{
  "schema_version": 1,
  "required_total": 18,
  "required_portal": 9,
  "required_cli": 9,
  "captures": [
    {
      "id": 1,
      "file": "docs/screenshots/01-preflight-plan.png",
      "surface": "CLI",
      "title": "Preflight and reviewed plan",
      "required": true,
      "status": "captured",
      "caption": "Actual Cloud Shell display of the retained local Preflight and reviewed Plan report. Execution occurred on the operator workstation; the recorded preflight time is Europe/Berlin local time. The display timestamp is UTC. The retained preflight line uses workstation CET (UTC+1); the Cloud Shell display timestamp is UTC.",
      "captured_utc": "2026-11-06T17:24:06.9493105Z",
      "source_phase": "PreflightPlan",
      "sha256": "5b6261a038df259a9493088facadf5686f2c1a669da9aa9e648b1730ff03458e",
      "redactions": [],
      "execution_context": "Local operator report displayed later in Azure Cloud Shell",
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "20e8e9c2a01089c9febf479c536bbb0b48337da3a2730fa32bead29aab1bf7af",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 2,
      "file": "docs/screenshots/02-gateway-overview.png",
      "surface": "Portal",
      "title": "Application Gateway overview",
      "required": true,
      "status": "captured",
      "caption": "Actual deployed Application Gateway overview in West Europe: WAF V2 tier and the dedicated gateway subnet. Subscription and public IP values are redacted.",
      "captured_utc": "2026-11-06T17:58:46.1065242Z",
      "source_phase": "HealthyGatewayOverview",
      "sha256": "7423a308ae205e273471d4a190353f37e7d031638211d5328077476f6db73736",
      "redactions": [
        [
          450,
          240,
          340,
          30
        ],
        [
          1205,
          180,
          340,
          30
        ]
      ],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "06360dba34bd64fe30fdd4557f3236ec8b59aaefd65764e346f4bff72599aec7",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 3,
      "file": "docs/screenshots/03-https-listener.png",
      "surface": "Portal",
      "title": "HTTPS listener",
      "required": true,
      "status": "captured",
      "caption": "Actual HTTPS listener inspector: public frontend, port 443, and the existing frontend lab certificate.",
      "captured_utc": "2026-11-06T17:40:39.2443992Z",
      "source_phase": "ListenerConfiguration",
      "sha256": "c66d5885e47649b9e714a798c31f0cc77456e5e86bfe6791941329dafd92593a",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "a0f7908d817e7d599023ce59fd0542de015e5ef544eac6b668dd686fd789368e",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 4,
      "file": "docs/screenshots/04-backend-settings-probe.png",
      "surface": "Portal",
      "title": "Backend TLS validation and trusted root",
      "required": true,
      "status": "captured",
      "caption": "Actual TLS backend settings: HTTPS port 443, Complete validation, a private CA, and the uploaded lab-root-ca certificate. The hostname and probe are shown separately in the supplemental close-up.",
      "captured_utc": "2026-11-06T17:49:29.5418548Z",
      "source_phase": "BackendTlsConfiguration",
      "sha256": "5c41345f218bac6a60b427203000c0ba4cf6e950837dbd5090f962d8447a303b",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "b47a85ccdbea263f149a3c1ede6719ad671ae5a4a3381b764a5abb90f15597a9",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 5,
      "file": "docs/screenshots/05-healthy-baseline.png",
      "surface": "Portal",
      "title": "Healthy baseline",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal: all three HTTPS backend settings are Healthy and received HTTP 200 before fault injection.",
      "captured_utc": "2026-11-06T18:04:24.2216821Z",
      "source_phase": "Baseline",
      "sha256": "0c05ef5419d24a560c1d1ca07fd411787b5b19b1794be438caa010db0743d675",
      "redactions": [],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "25672ab36e08fb1d552a08fb9c07ab8f1013781a903a44125bf898a8dd71736c",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 6,
      "file": "docs/screenshots/06-trusted-baseline.png",
      "surface": "CLI",
      "title": "Trusted baseline request",
      "required": true,
