# Genuine screenshot and provenance guide

The original acceptance set requires 18 genuine images: nine Azure Portal captures and nine CLI captures. Two supplemental Portal close-ups improve readability where settings cannot fit in one view. The completed release contains 20 genuine images: 11 Portal and nine CLI. The original required_total/required_portal/required_cli remain 18/9/9; entries 19 and 20 have required=false. Check each entry's actual status and file before claiming completion. The exact inventory and file paths are in capture-plan.json. No screenshot may be generated from invented terminal output, reconstructed Portal controls, or expected results.

## Capture rules

1. Capture the actual environment at the named phase. Take a fresh healthy observation immediately before each fault and retain raw transcripts/JSON privately.
2. Preserve readable HTTP outcomes, health reasons, relevant rule IDs and timestamps. A configuration screenshot must not be captioned as proof of successful traffic.
3. Crop browser chrome and unrelated windows where possible. Mask subscription/tenant/object/workspace identifiers, user/email values, actual public/private addresses, hostnames tied to real resources, credentials and private paths. The synthetic .test names and test markers can remain readable.
4. Use opaque redaction or cropping only. Never regenerate or rewrite the underlying Portal/CLI evidence. Retain the original capture privately and record the derivative's hash.
5. CLI images may show the actual execution or a later display of its retained authentic output. The caption must distinguish those cases and preserve the original execution timestamp. A later display is not a new execution.
6. Record source phase, capture UTC, surface, caption, redactions and SHA-256 in the provenance inventory. Keep original/raw file paths private.

## Cloud Shell versus local execution

Capture 01 displays the retained local preflight/plan report in genuine Azure Cloud Shell. Capture 16 displays the retained local final-validation/Terraform report there. Preserve their original execution times and label the later display. Record Cloud Shell Azure CLI/PowerShell versions separately from the local operator versions. Recovery captures 08, 10 and 15 combine labelled retained local controller reports with fresh Cloud Shell curl requests. Their captions distinguish the original controller execution from the later display and the new remote requests. Other Cloud Shell captures show their actual named read-only Azure or HTTPS commands; do not relabel these as a local run.

## Required views

| File | Surface | Required observation |
|---|---|---|
| 01-preflight-plan.png | CLI | Read-only preflight and exact reviewed deployment scope |
| 02-gateway-overview.png | Portal | Real WAF_v2 gateway and disposable deployment |
| 03-https-listener.png | Portal | HTTPS listener and workshop certificate |
| 04-backend-settings-probe.png | Portal | Backend TLS validation and trusted root; see supplemental 19 for lower hostname/probe settings |
| 05-healthy-baseline.png | Portal | Healthy periodic backend/settings combinations |
| 06-trusted-baseline.png | CLI | Real CA-validated request and correct marker |
| 07-probe-failure.png | Portal | Missing-path probe health reason |
| 08-probe-recovery.png | CLI | Recovered request, healthy control and repeated repair |
| 09-tls-failure.png | Portal | Actual backend certificate/name health diagnostic |
| 10-tls-recovery.png | CLI | Restored expected name and safe repeated repair |
| 11-waf-policy.png | Portal | DRS 2.2 managed-rules table; see supplemental 20 for Prevention mode |
| 12-enforcement-controls.png | CLI | Normal success and independent custom-marker denial |
| 13-managed-rule-log.png | Portal | Actual legitimate fixture's managed-rule decision |
| 14-narrow-exclusion.png | Portal | Exact labSnippet selector and three XSS rule IDs; this policy-level exclusion applies across all associated paths |
| 15-waf-recovery.png | CLI | Legitimate request recovers; nonexcluded field still blocked |
| 16-final-validation.png | CLI | Final healthy checks and zero unexpected drift |
| 17-cleanup.png | CLI | Exact recorded resources absent |
| 18-repeated-cleanup.png | CLI | Second cleanup creates nothing; protected baseline unchanged |

## Supplemental Portal close-ups

| File | Surface | Observation |
|---|---|---|
| 19-backend-host-probe.png | Portal | Actual backend hostname and health probe, below the TLS/root settings in capture 04 |
| 20-waf-prevention-mode.png | Portal | Actual Prevention mode in its separate policy view, complementing the ruleset table in capture 11 |

These entries are supplementary to the original required set. Include them only when their real captures exist and their provenance is complete.

## Publication acceptance

Every required image must exist, open successfully, and visually match its caption. Verify the original required nine/nine surface split, the two supplemental Portal entries when present, and every image hash against the inventory. A complete 20-image publication has 11 Portal and nine CLI captures. Link each image to its stage's sanitized evidence. Keep absence checks as real observations, not output pasted from a mock test.

If a required capture cannot be obtained, record the exact missing item and resolve capture access before declaring the release complete. Do not silently replace it with artwork or illustrative output.