Generated from six final module app-data payloads, not prior RELEASE_LOCK assertions. 268 exact work orders. No answer key.
| Module / work order | Phase | Command | CLI reference |
|---|---|---|---|
| 01 · CLI-01 | Orient | pwd | Module 01 |
| 01 · CLI-02 | Orient | cat Incoming/EXAMINER_ASSIGNMENT_AND_SCOPE.txt | Module 01 |
| 01 · CLI-03 | Orient | cat Incoming/authority_scope_and_consent_summary.txt | Module 01 |
| 01 · CLI-04 | Orient | ls -lah Incoming | Module 01 |
| 01 · CLI-05 | Orient | find Incoming -type f | Module 01 |
| 01 · CLI-06 | Orient | whoami | Module 01 |
| 01 · CLI-07 | Source audit | file Incoming/intake_chain_of_custody.csv | Module 01 |
| 01 · CLI-08 | Source audit | stat -c '%n %s bytes' Incoming/protected_witness_intake_Liora_Venn.txt | Module 01 |
| 01 · CLI-09 | Source audit | cat Incoming/protected_witness_intake_Liora_Venn.txt | Module 01 |
| 01 · CLI-10 | Source audit | cat Incoming/intake_chain_of_custody.csv | Module 01 |
| 01 · CLI-11 | Source audit | cat Incoming/witness_status_record.json | Module 01 |
| 01 · CLI-12 | Source audit | cat Incoming/supplemental_recall_form_draft.txt | Module 01 |
| 01 · CLI-13 | Source audit | grep -n -F 'medical-forensic scope required' Incoming/witness_status_record.json | Module 01 |
| 01 · CLI-14 | Source audit | cat Incoming/RECEIVED_INTAKE_SHA256.txt | Module 01 |
| 01 · CLI-15 | Verify | sha256sum -c Incoming/RECEIVED_INTAKE_SHA256.txt | Module 01 |
| 01 · CLI-16 | Preserve | mkdir -p Evidence/Working Reports | Module 01 |
| 01 · CLI-17 | Preserve | cp Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Module 01 |
| 01 · CLI-18 | Preserve | cp Incoming/intake_chain_of_custody.csv Evidence/Working/intake_chain_of_custody.csv | Module 01 |
| 01 · CLI-19 | Preserve | cp Incoming/authority_scope_and_consent_summary.txt Evidence/Working/authority_scope_and_consent_summary.txt | Module 01 |
| 01 · CLI-20 | Verify | sha256sum Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Module 01 |
| 01 · CLI-21 | Verify | cmp -s Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Module 01 |
| 01 · CLI-22 | Verify | echo $? | Module 01 |
| 01 · CLI-23 | Verify | sha256sum Evidence/Working/protected_witness_intake_Liora_Venn.txt > Reports/SHA256SUMS.txt | Module 01 |
| 01 · CLI-24 | Verify | sha256sum -c Reports/SHA256SUMS.txt | Module 01 |
| 01 · CLI-25 | Review | grep -n -F 'sidecar disclosure documented' Evidence/Working/intake_chain_of_custody.csv | Module 01 |
| 01 · CLI-26 | Review | grep -n -F 'sidecar disclosure documented' Evidence/Working/intake_chain_of_custody.csv | tee Reports/intake_disclosure_excerpt.txt | Module 01 |
| 01 · CLI-27 | Review | cat Reports/intake_disclosure_excerpt.txt | Module 01 |
| 01 · CLI-28 | Review | wc -l Reports/intake_disclosure_excerpt.txt | Module 01 |
| 01 · CLI-29 | Failure clinic | cat Incoming/NOT_PRESENT.txt | Module 01 |
| 01 · CLI-30 | Failure clinic | cp Incoming/authority_scope_and_consent_summary.txt Incoming/forbidden_copy.txt | Module 01 |
| 01 · CLI-31 | Failure clinic | cp Evidence/Working/protected_witness_intake_Liora_Venn.txt Reports/verification-trial.txt | Module 01 |
| 01 · CLI-32 | Failure clinic | sha256sum Reports/verification-trial.txt > Reports/TRIAL_SHA256SUMS.txt | Module 01 |
| 01 · CLI-33 | Failure clinic | echo CONTROLLED_TEST_CHANGE >> Reports/verification-trial.txt | Module 01 |
| 01 · CLI-34 | Failure clinic | sha256sum -c Reports/TRIAL_SHA256SUMS.txt | Module 01 |
| 01 · CLI-35 | Failure clinic | cp Evidence/Working/protected_witness_intake_Liora_Venn.txt Reports/verification-trial.txt | Module 01 |
| 01 · CLI-36 | Failure clinic | sha256sum -c Reports/TRIAL_SHA256SUMS.txt | Module 01 |
| 02 · CLI-01 | Orient | pwd | Module 02 |