      "status": "captured",
      "caption": "Live Cloud Shell execution at 18:06 UTC: curl trusts the public lab CA, returns HTTP 200 with the run marker, and Azure CLI reports all three HTTPS settings Healthy.",
      "captured_utc": "2026-11-06T18:06:30.2583802Z",
      "source_phase": "Baseline",
      "sha256": "f89f0faf5026abe88debb4af9b0d460a2e5234235006bbc8593dfdc8aee7e16d",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "988ed307b16ceb20e793f530e64944897adb66dff1407bc4a6b4ac2535b56dd3",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 7,
      "file": "docs/screenshots/07-probe-failure.png",
      "surface": "Portal",
      "title": "Probe failure",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal: only probe-settings is Unhealthy, with the actual HTTP 404 probe diagnostic; control-settings and tls-settings remain Healthy.",
      "captured_utc": "2026-11-06T18:10:42.2202024Z",
      "source_phase": "ProbeFault",
      "sha256": "ce0a3ca89f826aca916b9a7189e69896881a06c8590bd6dba15554d2b9bc7e38",
      "redactions": [],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "b772ac67d903e396fde39c4cc8f415ea60bf7cfbadaf436fa122501769a58292",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 8,
      "file": "docs/screenshots/08-probe-recovery.png",
      "surface": "CLI",
      "title": "Probe repair and repeated repair",
      "required": true,
      "status": "captured",
      "caption": "Genuine Cloud Shell: retained local controller evidence shows the 502 fault, repair, repeated repair and both recovery validations at their original times. Beneath it, newly executed trusted curl requests at 18:21 UTC return 200 and the correct marker for the probe and control routes.",
      "captured_utc": "2026-11-06T18:22:00.5050745Z",
      "source_phase": "ProbeRecovery",
      "sha256": "777eb2d97c9b0d78bac18c19d16aea4838766f910c37a3bc79dbdcf6534e974d",
      "redactions": [],
      "source": "Chrome tab screenshot of actual Cloud Shell; labelled retained local report followed by fresh curl execution",
      "source_sha256": "a33030de55a71a34963c5ca60b9fb70c866bc003d22c3bd0d676a1a6fa2d7c03",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 9,
      "file": "docs/screenshots/09-tls-failure.png",
      "surface": "Portal",
      "title": "Backend TLS failure",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal: tls-settings alone is Unhealthy. The actual diagnostic says the backend leaf certificate Common Name does not match the probe or backend-setting hostname; control and probe settings remain Healthy.",
      "captured_utc": "2026-11-06T18:17:50.6560883Z",
      "source_phase": "TlsFault",
      "sha256": "ec9c31eed148708a8aeb3f44bcd98e821a241e2b2cfb21e2712b580c2c3da774",
      "redactions": [],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "bc98b7e35071c41825fd585a4ae24f9108bd7c433f6587055407d9e279599635",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 10,
      "file": "docs/screenshots/10-tls-recovery.png",
      "surface": "CLI",
      "title": "TLS repair and repeated repair",
      "required": true,
      "status": "captured",
      "caption": "Genuine Cloud Shell: retained local controller evidence shows the TLS 502 fault and two successful repair/validation windows. Fresh CA-trusted curl requests at 18:23 UTC return 200 with the run marker for the restored TLS route and control.",
      "captured_utc": "2026-11-06T18:23:10.1001760Z",
      "source_phase": "TlsRecovery",
      "sha256": "11fce7e837a4be1a8c080bd01536cad28969c1b5bd8ae7bf3760d35b8c9072ef",
      "redactions": [],
      "source": "Chrome tab screenshot of actual Cloud Shell; labelled retained local report followed by fresh curl execution",
      "source_sha256": "340be6c36385d6754d1cb2e3d2b350e24a362d4f271e033199580dead0232359",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 11,
      "file": "docs/screenshots/11-waf-policy.png",
      "surface": "Portal",
      "title": "Pinned managed ruleset",
      "required": true,
      "status": "captured",
      "caption": "Actual Portal view of Microsoft Default Rule Set 2.2, filtered to XSS rules. Enabled and disabled rows reflect the deployed ruleset defaults before exclusion calibration.",
