT Terminal Proof

Commands

$env:PYTHONPATH="src"
python -m unittest discover -s tests -v
python tools/judge_smoke_test.py
python -m evidencelock_sift.cli verify-manifest --manifest reports\integrity_manifest.json --repo-root .
python -m compileall -q src tests tools

Observed Results

Command	Result	Judge signal
`python -m unittest discover -s tests -v`	`Ran 15 tests ... OK`	Parser/search behavior, verifier rejection, forged proof rejection, negative control, manifest tamper detection, public artifact links, and judge smoke are covered.
`python tools/judge_smoke_test.py`	`"ok": true`	Rejected draft, corrected proof trace, manifest check, and negative control pass together.
`python -m evidencelock_sift.cli verify-manifest ...`	`{ "issues": [], "ok": true }`	Checked-in evidence and generated outputs still match the SHA-256 manifest.
`python -m compileall -q src tests tools`	exit code `0`	Public Python sources compile.

Smoke Output Highlights

{
  "case_id": "windows-triage-mini-001",
  "checks": {
    "draft_rejected_with_three_issues": true,
    "final_verifier_zero_issues": true,
    "proof_trace_tool_results_match": true,
    "manifest_ok": true,
    "negative_control_downgrades_to_unresolved": true,
    "negative_manifest_ok": true
  },
  "proof_trace": {
    "F-001": {
      "status": "confirmed",
      "evidence_ids": ["windows_triage_events:1024"],
      "tool_call_ids": ["cmd-0003"],
      "tool_names": ["search_events"]
    },
    "F-002": {
      "status": "confirmed",
      "evidence_ids": ["windows_triage_events:2048"],
      "tool_call_ids": ["cmd-0004"],
      "tool_names": ["search_events"]
    }
  },
  "negative_control": {
    "case_id": "windows-negative-mini-001",
    "finding_id": "F-001",
    "status": "unresolved",
    "evidence_ids": [],
    "tool_call_ids": []
  },
  "ok": true
}

What This Proves

Fail closed

The verifier rejects an unsupported confirmed draft before it reaches the final report.

Exact trace

Corrected findings cite exact evidence IDs and exact successful tool-call IDs.

No borrowed proof

proof_trace_tool_results_match: true means cited commands actually produced cited evidence IDs.

Negative control

Unsupported no-evidence input downgrades to unresolved with no evidence refs and no tool refs.

Honest boundary: this is public terminal evidence for a synthetic Windows EVTX-style mini-case. It does not claim live victim data, full-disk SIFT workstation execution, public-corpus benchmarking, or endpoint containment.

Source Markdown: docs/terminal_proof.md. Back to Judge Hub.