| 02 · CLI-02 | Orient | cat Incoming/EXAMINER_PORTAL_ASSIGNMENT.txt | Module 02 |
| 02 · CLI-03 | Orient | ls -lah Incoming | Module 02 |
| 02 · CLI-04 | Orient | find Incoming -type f | Module 02 |
| 02 · CLI-05 | Orient | sha256sum Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-06 | Portal JSON | jq -r '.case.case_id' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-07 | Portal JSON | jq -r '.appointment_record.original.location' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-08 | Portal JSON | jq -r '.appointment_record.current.location' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-09 | Portal JSON | jq -r '.appointment_record.current.reason' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-10 | Portal JSON | jq -r '.appointment_record.current.requester' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-11 | Portal JSON | jq -r '.appointment_record.current.approver_display' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-12 | Portal JSON | jq -r '.appointment_record.current.approver_account_id' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-13 | Portal JSON | jq -r '.policy_and_account_snapshot.approver_account.directory_status' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-14 | Portal JSON | jq -r '.policy_and_account_snapshot.policy_result' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-15 | Portal JSON | jq -r '.policy_and_account_snapshot.mfa_state_at_approval' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-16 | Portal JSON | jq -r '.appointment_record.current.confirmation_status' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-17 | Portal JSON | jq -r '.appointment_record.scheduled_start' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-18 | Portal JSON | jq -r '.appointment_record.original.required_observers[]' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-19 | Portal JSON | jq -r '.change_event.approval_recorded_at' Incoming/witness_support_portal_export_student_v1.json | Module 02 |
| 02 · CLI-20 | Audit CSV | csvcut -n Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-21 | Audit CSV | csvcut -c seq,event_time,action,actor_display Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-22 | Audit CSV | csvgrep -c action -m field_update Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-23 | Audit CSV | csvgrep -c action -m approval_requested Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-24 | Audit CSV | csvgrep -c action -m approval_recorded Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-25 | Audit CSV | csvgrep -c action -m record_committed Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-26 | Audit CSV | csvgrep -c action -m notification_sent Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-27 | Audit CSV | csvgrep -c action -m portal_view Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-28 | Audit CSV | csvgrep -c action -m confirmation_state_check Incoming/appointment_change_audit.csv | Module 02 |
| 02 · CLI-29 | Notice & email | grep -n -F 'Confirmation status: PENDING' Incoming/portal_screenshot_text_dump.txt | Module 02 |
| 02 · CLI-30 | Notice & email | grep -n -F 'Previous location:' Incoming/portal_screenshot_text_dump.txt | Module 02 |
| 02 · CLI-31 | Notice & email | head -n 16 Incoming/transport_update_email.eml | Module 02 |
| 02 · CLI-32 | Notice & email | grep -n -F 'X-WSP-Approver-Display:' Incoming/transport_update_email.eml | Module 02 |
| 02 · CLI-33 | Notice & email | grep -n -F 'Message-ID:' Incoming/transport_update_email.eml | Module 02 |
| 02 · CLI-34 | Notice & email | grep -n -F 'Tomorrow' Incoming/transport_update_email.eml | Module 02 |
| 02 · CLI-35 | Chronology | date -d '2211-09-18' '+%A' | Module 02 |
| 02 · CLI-36 | Chronology | date -u -d '2211-09-18T02:11:43-06:00' '+%Y-%m-%dT%H:%M:%SZ' | Module 02 |