      "captured_utc": "2026-11-06T17:36:27.7374891Z",
      "source_phase": "DeployedWafPolicy",
      "sha256": "94d04005dbfe99d2a45657c39b431f6349e567f2e3d693aa27447dfeee043786",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "f34b6dff4b321fe8f800691437120bfb1fbdfdf6b9495fbf0945bb28d7cbab22",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 12,
      "file": "docs/screenshots/12-enforcement-controls.png",
      "surface": "CLI",
      "title": "Enforcement controls",
      "required": true,
      "status": "captured",
      "caption": "Live Cloud Shell at 18:08 UTC: DRS 2.2 is Enabled in Prevention mode; the trusted normal request returns 200 and the harmless custom marker returns 403, both with curl exit 0.",
      "captured_utc": "2026-11-06T18:08:27.5911966Z",
      "source_phase": "Enforcement",
      "sha256": "593801c7372edb3265d25be39fe19d40e62ae0a599c73a46da3e92235bd183bf",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "3ed3c703feb3b375e814b3bbe4841c952f0386b62d28ff15c663e079ffdb2c2b",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 13,
      "file": "docs/screenshots/13-managed-rule-log.png",
      "surface": "Portal",
      "title": "Managed-rule evidence",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal query of genuine calibration events at 17:57:01 UTC: rules 941100, 941110 and 941160 matched; 949110 blocked at anomaly score 15. DRS version 2.2 and event timestamps remain visible.",
      "captured_utc": "2026-11-06T18:12:46.3182629Z",
      "source_phase": "WafCalibration",
      "sha256": "4797f4538c081533517aac79203860853ced397c6ea7720e17ba2f1bd81d3a46",
      "redactions": [],
      "source": "Chrome tab screenshot of actual resource-specific AGWFirewallLogs query results",
      "source_sha256": "e94b1ac290e121f45f113941562a4b53b20c6ad2a7925ca24a4d72083ab632d0",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 14,
      "file": "docs/screenshots/14-narrow-exclusion.png",
      "surface": "Portal",
      "title": "Exact per-rule exclusion",
      "required": true,
      "status": "captured",
      "caption": "Live Azure Portal after repeated WAF repair: RequestArgValues Equals labSnippet excludes only XSS rules 941100, 941110 and 941160 under DRS 2.2. The Portal column was widened to preserve full rule IDs. This policy-level field exclusion covers every associated path.",
      "captured_utc": "2026-11-06T18:27:54.8648418Z",
      "source_phase": "WafRecovery",
      "sha256": "81cb1723f7c5dcbc06bfc597af8210b601d22deb455dc6eb15ad30bb1fea299b",
      "redactions": [],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "9c38e949774ff11f3f5ae8a13a889784787a97f6c62402454a285b1a7ab9281c",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 15,
      "file": "docs/screenshots/15-waf-recovery.png",
      "surface": "CLI",
      "title": "WAF repair and boundary control",
      "required": true,
      "status": "captured",
      "caption": "Genuine Cloud Shell: retained controller checks show the managed-rule 403 fault and two successful repair windows. Fresh CA-trusted requests at 18:26 UTC prove the pinned payload returns 200 in labSnippet and remains blocked with 403 in untrustedSnippet; curl exit is 0 in both cases.",
      "captured_utc": "2026-11-06T18:27:05.5724772Z",
      "source_phase": "WafRecovery",
      "sha256": "3eb0584abd881b78127d145a34edb45458016105596f703818d91f612254b5cf",
      "redactions": [],
      "source": "Chrome tab screenshot of actual Cloud Shell; labelled retained local report followed by fresh curl execution",
      "source_sha256": "21d596a851f95f171473a131df7b9205d85b9b6cb26997941e5f0c7f49ca0f27",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 16,
      "file": "docs/screenshots/16-final-validation.png",
      "surface": "CLI",
      "title": "Final validation and no drift",
      "required": true,
      "status": "captured",
      "caption": "Retained genuine local Windows controller results displayed later in Cloud Shell: final healthy HTTPS checks, Terraform detailed exit code 0, both fault-route 502 log records, custom-rule correlation and DRS 2.2 managed-rule correlation. Original execution timestamps are preserved; Terraform was not rerun in Cloud Shell.",
      "captured_utc": "2026-11-06T18:30:24.2502750Z",
