{
  "schema_version": 1,
  "required_total": 20,
  "required_portal": 6,
  "required_cli": 11,
  "required_windows": 3,
  "captures": [
    {
      "id": 1,
      "file": "docs/screenshots/01-preflight-plan.png",
      "surface": "CLI",
      "title": "Preflight and reviewed Foundation plan",
      "source_phase": "PreflightPlanFoundation",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Cloud Shell display prepared at 10:36:55 UTC and captured at 10:37:56 UTC on 7 November 2026. It shows retained local Preflight and the initial Foundation plan recorded at 10:33:58 UTC; Terraform and local tests were not rerun in Cloud Shell. A fresh Azure CLI query at that point confirms the workshop group does not yet exist. Later reconciled plans and bootstrap fixes are documented in the validation history.",
      "captured_utc": "2026-11-07T10:37:56.7185663Z",
      "sha256": "ee323f077179b13c1f27159995f94d5dc25a1f0bedfcd9b4ed6f8386c699eeab",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Actual Cloud Shell display of retained local operator execution; fresh group-exists query",
      "source": "Native Chrome Azure Portal/Cloud Shell screenshot",
      "source_sha256": "08c77b376047873f002e205921ec8beb036400f76824258b38cfd5f076ffb8fb",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell displays retained local operator execution; personal account identifiers cropped"
    },
    {
      "id": 2,
      "file": "docs/screenshots/02-private-foundation.png",
      "surface": "Portal",
      "title": "Dedicated private workshop foundation",
      "source_phase": "Foundation",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Portal view after the corrected Foundation deployment succeeded. The dedicated West Europe group contains the client, domain-controller VM, Bastion and isolated networking. This infrastructure view precedes domain bootstrap and does not establish user SMB access.",
      "captured_utc": "2026-11-07T10:54:00.580Z",
      "source": "Native Chrome Azure Portal resource-group overview",
      "sha256": "9a33f1f31cd6a1d65d00be564fac24caf529c6a3699da761d7ba24f71374bd1a",
      "source_sha256": "f1e4c088edfbba5e51e44a14962f8f1a9a1fbba67a574972f104a1662b11754c",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Live Azure Portal resource-group overview after Foundation deployment",
      "redactions": [],
      "crop": {
        "x": 225,
        "height": 850,
        "y": 40,
        "width": 1823
      },
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure Portal session; account visible in private original and cropped from public image"
    },
    {
      "id": 3,
      "file": "docs/screenshots/03-private-endpoint-dns.png",
      "surface": "Portal",
      "title": "Private endpoint and DNS integration",
      "source_phase": "Foundation",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Portal DNS configuration for the exercise file private endpoint. The canonical storage file hostname and its private DNS record resolve to the owned private endpoint address 10.172.2.4. Client-side DNS and SMB are tested separately.",
      "captured_utc": "2026-11-07T10:44:03.8250243Z",
      "source": "Native Chrome Azure Portal / Cloud Shell screenshot",
      "sha256": "03e78d752693728c532bf2ea4dfe8e7e5c7b6f2a0176a5e35927815a06b345ea",
      "source_sha256": "5f14a49b72947f261f7ccf9d6e12603cdf262718fd68237220b9ed220c9d9852",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Live Azure Portal private endpoint DNS configuration",
      "redactions": [],
      "crop": {
        "y": 40,
        "width": 1823,
        "x": 225,
        "height": 790
      },
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure Portal session; account visible in private original and cropped from public image"
    },
    {
      "id": 4,
      "file": "docs/screenshots/04-ad-ds-identity.png",
      "surface": "Portal",
      "title": "Storage AD DS identity registration",
      "source_phase": "Identity",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Portal identity-based access for the exercise account shows AD DS enabled and the account-wide default Storage File Data SMB Share Elevated Contributor. This configuration checkpoint does not establish successful user SMB access; the named-user baseline is validated separately.",
      "captured_utc": "2026-11-07T12:01:05.855Z",
      "source": "Native Chrome Azure Portal identity-based access",
      "sha256": "a4f5208b57f8a046f0f60031e6c3be52a88330169d45fd865fb878e1643b8eb4",
      "source_sha256": "6a7d35eefd576b484157ed5de1625898596897abd5930e1e25f2b92dae31bba8",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Live Azure Portal readback after Identity deployment and full SAM/type helper readback; no settings changed through this form",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure Portal session; personal account identifiers cropped",