| 02 · CLI-37 | Preserve & verify | mkdir -p Evidence/Working Reports | Module 02 |
| 02 · CLI-38 | Preserve & verify | cp Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Module 02 |
| 02 · CLI-39 | Preserve & verify | sha256sum Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Module 02 |
| 02 · CLI-40 | Preserve & verify | cmp -s Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Module 02 |
| 02 · CLI-41 | Preserve & verify | echo $? | Module 02 |
| 02 · CLI-42 | Preserve & verify | csvgrep -c action -m approval_recorded Evidence/Working/appointment_change_audit.csv | csvcut -c event_time,actor_display,account_state,policy_result | tee Reports/approval_row.csv | Module 02 |
| 03 · CLI-01 | Orient | pwd | Module 03 |
| 03 · CLI-02 | Orient | cat Incoming/EXAMINER_SCENE_ASSIGNMENT.txt | Module 03 |
| 03 · CLI-03 | Orient | ls -lah Incoming | Module 03 |
| 03 · CLI-04 | Orient | find Incoming -type f | Module 03 |
| 03 · CLI-05 | Orient | sha256sum Incoming/scene_entry_log.csv | Module 03 |
| 03 · CLI-06 | Access control | csvcut -n Incoming/door_lock_audit.csv | Module 03 |
| 03 · CLI-07 | Access control | csvgrep -c Event_Type -m credential_presented Incoming/door_lock_audit.csv | Module 03 |
| 03 · CLI-08 | Access control | csvgrep -c Event_Type -m admin_override_request Incoming/door_lock_audit.csv | Module 03 |
| 03 · CLI-09 | Access control | csvgrep -c Lock_Zone -m bedroom_closet_pass_through Incoming/door_lock_audit.csv | Module 03 |
| 03 · CLI-10 | Smart-home JSONL | jq -r '.event_type' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-11 | Smart-home JSONL | jq -r 'select(.event_type=="admin_override_request") | .timestamp' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-12 | Smart-home JSONL | jq -r 'select(.event_type=="mode_entered") | .details.mode' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-13 | Smart-home JSONL | jq -r 'select(.event_type=="service_panel_contact") | .details.panel_id' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-14 | Smart-home JSONL | jq -r 'select(.event_type=="service_pass_through_state") | .timestamp' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-15 | Smart-home JSONL | jq -r 'select(.event_type=="manual_note_field_update") | .details.note_after' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-16 | Smart-home JSONL | jq -r 'select(.event_type=="carrier_state_change") | .details.voice_status' Incoming/smart_home_events_student_v1.jsonl | Module 03 |
| 03 · CLI-17 | Smart-home JSONL | jq -r '.apartment_gateway.wan_status' Incoming/unit_connectivity_scene_only_v1.json | Module 03 |
| 03 · CLI-18 | Visitor & panel | csvgrep -c Requestor_Label -m "Building Wellness Services" Incoming/visitor_access_requests_student_v1.csv | Module 03 |
| 03 · CLI-19 | Visitor & panel | csvgrep -c Decision_Status -m pending Incoming/visitor_access_requests_student_v1.csv | Module 03 |
| 03 · CLI-20 | Visitor & panel | csvgrep -c Display_Text -m 'MAINTENANCE MODE ACTIVE' Incoming/wall_panel_events.csv | Module 03 |
| 03 · CLI-21 | Visitor & panel | csvgrep -c Display_Text -m 'TAMPER RESPONSE: ARMED' Incoming/wall_panel_events.csv | Module 03 |
| 03 · CLI-22 | Visitor & panel | csvgrep -c Display_Text -m 'PARK ROUTE' Incoming/wall_panel_events.csv | Module 03 |
| 03 · CLI-23 | Scene and route | csvcut -n Incoming/hallway_camera_index_student_v1.csv | Module 03 |
| 03 · CLI-24 | Scene and route | csvgrep -c Availability -m gap Incoming/hallway_camera_index_student_v1.csv | Module 03 |
| 03 · CLI-25 | Scene and route | csvgrep -c Camera_ID -m 32S Incoming/hallway_camera_index_student_v1.csv | Module 03 |
| 03 · CLI-26 | Scene and route | grep -n -F 'Hidden Service' Incoming/floor_plan_unit_3214.svg | Module 03 |
