# Genuine screenshot contract

The workshop requires **20 genuine evidence captures: six Azure Portal, eight CLI and six GitHub UI**. The separate synthwave cover is labeled conceptual AI artwork and never counts as environment evidence. The exact numbered filenames, phases and source actors are in [capture-plan.json](capture-plan.json).

## Before paid resources

Verify usable native Azure Portal, CLI-report display and GitHub UI capture access. A screenshot needs the actual resource or actual executed output, not reconstructed UI or a terminal filled with expected results. Resolve authentication/capture access before deployment.

## Execution context

The Windows operator controls deployment; workflow jobs execute on a private Ubuntu runner. A browser can display a retained, genuine local/runner report later, provided it explicitly says **retained output**, preserves the original command and UTC execution time, and records the source hash. Display time is separate from execution time. Newly executed commands in that same view need their own label and timestamp. A Cloud Shell display of retained Terraform output is not a fresh Terraform execution in Cloud Shell.

The six Portal and six GitHub images must show their native UI. Do not substitute an API JSON screenshot for a native workflow run or Portal configuration view. Keep status, error reason, hash, run attempt and relevant scope readable.

## Capture and privacy review

Keep originals outside the public package and Git. Redact tenant/subscription IDs, private repository identifiers, personal data, tokens, state contents, sensitive plan values, host paths and unrelated resource names while preserving the diagnostic evidence. Never capture JWTs, client/request bearer tokens, runner registration tokens or raw Terraform state. A safe OIDC claims screenshot shows only allowlisted claim values; it does not show the token.

Record for every accepted JPEG/PNG: id/file, source surface, source phase, capture UTC, command execution UTC/context when applicable, source SHA-256, public SHA-256, caption, redactions, privacy_reviewed=true and generated_ui=false. Cropping/redaction may improve readability; it may not alter results. Intrinsic image dimensions must remain positive and be included in HTML to prevent layout shifts at article anchors. The twenty planned browser captures use `.jpg`; the separate conceptual cover uses `.png`.

## Required sequence

| ID | Surface | Evidence |
|---|---|---|
| 01 | CLI | Context, cost and reviewed Foundation plan |
| 02 | Portal | Private runner NIC/network |
| 03 | Portal | Private Blob backend networking |
| 04 | Portal | Exact scoped deployment/control role assignments |
| 05 | GitHub | Private repository/main workflow source |
| 06 | GitHub | Actual safe issuer/subject/audience claims |
| 07 | CLI | Reviewed Federation plan and ownership/scope |
| 08 | Portal | Exact observed federated trust |
| 09 | GitHub | Plan run/attempt, artifact/checksum and freshness metadata |
| 10 | CLI | Manual run/hash review and real refusal checks |
| 11 | GitHub | Guard checks and original binary plan apply |
| 12 | Portal | Healthy workload and independent canary |
| 13 | GitHub | Deployment OIDC failure with fresh control success |
| 14 | CLI | First and repeated OIDC repair validation |
| 15 | CLI | Owned 60-second lease conflict, release and state invariants |
| 16 | Portal | Actual StorageBlobLogs evidence |
| 17 | CLI | Isolated marker drift, healthy canary and plan scope |
| 18 | GitHub | Reviewed drift repair and safe repetition |
| 19 | CLI | Restored validation, no drift and log/artifact checks |
| 20 | CLI | Workload destroy, exact Foundation cleanup, repeated absence and baseline preservation |

Capture20 may show retained first/repeated cleanup results together if both original UTC times and phases stay explicit. Do not claim one screenshot is two fresh executions. Any independent fresh absence query must be labeled separately.

## Acceptance

All twenty mandatory files must exist with matching checksums, actual source provenance and privacy review. A placeholder never passes. Configuration screenshots alone do not prove an OIDC exchange, a lease conflict, correct plan application, drift repair or resource absence. The completed sanitized live evidence supplies those observations separately.