evidence-graph-reviewlisted

# Evidence Graph Review ## Scope and Authorization Gate **MUST** confirm `scope.md` before any analysis step: - `scope.md` must exist under the current case root - `auth.status` must be `granted` - `network_profile.mode` must be set (offline | lab_only | authorized_target_only | unrestricted_lab) If `scope.md` is missing or `auth.status != granted`, **STOP** and report scope deficiency. Do not proceed with any analysis or tool invocation. ## Evidence Discipline ### Evidence Records (E-xxx) - Each evidence record is a self-contained Markdown file under the case root - Must contain: `title`, `observed_at`, `source_type`, `source_ref`, `repro_command`, `raw_excerpt`, `linked_workitem`, `supersedes` - `content_hash` and `artifact_path` are optional but MUST be recorded if a local artifact is referenced - `repro_command` must be a real command that a third party can run, or explicitly marked `n/a` with documentation of the offline limitation ### Finding Records (F-xxx) - Every Finding must reference at least one Evidence ID in `evidence_ids` - When `status=validated`, `confidence` must be `high` or `medium`; `low` is only allowed with an explicit `residual_risk` note - Findings without linked Evidence must be marked `status=candidate` and promoted only after additional Evidence is gathered ### Finding Sufficiency (R4*) - `preliminary / candidate` → >=1 Evidence (unchanged) - `validated` → SHOULD >=2 independent Evidence (best: 1 static + 1 dynamic). A single Evidence alo