| 03 · CLI-27 | Scene and route | cat Incoming/hidden_pass_through_observation_student_v1.txt | Module 03 |
| 03 · CLI-28 | Scene and route | jq -r '.markers[].marker' Incoming/evidence_markers_student_v1.json | Module 03 |
| 03 · CLI-29 | Responder & custody | csvcut -c Entry_ID,Timestamp,Person,Reason_for_Entry Incoming/scene_entry_log.csv | Module 03 |
| 03 · CLI-30 | Responder & custody | csvgrep -c Agency_or_Group -m "Saint Meridian EMS" Incoming/scene_entry_log.csv | Module 03 |
| 03 · CLI-31 | Responder & custody | csvgrep -c Person -m Flores Incoming/scene_entry_log.csv | Module 03 |
| 03 · CLI-32 | Responder & custody | csvgrep -c Credential_Label -m Marek Incoming/door_lock_audit.csv | Module 03 |
| 03 · CLI-33 | Responder & custody | csvgrep -c handler -m Tomas Incoming/recorder_handling_log.csv | Module 03 |
| 03 · CLI-34 | Responder & custody | grep -n -F 'Tamper burn preferred.' Incoming/recorder_text_transcript_received.txt | Module 03 |
| 03 · CLI-35 | Responder & custody | csvsort -c collected_time Incoming/chain_of_custody_scene.csv | Module 03 |
| 03 · CLI-36 | Responder & custody | csvgrep -c Photographer -m "Jun Kato" Incoming/scene_photos_manifest_student_v1.csv | Module 03 |
| 03 · CLI-37 | Preserve & report | mkdir -p Evidence/Working Reports | Module 03 |
| 03 · CLI-38 | Preserve & report | cp Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Module 03 |
| 03 · CLI-39 | Preserve & report | sha256sum Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Module 03 |
| 03 · CLI-40 | Preserve & report | cmp -s Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Module 03 |
| 03 · CLI-41 | Preserve & report | echo $? | Module 03 |
| 03 · CLI-42 | Preserve & report | csvgrep -c Event_Type -m admin_override_request Evidence/Working/door_lock_audit.csv | csvcut -c Timestamp,Audit_ID,Credential_ID,Result | tee Reports/override_extract.csv | Module 03 |
| 04 · CLI-01 | Authority & consent | pwd | Module 04 |
| 04 · CLI-02 | Authority & consent | cat Incoming/EXAMINER_HOSPITAL_ASSIGNMENT.txt | Module 04 |
| 04 · CLI-03 | Authority & consent | ls -l Incoming | Module 04 |
| 04 · CLI-04 | Authority & consent | cat Incoming/limited_consent_form.txt | Module 04 |
| 04 · CLI-05 | Authority & consent | jq -r '.authorized_assessment.permitted_data_categories[]' Incoming/consent_scope_boundaries.json | Module 04 |
| 04 · CLI-06 | Authority & consent | jq -r '.excluded_categories[]' Incoming/consent_scope_boundaries.json | Module 04 |
| 04 · CLI-07 | Authority & consent | cat Incoming/no_vendor_access_order.txt | Module 04 |
| 04 · CLI-08 | Cradle & passive evidence | csvgrep -c action -m calibration_hold_applied Incoming/cradle_transport_manifest.csv | Module 04 |
| 04 · CLI-09 | Cradle & passive evidence | csvgrep -c action -m contents_inventory_exception Incoming/cradle_transport_manifest.csv | Module 04 |
| 04 · CLI-10 | Cradle & passive evidence | cat Incoming/delayed_calibration_card.txt | Module 04 |
| 04 · CLI-11 | Cradle & passive evidence | cat Incoming/substitute_interface_warning.txt | Module 04 |
| 04 · CLI-12 | Cradle & passive evidence | csvgrep -c primary_warning -m 'WAIT FOR AUTHORIZED CRADLE' Incoming/containment_monitor_passive_capture.csv | Module 04 |
| 04 · CLI-13 | Cradle & passive evidence | csvgrep -c partial_identifier_2 -m FORMALIZATION Incoming/containment_monitor_passive_capture.csv | Module 04 |
| 04 · CLI-14 | Cradle & passive evidence | csvgrep -c person_name -m "Nico Raines" Incoming/diagnostic_suite_access_log.csv | Module 04 |