      "redactions": [],
      "crop": {
        "width": 1823,
        "height": 850,
        "y": 40,
        "x": 225
      }
    },
    {
      "id": 5,
      "file": "docs/screenshots/05-windows-healthy-writer.png",
      "surface": "Windows",
      "title": "Healthy Writer session in Windows Explorer",
      "source_phase": "Baseline",
      "required": true,
      "status": "captured",
      "caption": "Genuine Bastion Windows desktop: Writer opens readable.txt from the protected exercise directory. The normal Azure Files hostname is visible in Explorer and the file contains the exact run-specific marker. Fresh automated user-session tests separately prove the full access matrix.",
      "captured_utc": "2026-11-07T12:51:40.770Z",
      "source": "Native Chrome Bastion Windows desktop screenshot",
      "sha256": "1502ca5783e6925fd4ec4ed14b5c594939c3ae5d3c69c7ff15ab0d98861fa416",
      "source_sha256": "59bbeb7043577b14e15a78a7b7bdcfd1e1025053bc764b5e743dade7d33c55a6",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Fresh interactive Windows Writer password logon; live SMB read and Notepad display",
      "actor": "AWZFILES\\Writer",
      "session_identity": "Interactive Windows RDP password logon through Bastion; same desktop opened Explorer and Notepad",
      "redactions": [],
      "crop": {
        "height": 882,
        "x": 0,
        "width": 1700,
        "y": 0
      }
    },
    {
      "id": 6,
      "file": "docs/screenshots/06-kerberos-smb-baseline.png",
      "surface": "CLI",
      "title": "Fresh-user Kerberos and SMB baseline",
      "source_phase": "Baseline",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Cloud Shell display at 13:03 UTC of the retained baseline executed earlier at 12:43–12:44 UTC. The verified guest report hash, fresh actor LUIDs and all 12 ticket, encrypted SMB and file-operation results are preserved. This is later display of real execution, not a rerun in Cloud Shell.",
      "captured_utc": "2026-11-07T13:04:03.823Z",
      "source": "Native Chrome Azure Cloud Shell screenshot of retained real execution report",
      "sha256": "d43414372b38862a05b26a3703b9b435f32455ccf87b597ef7ca5bf68c879164",
      "source_sha256": "f8afda6b7b20f7d6c66729e0856548563c6fc8c5112011dcae1dda9669ee7a47",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later Cloud Shell display of hash-verified retained actual baseline output; display UTC shown separately",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell; guest named-user password-logon LUIDs shown, personal operator header/prompt cropped",
      "retained_execution_sources": [
        {
          "file": "06-state.json",
          "sha256": "38c0e7723e8d58dc1600738bfd11a01bb5ce64b08b5f68969e7689bbebe2c58b"
        },
        {
          "file": "20261107T124357011-Probe.json",
          "sha256": "9b89f129ab82951723179be3f0649eb83accd3f61153fdfa26d502960f6fef52"
        }
      ],
      "retained_display_text_sha256": "d6594bcab24be831a6b3054f9a3157fc30096ec97da759db884e4fe48bdd5727",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x00000000004d76e9",
          "executed_utc": "2026-11-07T12:42:57.2292176+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x0000000000525d73",
          "executed_utc": "2026-11-07T12:43:19.2366183+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x000000000057a5b2",
          "executed_utc": "2026-11-07T12:43:35.5287895+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "width": 2048,
        "height": 721,
        "x": 0,
        "y": 77
      }
    },
    {
      "id": 7,
      "file": "docs/screenshots/07-windows-spn-fault.png",
      "surface": "Windows",
      "title": "Exercise CIFS SPN absent in ADUC",
      "source_phase": "KerberosFault",
      "required": true,
      "status": "captured",
      "caption": "Live ADUC Attribute Editor during the Kerberos drill: servicePrincipalName is (not set) on the exact exercise storage computer. The recorded control storage identity remains unchanged; the fault removes only the owned CIFS SPN.",
      "captured_utc": "2026-11-07T12:56:46.754Z",
      "source": "Native Chrome Bastion ADUC Windows desktop screenshot",
      "sha256": "7640ec5e19e4c7d65c66e3925fd9a876e995606909bb6bc05bad9f2501803c0f",
      "source_sha256": "f98364091367463db359e63b26268504411bca8209799ca2b798cd675187400e",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Fresh live Windows ADUC read during active Kerberos fault; no UI edits",
      "actor": "AWZFILES\\LabAdmin",
      "session_identity": "Interactive Windows domain administrator password logon through Bastion",
