{"actor": "evidence-locked-agent", "artifacts": 6, "case_id": "CASE-DFIR-002", "event": "case_loaded", "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "timestamp": "2026-06-13T06:06:33Z", "tool": "read_only_case_loader", "writes_to_case_data": 0}
{"actor": "evidence-locked-agent", "case_files": 6, "event": "source_hashes_recorded", "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "manifest": "findevil/reports/source-hash-manifest.json", "timestamp": "2026-06-13T06:06:33Z", "tool": "sha256_manifest"}
{"actor": "dfir-analysis-agent", "claims": ["claim-phishing-email", "claim-suspicious-attachment", "claim-browser-download", "claim-malware-executed", "claim-endpoint-isolation"], "event": "claims_generated", "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "timestamp": "2026-06-13T06:06:33Z", "token_usage_note": "local verifier uses deterministic evidence-lock logic; no live LLM API call is made during this run", "tool": "typed_claim_builder"}
{"actor": "dfir-analysis-agent", "event": "evidence_lock_applied", "false_confident_supported_claims": 0, "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "timestamp": "2026-06-13T06:06:33Z", "tool": "evidence_lock_guardrail", "unsupported_claims_blocked": 1}
{"actor": "evidence-locked-agent", "claims_total": 5, "event": "accuracy_scored", "exact_status_accuracy": 1.0, "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "timestamp": "2026-06-13T06:06:33Z", "tool": "ground_truth_scorer"}
{"actor": "security-analyst", "decision": "mailbox_containment_only", "endpoint_isolation": "not_approved", "event": "human_gate", "llm_completion_tokens": 0, "llm_prompt_tokens": 0, "timestamp": "2026-06-13T06:06:33Z", "tool": "approval_gate"}