| 04 · CLI-15 | Workstation & USB | csvcut -n Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-16 | Workstation & USB | csvgrep -c event_id -m 8004 Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-17 | Workstation & USB | csvgrep -c event_id -m 410 Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-18 | Workstation & USB | csvgrep -c message -m 'TRAINING / NON-FORENSIC / UNSUPPORTED' Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-19 | Workstation & USB | csvgrep -c message -m 'Workstation service port accessed' Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-20 | Workstation & USB | csvgrep -c message -m 'Service bridge handshake request generated' Incoming/observation_workstation_eventlog_student.csv | Module 04 |
| 04 · CLI-21 | Workstation & USB | csvgrep -c serial_number -m NIFB-LG-4C77 Incoming/usb_device_history.csv | Module 04 |
| 04 · CLI-22 | Workstation & USB | cat Incoming/nif_bridge_adapter_label.txt | Module 04 |
| 04 · CLI-23 | Port correlation | jq -r '.before_unauthorized_connection.isolation_state' Incoming/service_port_status_student.json | Module 04 |
| 04 · CLI-24 | Port correlation | jq -r '.during_unauthorized_connection.handshake_type_claimed_by_tool' Incoming/service_port_status_student.json | Module 04 |
| 04 · CLI-25 | Port correlation | jq -r '.after_unauthorized_connection.service_port_2_state' Incoming/service_port_status_student.json | Module 04 |
| 04 · CLI-26 | SQLite tamper analysis | csvcut -c sequence,timestamp,event_state Incoming/purge_sequence_student.csv | Module 04 |
| 04 · CLI-27 | SQLite tamper analysis | csvgrep -c rule_id -m UAL-7 Incoming/purge_sequence_student.csv | Module 04 |
| 04 · CLI-28 | SQLite tamper analysis | csvgrep -c event_state -m CLEARED Incoming/purge_sequence_student.csv | Module 04 |
| 04 · CLI-29 | SQLite tamper analysis | file Incoming/sidecar_tamper_log_student.sqlite | Module 04 |
| 04 · CLI-30 | SQLite tamper analysis | sqlite3 -readonly Incoming/sidecar_tamper_log_student.sqlite .tables | Module 04 |
| 04 · CLI-31 | SQLite tamper analysis | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT event_id,sequence,state FROM tamper_events ORDER BY sequence LIMIT 5;" | Module 04 |
| 04 · CLI-32 | SQLite tamper analysis | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT event_id,rule_id,state FROM tamper_events WHERE rule_id='UAL-7' ORDER BY sequence;" | Module 04 |
| 04 · CLI-33 | SQLite tamper analysis | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT region_name,state,readable_content FROM cleared_regions ORDER BY region_id;" | Module 04 |
| 04 · CLI-34 | SQLite tamper analysis | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT marker_type,marker_value FROM surviving_markers ORDER BY marker_id;" | Module 04 |
| 04 · CLI-35 | Evidence loss & limits | cat Incoming/medical_stabilization_note.txt | Module 04 |
| 04 · CLI-36 | Integrity & reporting | mkdir -p Evidence/Working Reports | Module 04 |
| 04 · CLI-37 | Integrity & reporting | cp Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Module 04 |
| 04 · CLI-38 | Integrity & reporting | sha256sum Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Module 04 |
| 04 · CLI-39 | Integrity & reporting | cmp -s Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Module 04 |
| 04 · CLI-40 | Integrity & reporting | echo $? | Module 04 |
| 04 · CLI-41 | Integrity & reporting | csvgrep -c rule_id -m UAL-7 Evidence/Working/purge_sequence_student.csv | tee Reports/ual7_trigger_extract.csv | Module 04 |
| 04 · CLI-42 | Integrity & reporting | cat Reports/ual7_trigger_extract.csv | Module 04 |
| 05 · CLI-01 | Authority & provenance | pwd | Module 05 |
| 05 · CLI-02 | Authority & provenance | cat Incoming/EXAMINER_PROVIDER_BROKER_ASSIGNMENT.txt | Module 05 |
| 05 · CLI-03 | Authority & provenance | ls -l Incoming | Module 05 |
| 05 · CLI-04 | Receipt & packet | jq -r '.local_reference_id' Incoming/remote_receipt_marker_student.json | Module 05 |