      "redactions": [],
      "crop": {
        "width": 755,
        "height": 540,
        "x": 95,
        "y": 85
      }
    },
    {
      "id": 8,
      "file": "docs/screenshots/08-kerberos-failure.png",
      "surface": "CLI",
      "title": "Kerberos failure with a fresh user session",
      "source_phase": "KerberosFault",
      "required": true,
      "status": "captured",
      "caption": "Later Cloud Shell display of the real Kerberos-fault execution, with original timestamps, report hash and actor LUIDs. The exercise klist diagnostic is 0xc000018b / 0x6fb; the independent control remains healthy. net use exits 2 with 1223 after standard input closes its credential prompt; this cancellation is not presented as the server error. Separate DC evidence records 4769 status 0x7 for the missing CIFS SPN.",
      "captured_utc": "2026-11-07T13:16:23.913Z",
      "source": "Native Chrome Azure Cloud Shell screenshot of retained real execution report",
      "sha256": "d8d65ff80f41405e50541ed34eb4931980c5f5dc4de698918c1d6a8630fbb95d",
      "source_sha256": "4eb9cafce0e3a1be6d238174a4cd727af2e05ea0adb92347b7d808f35111ce75",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained actual fresh-session Kerberos-fault output; no rerun in Cloud Shell",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell displays original guest password-logon LUIDs; personal operator header/prompt cropped",
      "retained_execution_sources": [
        {
          "file": "08-state.json",
          "sha256": "3b5945d32533f11a8944e265d428840cd6d8c4da772ba6dba6145a6d57a0e62c"
        },
        {
          "file": "20261107T131118411-Probe.json",
          "sha256": "135d5661a87944930f1603d388bf6b1ba07595be5a17e7547697fa02ecba47e0"
        }
      ],
      "retained_display_text_sha256": "4dd0547af95c4713c712a8ad500b9b23847c4b5277b6e590b0ebfc8789b24049",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x000000000089c948",
          "executed_utc": "2026-11-07T13:10:35.8355147+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x00000000008bab37",
          "executed_utc": "2026-11-07T13:10:49.4938884+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x00000000008d8949",
          "executed_utc": "2026-11-07T13:11:00.8054512+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "x": 0,
        "height": 692,
        "y": 77,
        "width": 1660
      }
    },
    {
      "id": 9,
      "file": "docs/screenshots/09-kerberos-recovery.png",
      "surface": "CLI",
      "title": "Kerberos repair and repeated repair",
      "source_phase": "KerberosRecovery",
      "required": true,
      "status": "captured",
      "caption": "Genuine later Cloud Shell display of the retained Kerberos recovery and repeated-repair checks. Original execution times, verified report hash and fresh actor LUIDs remain visible. Both accounts again provide AES256 tickets, encrypted SMB 3.1.1 and the intended user-access matrix after the exact SPN is restored.",
      "captured_utc": "2026-11-07T13:21:27.654Z",
      "source": "Native Chrome Azure Cloud Shell screenshot of retained real execution report",
      "sha256": "ce1b4b6d558c97ca685ac68f88a6dbadc2a1b9a8c3fdf8e28b2eb20eb2325575",
      "source_sha256": "3dc963103d0ab317827f2e57462f5ac94ddd9e072042781f1f3238bc5c51706d",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained real first/repeated Kerberos recovery; no rerun in Cloud Shell",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell displays guest named-user password-logon LUIDs; personal operator header/prompt cropped",
      "retained_execution_sources": [
        {
          "file": "09-state.json",
          "sha256": "d252602629152a884ccdfdf2a56f904df17656668f1b2967b170cb0bd853d348"
        },
        {
          "file": "20261107T131851669-Probe.json",
          "sha256": "516f01454d873ed729616572fe833a7bff9153cb00a7893277a16181659b518d"
        }
      ],
      "retained_display_text_sha256": "9004715e6fbbda42ebae7182aebd1b0f6b8b7f246319c485e13cc01e8c6bf6a4",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x00000000009b27e6",
          "executed_utc": "2026-11-07T13:17:54.1205484+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x00000000009d2c1f",
          "executed_utc": "2026-11-07T13:18:11.4804421+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x00000000009f9b1d",
          "executed_utc": "2026-11-07T13:18:22.5029737+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "height": 615,
        "y": 77,
        "x": 0,
        "width": 1660
      }
    },
    {
      "id": 10,
      "file": "docs/screenshots/10-share-gate-reader.png",
      "surface": "Portal",
      "title": "Account-wide default share permission Reader",
