Citations & evidence

In forensics, an uncited claim is worse than no claim. Siftbench treats citations as an enforced contract, not a prompt suggestion.

The grammar

• Evidence is neutral and monospace — parser output, never paraphrased as truth.
• AI content is tinted and badged — findings, summaries, and transcript prose stay visually distinct forever, even after a human accepts them.
• Citation chips carry a locator (registry path, EVTX record ID, SQLite table/rowid, byte range). Clicking opens the exact record in its native explorer.

API enforcement

Findings cross one public API boundary that synchronously resolves every citation. A fabricated or stale locator fails closed with a 422 — the finding never lands.

Human acceptance

Agents propose; named humans accept or reject. Acceptance records identity and timestamp. Human review does not launder AI content into evidence — the two-category world is permanent.