| 05 · CLI-05 | Receipt & packet | jq -r '.linked_packet.file_name' Incoming/remote_receipt_marker_student.json | Module 05 |
| 05 · CLI-06 | Receipt & packet | jq -r '.created_timestamp' Incoming/remote_receipt_marker_student.json | Module 05 |
| 05 · CLI-07 | Receipt & packet | file Incoming/encrypted_status_packet.bin | Module 05 |
| 05 · CLI-08 | Receipt & packet | sha256sum Incoming/encrypted_status_packet.bin | Module 05 |
| 05 · CLI-09 | Receipt & packet | xxd -l 64 -g 1 Incoming/encrypted_status_packet.bin | Module 05 |
| 05 · CLI-10 | Receipt & packet | strings -a -n 16 Incoming/encrypted_status_packet.bin | Module 05 |
| 05 · CLI-11 | Receipt & packet | jq -r '.linked_packet.sha256' Incoming/remote_receipt_marker_student.json | Module 05 |
| 05 · CLI-12 | Provider access sequence | csvcut -n Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-13 | Provider access sequence | csvgrep -c event_type -m pre_purge_service_access Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-14 | Provider access sequence | csvcut -c event_id,timestamp,event_type,result Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-15 | Provider access sequence | csvgrep -c event_type -m cache_cleared_notice Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-16 | Provider access sequence | csvgrep -c event_type -m remote_receipt_marker Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-17 | Provider access sequence | jq -r '.service_status.first_seen' Incoming/provider_service_record_student.json | Module 05 |
| 05 · CLI-18 | Provider access sequence | jq -r '.routing_classification.broker_field' Incoming/provider_service_record_student.json | Module 05 |
| 05 · CLI-19 | Provider access sequence | jq -r '.provider.export_timestamp' Incoming/provider_service_record_student.json | Module 05 |
| 05 · CLI-20 | Preservation & legal hold | cat Incoming/preservation_request_draft.txt | Module 05 |
| 05 · CLI-21 | Preservation & legal hold | grep -F 'Subject:' Incoming/preservation_acknowledgment.eml | Module 05 |
| 05 · CLI-22 | Preservation & legal hold | grep -F 'Hold ID:' Incoming/preservation_acknowledgment.eml | Module 05 |
| 05 · CLI-23 | Preservation & legal hold | csvgrep -c event_type -m preservation_flag Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-24 | Brokered trust and account state | csvcut -n Incoming/dead_account_trust_class_student.csv | Module 05 |
| 05 · CLI-25 | Brokered trust and account state | csvgrep -c account_state -m deceased Incoming/dead_account_trust_class_student.csv | Module 05 |
| 05 · CLI-26 | Brokered trust and account state | csvcut -c report_id,timestamp,account_display,account_state,trust_class,broker_field Incoming/dead_account_trust_class_student.csv | Module 05 |
| 05 · CLI-27 | Brokered trust and account state | jq -r 'select(.event_type=="pre_purge_broker_class_lookup") | .result' Incoming/broker_query_events_student.jsonl | Module 05 |
| 05 · CLI-28 | Brokered trust and account state | jq -r 'select(.event_type=="municipal_relay_queue_status") | .queue_reference' Incoming/broker_query_events_student.jsonl | Module 05 |
| 05 · CLI-29 | Brokered trust and account state | csvgrep -c query_target_category -m protected-person Incoming/protected_person_status_student.csv | Module 05 |
| 05 · CLI-30 | Reduced identity audit | jq -r '.export_timestamp' Incoming/municipal_identity_audit_student.json | Module 05 |
| 05 · CLI-31 | Reduced identity audit | jq -r '.audit_field_recorded.search_phrase' Incoming/municipal_identity_audit_student.json | Module 05 |
| 05 · CLI-32 | Reduced identity audit | jq -r '.audit_field_recorded.identity_disclosure_state' Incoming/municipal_identity_audit_student.json | Module 05 |
| 05 · CLI-33 | Reduced identity audit | jq -r '.audit_field_recorded.relevance_state' Incoming/municipal_identity_audit_student.json | Module 05 |