      "source_phase": "ShareGateFault",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal during ShareGate fault: AD DS remains enabled while the exercise storage account default share-level permission is Storage File Data SMB Share Reader. The setting applies to all shares in this account. The native Save button is disabled because this is a read-only checkpoint after the controller change.",
      "captured_utc": "2026-11-07T13:24:16.546Z",
      "source": "Native Chrome Azure Portal Identity-based access screenshot",
      "sha256": "2713b266102682bf9505140e29f8747d0db67955b35a2e104bd40de27894317b",
      "source_sha256": "567fafb7d3457b1fc74021d51bfcec83074dee719cbbc5a7fc00531678f8af35",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Fresh live Azure Portal read during active ShareGate fault; no UI changes",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure Portal session; personal account identifiers cropped",
      "redactions": [],
      "crop": {
        "width": 1823,
        "y": 40,
        "height": 850,
        "x": 225
      }
    },
    {
      "id": 11,
      "file": "docs/screenshots/11-share-gate-failure.png",
      "surface": "CLI",
      "title": "Share gate denies new writes",
      "source_phase": "ShareGateFault",
      "required": true,
      "status": "captured",
      "caption": "Later Cloud Shell display of the retained ShareGate fault executed in fresh named-user sessions. Both accounts still supply AES256 tickets and encrypted SMB 3.1.1. Writer reads succeed but new-file creation, modification and deletion return access denied (5) on the exercise account; control-account writes succeed. Physical ACL audit confirms all four folder ACLs remain unchanged.",
      "captured_utc": "2026-11-07T13:28:35.835Z",
      "source": "Native Chrome Azure Cloud Shell screenshot of retained real execution report",
      "sha256": "7b9e9964fe83303957ebe3451f27eeac9f391e99b4d7feb258575ab7ce2aa515",
      "source_sha256": "1696a4ea17f5045afa09d08e37304bcf3d6df2a22b11104bfa7ba8ee638b3367",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained actual ShareGate-fault output; no rerun in Cloud Shell",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell displays original guest named-user password-logon LUIDs; operator header/prompt cropped",
      "retained_execution_sources": [
        {
          "file": "11-state.json",
          "sha256": "65b08ca3db3f81ba132156034eadcc8f4a94a1ca04e97026ce56b6ea565240a0"
        },
        {
          "file": "20261107T132551419-Probe.json",
          "sha256": "a9af39d62a36b7169a1aed512421be6b56c7fedfbef8c60fffcb38a3fa805049"
        }
      ],
      "retained_display_text_sha256": "d0bdf494cf487687f748571e393dd6a350e7a256472fed8f04b9aed201a80109",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x0000000000ad480e",
          "executed_utc": "2026-11-07T13:24:49.8140086+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x0000000000af1112",
          "executed_utc": "2026-11-07T13:25:05.6810854+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x0000000000b14c8b",
          "executed_utc": "2026-11-07T13:25:16.6929282+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "height": 577,
        "x": 0,
        "y": 77,
        "width": 1660
      }
    },
    {
      "id": 12,
      "file": "docs/screenshots/12-share-gate-recovery.png",
      "surface": "CLI",
      "title": "Share gate repair and repeated repair",
      "source_phase": "ShareGateRecovery",
      "required": true,
      "status": "captured",
      "caption": "Later Cloud Shell display of actual first and repeated ShareGate recovery. The restored account default again permits Writer creation, read, modification and deletion in both exercise-account folders. Original timestamps, source-report hash, fresh actor LUIDs and both passing checks remain visible.",
      "captured_utc": "2026-11-07T13:39:34.813Z",
      "source": "Native Chrome Azure Cloud Shell screenshot of retained real execution report",
      "sha256": "fd38cc03f088d06bcaff672efddba5143312c0647f3b7a403a040e73bd766796",
      "source_sha256": "b9f1d725fc612f6d845280e117bfc0f6e8bf196eb0cfb6bae014217a46b42f07",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained real ShareGate recovery/repeated-repair execution; no rerun in Cloud Shell",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Cloud Shell displays guest named-user password-logon LUIDs; personal operator header/prompt cropped",
      "retained_execution_sources": [
        {
          "file": "12-state.json",
          "sha256": "3db389ba01fe9ff5ce8096ea5b8b35bd35223a121efaf062fe983cc0e7a27369"
        },
        {
          "file": "20261107T133421333-Probe.json",