      "source_phase": "FinalValidation",
      "sha256": "94a1e6c59f4f5fa8b11ffa2ba7e89a208d9715fb240e987985437bd22bef801c",
      "redactions": [],
      "execution_context": "Local operator report displayed later in Azure Cloud Shell",
      "source": "Chrome tab screenshot of actual Cloud Shell displaying explicitly labelled retained local execution evidence",
      "source_sha256": "c055a6dcf8ca9aafab4e49fe9c6e98b8d65149cb7fa987715ce4ce693d2ac817",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 17,
      "file": "docs/screenshots/17-cleanup.png",
      "surface": "CLI",
      "title": "Verified cleanup",
      "required": true,
      "status": "captured",
      "caption": "Retained actual local Terraform cleanup checks at 18:40 UTC report exact group absence and zero missing baseline resources. Fresh independent Cloud Shell queries at 18:41 UTC confirm GroupExists=False and zero scoped resources. All 27 pre-existing resources were preserved.",
      "captured_utc": "2026-11-06T18:41:30.3995023Z",
      "source_phase": "Cleanup",
      "sha256": "f481159212972843701f1029d1aff8479e972c02f1b1e6252ddb724c07d205a7",
      "redactions": [],
      "source": "Chrome tab screenshot of actual Cloud Shell; labelled retained local cleanup report followed by fresh Azure CLI absence queries",
      "source_sha256": "795b390bc8f412f1d7f82d5a2b3c127ed1b14e289081d409ec027dd8655ed2e6",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 18,
      "file": "docs/screenshots/18-repeated-cleanup.png",
      "surface": "CLI",
      "title": "Repeated cleanup and baseline comparison",
      "required": true,
      "status": "captured",
      "caption": "Genuine Cloud Shell: retained first and repeated local Cleanup checks confirm safe repetition, zero missing pre-existing resources and complete=true with no missing checks. Another fresh Azure CLI query at 18:42 UTC confirms the exact group remains absent.",
      "captured_utc": "2026-11-06T18:42:29.2846577Z",
      "source_phase": "RepeatedCleanup",
      "sha256": "45617d27700cfb3296d84493a80d8e6034c0d4f76840867a1be19c81bdbe21fd",
      "redactions": [],
      "source": "Chrome tab screenshot of actual Cloud Shell; labelled retained repeated-cleanup report followed by fresh Azure CLI absence query",
      "source_sha256": "f1262a9255d2227d7cc76cacd9db7784feb17c1022a1b02a4479034aeb4d2b54",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 19,
      "file": "docs/screenshots/19-backend-host-probe.png",
      "surface": "Portal",
      "title": "Backend hostname and probe close-up",
      "required": false,
      "status": "captured",
      "caption": "Actual lower section of the same TLS backend inspector: backend.lab.test is the hostname override and tls-probe is the selected custom probe.",
      "captured_utc": "2026-11-06T17:55:46.4522793Z",
      "source_phase": "BackendHostnameProbe",
      "sha256": "860821ecbd12d13aa471d2a5e1ada2b01c018db7fc0f3abf28bfe197e3936f31",
      "redactions": [],
      "source": "Native Chrome window screenshot of the actual Azure Portal or Cloud Shell",
      "source_sha256": "d3221f36e23086133a2500456fccc4fe30a9b5eec36c116d2a04f6155cfa811e",
      "privacy_reviewed": true,
      "generated_ui": false
    },
    {
      "id": 20,
      "file": "docs/screenshots/20-waf-prevention-mode.png",
      "surface": "Portal",
      "title": "WAF Prevention mode close-up",
      "required": false,
      "status": "captured",
      "caption": "Live Azure Portal overview confirms the WAF policy is Enabled in Prevention mode. Subscription identifier is redacted.",
      "captured_utc": "2026-11-06T18:09:15.2747639Z",
      "source_phase": "Enforcement",
      "sha256": "8fe3bde3a58ca24a1e6da213ab511f9f6e3d1567bc87cd6ac825a8d771630c84",
      "redactions": [
        [
          430,
          230,
          300,
          26
        ]
      ],
      "source": "Chrome tab screenshot of the actual Azure Portal",
      "source_sha256": "4e51b997cec2dfea0373e74f0d5c3f1bee24a4a2fd1a82e588d8d72fa9350c8e",
      "privacy_reviewed": true,
      "generated_ui": false
    }
  ],
  "supplemental_planned": 2,
  "public_target_total": 20,
  "public_target_portal": 11,
  "public_target_cli": 9
}