| 05 · CLI-34 | Reduced identity audit | cat Incoming/account_state_summary_student.txt | Module 05 |
| 05 · CLI-35 | Integrity & reporting | mkdir -p Evidence/Working Reports | Module 05 |
| 05 · CLI-36 | Integrity & reporting | cp Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Module 05 |
| 05 · CLI-37 | Integrity & reporting | sha256sum Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Module 05 |
| 05 · CLI-38 | Integrity & reporting | cmp -s Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Module 05 |
| 05 · CLI-39 | Integrity & reporting | echo $? | Module 05 |
| 05 · CLI-40 | Integrity & reporting | csvgrep -c event_type -m pre_purge_service_access Evidence/Working/provider_access_log_student.csv | tee Reports/pre_purge_access.csv | Module 05 |
| 05 · CLI-41 | Integrity & reporting | cat Reports/pre_purge_access.csv | Module 05 |
| 05 · CLI-42 | Integrity & reporting | sha256sum Reports/pre_purge_access.csv | Module 05 |
| 05 · CLI-43 | Cross-module chronology & verification | csvcut -n Incoming/prior_module_event_reference_student.csv | Module 05 |
| 05 · CLI-44 | Cross-module chronology & verification | csvsort -c reported_time Incoming/prior_module_event_reference_student.csv | Module 05 |
| 05 · CLI-45 | Cross-module chronology & verification | csvsort -c timestamp Incoming/provider_access_log_student.csv | Module 05 |
| 05 · CLI-46 | Cross-module chronology & verification | date -u -d '2211-09-18T03:21:58-06:00' '+%Y-%m-%dT%H:%M:%SZ' | Module 05 |
| 05 · CLI-47 | Cross-module chronology & verification | grep -F 'Message-ID:' Incoming/preservation_acknowledgment.eml | Module 05 |
| 05 · CLI-48 | Cross-module chronology & verification | cat Incoming/PROVIDER_RETURN_AVAILABILITY.txt | Module 05 |
| 05 · CLI-49 | Cross-module chronology & verification | sha256sum Incoming/remote_receipt_marker_student.json | Module 05 |
| 05 · CLI-50 | Cross-module chronology & verification | sha256sum Incoming/encrypted_status_packet.bin > Reports/status_packet.sha256 && sha256sum -c Reports/status_packet.sha256 | Module 05 |
| 06 · CLI-01 | Case scope & evidence crosswalk | pwd | Module 06 |
| 06 · CLI-02 | Case scope & evidence crosswalk | cat Incoming/EXAMINER_CAPSTONE_ASSIGNMENT.txt | Module 06 |
| 06 · CLI-03 | Case scope & evidence crosswalk | ls -l Incoming | Module 06 |
| 06 · CLI-04 | Case scope & evidence crosswalk | csvcut -n Incoming/released_source_register.csv | Module 06 |
| 06 · CLI-05 | Case scope & evidence crosswalk | csvgrep -c module -m 04 Incoming/released_source_register.csv | Module 06 |
| 06 · CLI-06 | Case scope & evidence crosswalk | sha256sum Incoming/released_source_register.csv | Module 06 |
| 06 · CLI-07 | Cross-source clocks | csvcut -n Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-08 | Cross-source clocks | csvsort -c reported_local_time Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-09 | Cross-source clocks | csvgrep -c stream -m portal Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-10 | Cross-source clocks | csvgrep -c stream -m apartment Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-11 | Cross-source clocks | csvgrep -c stream -m hospital Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-12 | Cross-source clocks | csvgrep -c stream -m provider Incoming/case_timeline_claims.csv | Module 06 |
| 06 · CLI-13 | Cross-source clocks | csvcut -n Incoming/unresolved_source_conflicts.csv | Module 06 |
| 06 · CLI-14 | Cross-source clocks | csvgrep -c type -m custody Incoming/unresolved_source_conflicts.csv | Module 06 |
| 06 · CLI-15 | Cross-source clocks | csvgrep -c type -m hospital Incoming/unresolved_source_conflicts.csv | Module 06 |
| 06 · CLI-16 | Handling & loss | cat Incoming/nico_incident_statement_signed.txt | Module 06 |