          "sha256": "645fc35fb6d34f2288ce17b5351418feeb50fbc6d258a14821c723552a2da716"
        }
      ],
      "retained_display_text_sha256": "3084cd5a4746b9e3e3ad8904058a3350d1bbaedd6be5d8b86e56c0fb02b3d935",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x000000000130b278",
          "executed_utc": "2026-11-07T13:33:27.1932787+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x000000000132cb16",
          "executed_utc": "2026-11-07T13:33:44.2939100+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x0000000001354595",
          "executed_utc": "2026-11-07T13:33:56.8800800+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "height": 615,
        "width": 1660,
        "x": 0,
        "y": 77
      }
    },
    {
      "id": 13,
      "file": "docs/screenshots/13-windows-ntfs-rx.png",
      "surface": "Windows",
      "title": "Protected exercise-folder Writer RX ACL",
      "source_phase": "NtfsFault",
      "required": true,
      "status": "captured",
      "caption": "The exercise directory is owned by the workshop administrator, has inheritance disabled, and gives AWZ-Writers only Read and Execute during the validated ACL fault.",
      "captured_utc": "2026-11-07T14:22:33.530Z",
      "source": "Native Chrome Bastion Windows Advanced Security screenshot",
      "sha256": "1e94776a944204f665d9b6dd5b96cb12d42f8b14d49a43fc2d12c33905de46f1",
      "source_sha256": "70b612e3c7777b805e42f4876caf9ea3d1c6be5fa274c990a4cd44fe42f4420b",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Fresh live Windows Advanced Security read during validated Ntfs fault; no UI permission edits",
      "actor": "AWZFILES\\LabAdmin",
      "session_identity": "Interactive domain administrator RDP password logon through Bastion; fresh properties after fault",
      "redactions": [],
      "crop": {
        "x": 640,
        "y": 153,
        "width": 768,
        "height": 520
      }
    },
    {
      "id": 14,
      "file": "docs/screenshots/14-ntfs-failure.png",
      "surface": "CLI",
      "title": "NTFS fault denies new file creation",
      "source_phase": "NtfsFault",
      "required": true,
      "status": "captured",
      "caption": "Retained live Ntfs fault validation, displayed later in Cloud Shell: Writer keeps a valid AES256 ticket and encrypted SMB 3.1.1, but new-file creation is denied only in exercise/Exercise; the other three Writer paths remain writable.",
      "captured_utc": "2026-11-07T14:28:11.581Z",
      "source": "Native Azure Cloud Shell screenshot of retained actual execution report",
      "sha256": "ffb7b0e17595cb3ff4e7f90debfbae56c3cacc02d69a51dd92a9dcc14a04125b",
      "source_sha256": "e62670a02c02db653d613fd2ec93805561336ac1518e565460e6ef00548165f4",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained actual guest execution report; not a fresh execution in Cloud Shell",
      "actor": "Reader; Writer; Outsider",
      "session_identity": "Separate fresh PASSWORD logon LUIDs printed in the retained report; klist and SMB operations shared each actor session",
      "retained_execution_sources": [
        {
          "file": "14-state.json",
          "sha256": "89d0fc1bb4517af6d007b6448d15295638feab683ab0b9de295800795da951b2"
        },
        {
          "file": "20261107T142015264-Probe.json",
          "sha256": "070b7a9c72321e9aa74456639be0bc4c30272bcc285ce129f2b39b2f4ee99938"
        }
      ],
      "retained_display_text_sha256": "70ac0c020b7deaa4ca168208ac81888c98c843be7e0269470d636be305d1cdfb",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x000000000162b589",
          "executed_utc": "2026-11-07T14:19:11.6374657+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x000000000164bebf",
          "executed_utc": "2026-11-07T14:19:27.1032480+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x0000000001670c94",
          "executed_utc": "2026-11-07T14:19:39.3014528+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "height": 577,
        "y": 77,
        "width": 1660,
        "x": 0
      }
    },
    {
      "id": 15,
      "file": "docs/screenshots/15-ntfs-recovery.png",
      "surface": "CLI",
      "title": "NTFS repair and repeated repair",
      "source_phase": "NtfsRecovery",
      "required": true,
      "status": "captured",
      "caption": "Retained actual recovery evidence, displayed later: first and repeated Ntfs repairs passed. Writer can again create, modify and delete on all four paths; Reader remains read-only and Outsider remains denied.",
      "captured_utc": "2026-11-07T14:39:50.786Z",
      "source": "Native Azure Cloud Shell screenshot of retained actual execution report",
      "sha256": "769899294f40dee93298f31a65f8ac64d7f3e5d0dd5a8c36953e520012d44446",
