Incident Evidence Binder

Auditable incident evidence binder for authorized UGREEN AI NAS surveillance events and related documents.

What it does

Reconstructs a bounded timeline of authorized surveillance events, resolves possible people or vehicles, collects supported evidence, and binds related documents without altering NAS data unless approved.

Target user and problem

Homeowners and small teams operating UGREEN AI NAS cameras need to understand incidents such as unauthorized access, deliveries, or equipment damage. Events, identities, snapshots, and related records remain scattered.

Solution

Read-first workflow: query real surveillance events, resolve identities with confidence, collect evidence references, read related documents, reconcile facts, and produce an evidence binder. Write actions are optional, scoped, and approval-gated.

Core user flow

User supplies time range, location or camera scope, optional incident keywords, and optional related document scope. The Skill queries cameras and events, resolves identities, collects evidence, reads and extracts documents, reconciles facts, then returns a binder with gaps and confidence. Approved packaging can create a report folder.

Differentiation

Unlike conventional AI that summarizes user-provided text, this Skill orchestrates NAS-native surveillance, document, and file capabilities through registered expert agents. It preserves real identifiers, reports uncertainty, and refuses to invent events, identities, or evidence.

NAS capabilities used

• ug-surveillance: cameras, timelines, identities, evidence (steps 1-4)
• ug-document: extraction and reconciliation (steps 5-6)
• ug-filesystem and ug-filemgr: related files and approved packaging (steps 7-8)

Technical approach

Delegates to security-monitor-agent, document-agent, and file-agent in sequence, passing only verified results. Read operations need no approval; evidence packaging, tagging, moving, copying, and writing require approval. AI model use is optional and local or properly authorized. Data stays on the NAS.

Development status

Implemented: SKILL.md, references, static validation pass, capability mapping, orchestration, empty and partial result handling, approval boundaries. Not implemented: live NAS execution and final report templates. Pending NAS validation: camera query behavior, identity confidence, evidence access limits, document reconciliation, and approved packaging.

Validation plan

Core tests: (1) scoped two-hour event query with identity resolution and evidence collection; (2) binding delivery records to an event timeline with one conflict. Edge case: no events in range, returning an explicit empty result without broadening scope.

Known limitations

Dependence on NAS surveillance indexing, identity library coverage, permission settings, and document readability. Evidence quality varies by camera placement and lighting. Identity results may be unknown. Round 1 has no NAS runtime evidence.

Built With

• document-reconciliation
• surveillance
• ugos
• ugreen-ai-nas
• uliya-skill