      "source_sha256": "fc27e4e0828d77d39ad0ac163f1c8c72edef799ca964ce9cccba067261164379",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained actual guest execution report; not a fresh execution in Cloud Shell",
      "actor": "Reader; Writer; Outsider",
      "session_identity": "Separate fresh PASSWORD logon LUIDs printed in the retained report; klist and SMB operations shared each actor session",
      "retained_execution_sources": [
        {
          "file": "15-state.json",
          "sha256": "d651b4c29a83d7b8721753e546f4d4430a470d7f2336f2b76cddaa8c59339777"
        },
        {
          "file": "20261107T143649339-Probe.json",
          "sha256": "eeade9daacb77bcbab1638bbe6537ce7dcae1d538c8c251c64ed8a6d176830b2"
        }
      ],
      "retained_display_text_sha256": "36e4a924735550b98eb91158db1d5bf008d5af970cbaba001ada756edf1312bb",
      "actor_sessions": [
        {
          "actor": "Reader",
          "logon_luid": "0x00000000017e0b25",
          "executed_utc": "2026-11-07T14:36:01.1291224+00:00"
        },
        {
          "actor": "Writer",
          "logon_luid": "0x00000000017fe28d",
          "executed_utc": "2026-11-07T14:36:18.4516811+00:00"
        },
        {
          "actor": "Outsider",
          "logon_luid": "0x000000000182610d",
          "executed_utc": "2026-11-07T14:36:29.0462462+00:00"
        }
      ],
      "redactions": [],
      "crop": {
        "x": 0,
        "width": 1660,
        "height": 615,
        "y": 77
      }
    },
    {
      "id": 16,
      "file": "docs/screenshots/16-storage-file-logs.png",
      "surface": "Portal",
      "title": "Actual SMB diagnostic log observations",
      "source_phase": "ShareGateFaultLogs",
      "required": true,
      "status": "captured",
      "caption": "Genuine live Log Analytics query for the exact ShareGate Writer probe filename and request time. The control account emits Kerberos SMB CREATE (5), READ (8) and WRITE (9) success rows. Two exercise CREATE attempts emit StatusCode -1073741790; SmbStatusCode and StatusText are empty for those rows and are preserved as emitted. UTC result times, exact KQL and record counts remain visible.",
      "captured_utc": "2026-11-07T13:37:19.191Z",
      "source": "Native Chrome Azure Portal Log Analytics KQL result screenshot",
      "sha256": "1824eef9e729ff80841fd0bc130e5ef01a314fb4ac5b51c03a59927c751b4389",
      "source_sha256": "a1c354dcbda7ca94dab6346f35b57fccc8e1fa3a28331984ef9375a312bcf5d1",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Fresh Azure Portal execution of KQL against actual service logs from the earlier ShareGate fault request",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure operator; exact owned-account/Writer-probe scope visible, personal account header cropped",
      "redactions": [],
      "crop": {
        "x": 225,
        "width": 1823,
        "y": 40,
        "height": 887
      },
      "planned_phase": "FinalValidation",
      "query_sha256": "3f96d5b4841206c3b44bacee1fd01c443dc913fc6637c926b1c0aa3831fb3cb2"
    },
    {
      "id": 17,
      "file": "docs/screenshots/17-final-validation.png",
      "surface": "CLI",
      "title": "Final validation, logs and drift",
      "source_phase": "FinalValidation",
      "required": true,
      "status": "captured",
      "caption": "Offline evaluation of genuine retained Azure evidence, displayed later. The healthy guest observation, historical DC fault event and actual zero-change plan occurred before cleanup; the four final checks were evaluated afterward. Source execution and later evaluation times are shown separately, with a checksum binding all 16 source records.",
      "captured_utc": "2026-11-07T15:13:41.515Z",
      "source": "Native Azure Cloud Shell screenshot of later offline evaluation of checksum-bound genuine live Azure observations",
      "sha256": "e930ffcbc6e8960fec93f3acc0a2ac8f23ec5329497afcc5abb4b1e74f8c51cc",
      "source_sha256": "22ab7b87beaa0c4c525c74d069bd74de3b1122cf1d38858b50b61b7ce58706c0",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Native screenshot of later offline evaluation of checksum-bound live Azure observations; no new Azure execution and no recreated environment",
      "actor": "Workshop operator evaluating retained Reader, Writer and Outsider evidence",
      "session_identity": "Offline operator evaluation after cleanup; original separate domain-user PASSWORD logons remain bound by the retained guest source",
      "retained_execution_sources": [
        {
          "file": "17-state.json",
          "sha256": "ded4b6aee48b308b2ba7306142186783ecdf1382918b138dbe5cf20f62f579d2"
        },
        {
          "retained_utc": "2026-11-07T14:49:55.2794931+00:00",
          "action": "Probe",
          "file": "20261107T144955274-Probe.json",
          "observed_utc": "2026-11-07T14:49:32.6912088+00:00",
          "machine": "client",
          "sha256": "c2414c35cb844c1479900196090d94bf0cdcb2a2fa33ff761cf63c7d1b1511a7"
        },
        {
          "retained_utc": "2026-11-07T14:52:02.8877696+00:00",
          "action": "Audit",
          "file": "20261107T145202885-Audit.json",
          "observed_utc": "2026-11-07T14:51:50.6005671+00:00",
          "machine": "dc",
          "sha256": "7a4baee4b26409f38ee724b4b9039676047cac8a500c8d1e2c40ba98bcc27b6e"
        },
        {
          "retained_utc": "2026-11-07T14:54:31.0351603+00:00",
          "action": "Audit",
          "file": "20261107T145431032-Audit.json",
          "observed_utc": "2026-11-07T14:54:08.5664369+00:00",
          "machine": "client",
          "sha256": "15ffd676324808b57dff22eca56a8c14a4813498110c35b5cf94102e677ce98e"
        },
        {
          "retained_utc": "2026-11-07T13:12:03.7463181+00:00",
          "action": "Audit",
          "event_utc": [
            "2026-11-07T13:11:09.3954549Z"
          ],
          "file": "20261107T131203744-Audit.json",
          "observed_utc": "2026-11-07T13:11:53.0330701+00:00",
          "machine": "dc",
          "sha256": "58ef795debb9998b2876790bb92819c61b89cb99673338d44149877bb318b76e"
        },
        {
          "sha256": "b786137626a26af2e8d46e1c8e43db39fcbf0987e26a1276890415827e7c396f",
          "observed_utc": "2026-11-07T14:50:03.0760958+00:00",
          "file": "configuration-latest.json"
        },
        {
          "sha256": "487797577fe8401087534cea257cf1d47a9a55b2558437b353c775dabc3680f2",
          "observed_utc": "2026-11-07T14:54:33.7087973+00:00",
          "file": "storage-file-logs.json"
        },
        {
          "sha256": "b9cd71a1a1f3d9b0e6d5c6775df6647837df79b0c6a1d3f9126ae5c24900103e",
          "observed_utc": "2026-11-07T14:54:33.7031088+00:00",
          "file": "storage-log-poll.json"
        },
        {
          "sha256": "f8f7d021cd94f5356e8990eb310cd1434eee24e5bf4cf5224918ed5039825641",
          "observed_utc": "2026-11-07T14:57:19.9899652+00:00",
          "file": "final-independent-plan.json"
        },
        {
          "sha256": "8b6a6827f492b7e0384ac387c558c7ae3e70fdaaadba62f055acd82093cfa661",
          "observed_utc": "2026-11-07T14:57:19.9899652+00:00",
          "file": "final-independent.tfplan"
        },
        {
          "sha256": "42dcbf4e1121b38cf23d09e27cb76ccb5587378b9c4147412c2708580653c6d0",
          "observed_utc": "2026-11-07T14:57:19.9899652+00:00",
          "file": "final-independent-plan.txt"
        },
        {
          "sha256": "dc936119e42540122b38d5ac909e79e2d63d9d43c8fb1b6a1af7ddf5a90f51d2",
          "kind": "offline decode of the checksum-bound original saved plan",
          "observed_utc": "2026-11-07T14:57:19.9899652+00:00",
          "file": "final-independent-show.json"
        },
        {
          "sha256": "9e8ba3cad23182ac2629fd4edf57c389e027dc31c1860c06a9b4a9a89ae85389",
          "kind": "original native Logs REST response",
          "observed_utc": "2026-11-07T14:54:33.6600968+00:00",
          "file": "20261107T145433660-b8fe5aebd79f460cb620e131d85eba20-azure.json"
        },
        {
          "sha256": "4ee19a8003eaa0852010a1c308d796d670f2f189bf310af61397e58e9d7f1626",
          "kind": "original native configuration response",
          "observed_utc": "2026-11-07T14:49:57.1816187+00:00",
          "file": "20261107T144957181-52504d148f6b4379a7279bc054a66b1f-azure.json"
        },
        {
          "sha256": "e86e0e9f52e4e7bf356c6bdbf87dca45db99fb8f5b2e7124a1d9a0fc674e81c7",
          "kind": "original native configuration response",
          "observed_utc": "2026-11-07T14:49:59.2268880+00:00",
          "file": "20261107T144959226-1112c2b524594889adef308c43f229e3-azure.json"
        },
        {
          "sha256": "a11919a6c005b95918fcf81f8f7645a7418ce9c8018de24e6d7c8016252b6239",
          "kind": "original native configuration response",
          "observed_utc": "2026-11-07T14:50:01.1718974+00:00",
          "file": "20261107T145001171-752a1f055e7143648bf14ab0dcf026af-azure.json"
        },
        {
          "sha256": "f8a4f5194c72723057d23ba2e3a2d6c03df31d2d600e837a377566b577b3d9b4",
          "kind": "original native configuration response",
          "observed_utc": "2026-11-07T14:50:03.0737532+00:00",
          "file": "20261107T145003073-5e70d7ed53464d31822a7894b42a0fd0-azure.json"
        }
      ],
      "retained_display_text_sha256": "de73231bcf824caf62c55bbb4e9deac31e2833c340ae236f3cbd1bffba12295c",
      "actor_sessions": [],
      "redactions": [],
      "crop": {
        "height": 405,
        "width": 1660,
        "x": 0,
        "y": 77
      }
    },
    {
      "id": 18,
      "file": "docs/screenshots/18-cleanup.png",
      "surface": "CLI",
      "title": "Verified exact cleanup",
      "source_phase": "Cleanup",
      "required": true,
      "status": "captured",
      "caption": "Retained real cleanup results, displayed later: the exact workshop group is absent and all 27 protected resources remain. The stage summary omits the private StatePath; this first cleanup also used -Resume to reconcile the terminal validation attempt before deleting the reviewed plan.",
      "captured_utc": "2026-11-07T15:02:37.713Z",
      "source": "Native Azure Cloud Shell screenshot of retained actual cleanup results",
      "sha256": "010556beb85a802d23728d9bd9e91ab320cc109e866d2bcda0a02fb845345064",
      "source_sha256": "d535ae45cde572b73f643c8399de10466d3a94cc61fa53aad20c18f78c848eb0",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained cleanup output; actual first invocation included -Execute -ReviewedPlan -Resume and the explicit private StatePath",
      "actor": "Azure operator",
      "session_identity": "Actual selected Azure subscription operator; retained local CLI and Terraform result, not rerun in Cloud Shell",
      "retained_execution_sources": [
        {
          "file": "18-state.json",
          "sha256": "99eb1c54ef21e4cf22743deffc1457993c05f1468d7dd714c9956067df4efed4"
        }
      ],
      "retained_display_text_sha256": "13b2596897ba638775ef33f3fb0ca3e05ca81b81369fefbbf86a1de3715151be",
      "actor_sessions": [],
      "redactions": [],
      "crop": {
        "height": 270,
        "y": 77,
        "x": 0,
        "width": 1660
      }
    },
    {
      "id": 19,
      "file": "docs/screenshots/19-repeated-cleanup.png",
      "surface": "CLI",
      "title": "Repeated cleanup and preserved baseline",
      "source_phase": "RepeatedCleanup",
      "required": true,
      "status": "captured",
      "caption": "Retained actual second cleanup check, displayed later: the owned group remains absent, zero owned resources remain, and all 27 protected resources are preserved. Repeating cleanup created nothing.",
      "captured_utc": "2026-11-07T15:04:44.554Z",
      "source": "Native Azure Cloud Shell screenshot of retained actual repeated cleanup results",
      "sha256": "4bdd56e8248bea3d39973afeb10b13d7114c89fa2a1c4241ae0991723132c4d7",
      "source_sha256": "35f83e3e46f918acfa4092cb84d67a2de7f4f0d928eb329b5e8ea5528da49251",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Later display of retained actual repeat-cleanup output; not a fresh cleanup invocation in Cloud Shell",
      "actor": "Azure operator",
      "session_identity": "Actual selected subscription operator; the second CLI absence verification is retained with its original execution UTC",
      "retained_execution_sources": [
        {
          "file": "19-state.json",
          "sha256": "d1446dbfc3d75662bf0236d68aa73f8ab419734bc8a2f46eba0dc08550373730"
        }
      ],
      "retained_display_text_sha256": "3046cab164dd941194adf61c8fec07494190c4132ef12aee9019f7e052d99db4",
      "actor_sessions": [],
      "redactions": [],
      "crop": {
        "width": 1660,
        "height": 338,
        "y": 77,
        "x": 0
      }
    },
    {
      "id": 20,
      "file": "docs/screenshots/20-smb-security.png",
      "surface": "Portal",
      "title": "Explicit SMB protocol and encryption policy",
      "source_phase": "Baseline",
      "required": true,
      "status": "captured",
      "caption": "Genuine Azure Portal SMB Security blade for the exercise account. Require Encryption in Transit for SMB is enabled; the selected policy permits only SMB 3.1.1, AES-256-GCM channel encryption, Kerberos authentication and AES-256 tickets. Fresh encrypted user connections are validated separately.",
      "captured_utc": "2026-11-07T12:07:35.128Z",
      "source": "Native Chrome Azure Portal SMB Security blade for owned exercise account",
      "sha256": "1a89d84c36fc24b9e8f314f5ecc3bc4c149352b8eeeacd712c97420acf40bc1c",
      "source_sha256": "e38918465db8cdf17ed9714d7720ab28d91f728ebe8b16381535ff4af1ea87e5",
      "privacy_reviewed": true,
      "generated_ui": false,
      "execution_context": "Live Azure Portal readback of configured SMB policy; source account context remains in the private full original; no setting changed through this form",
      "actor": "Azure operator (personal account redacted)",
      "session_identity": "Authenticated Azure Portal session; personal account identifiers cropped",
      "redactions": [],
      "crop": {
        "height": 820,
        "width": 584,
        "y": 40,
        "x": 1464
      }
    }
  ]
}