| 06 · CLI-17 | Handling & loss | grep -F 'I proceeded anyway.' Incoming/nico_incident_statement_signed.txt | Module 06 |
| 06 · CLI-18 | Handling & loss | cat Incoming/restriction_order.txt | Module 06 |
| 06 · CLI-19 | Handling & loss | cat Incoming/review_board_findings.txt | Module 06 |
| 06 · CLI-20 | Handling & loss | csvcut -n Incoming/lost_vs_remaining_student.csv | Module 06 |
| 06 · CLI-21 | Handling & loss | csvgrep -c category -m lost Incoming/lost_vs_remaining_student.csv | Module 06 |
| 06 · CLI-22 | Handling & loss | csvgrep -c category -m survived Incoming/lost_vs_remaining_student.csv | Module 06 |
| 06 · CLI-23 | Handling & loss | cat Incoming/final_controlled_assessment_narrative_note.txt | Module 06 |
| 06 · CLI-24 | Reduced sealed comparison | csvcut -n Incoming/sealed_phrase_comparison_student.csv | Module 06 |
| 06 · CLI-25 | Reduced sealed comparison | csvgrep -c phrase_family -m self-induced Incoming/sealed_phrase_comparison_student.csv | Module 06 |
| 06 · CLI-26 | Reduced sealed comparison | csvgrep -c phrase_family -m open-book Incoming/sealed_phrase_comparison_student.csv | Module 06 |
| 06 · CLI-27 | Reduced sealed comparison | csvsort -c similarity_score -r Incoming/sealed_phrase_comparison_student.csv | Module 06 |
| 06 · CLI-28 | Reduced sealed comparison | cat Incoming/sealed_comparison_return_student.txt | Module 06 |
| 06 · CLI-29 | Reduced sealed comparison | cat Incoming/sealed_symbol_notes_student.txt | Module 06 |
| 06 · CLI-30 | Broker & attribution limits | csvgrep -c event_type -m pre_purge_service_access Incoming/provider_access_log.csv | Module 06 |
| 06 · CLI-31 | Broker & attribution limits | csvgrep -c event_type -m remote_receipt_marker Incoming/provider_access_log.csv | Module 06 |
| 06 · CLI-32 | Broker & attribution limits | jq -r '.audit_field_recorded.search_phrase' Incoming/municipal_identity_audit.json | Module 06 |
| 06 · CLI-33 | Broker & attribution limits | jq -r '.audit_field_recorded.target_identity' Incoming/municipal_identity_audit.json | Module 06 |
| 06 · CLI-34 | Broker & attribution limits | csvgrep -c search_phrase_recorded -m 'PRIMARY TARGET' Incoming/protected_person_status.csv | Module 06 |
| 06 · CLI-35 | Integrity & derivation | mkdir -p Evidence/Working Reports | Module 06 |
| 06 · CLI-36 | Integrity & derivation | cp Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Module 06 |
| 06 · CLI-37 | Integrity & derivation | sha256sum Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Module 06 |
| 06 · CLI-38 | Integrity & derivation | cmp -s Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Module 06 |
| 06 · CLI-39 | Integrity & derivation | echo $? | Module 06 |
| 06 · CLI-40 | Integrity & derivation | csvgrep -c stream -m hospital Evidence/Working/case_timeline_claims.csv | tee Reports/hospital_timeline_extract.csv | Module 06 |
| 06 · CLI-41 | Integrity & derivation | cat Reports/hospital_timeline_extract.csv | Module 06 |
| 06 · CLI-42 | Integrity & derivation | sha256sum Reports/hospital_timeline_extract.csv | Module 06 |
| 06 · CLI-43 | Examiner report & closure | csvgrep -c module -m 05 Incoming/released_source_register.csv | Module 06 |
| 06 · CLI-44 | Examiner report & closure | cat Incoming/witness_intake_original.txt | Module 06 |
| 06 · CLI-45 | Examiner report & closure | cat Incoming/recorder_transcript_original.txt | Module 06 |
| 06 · CLI-46 | Examiner report & closure | sqlite3 -readonly Incoming/sidecar_tamper_student.sqlite ".tables" | Module 06 |
| 06 · CLI-47 | Examiner report & closure | grep -F Subject: Incoming/preservation_email_original.eml | Module 06 |
| 06 · CLI-48 | Examiner report & closure | csvcut -n Incoming/sealed_negative_controls_student.csv | Module 06 |
| 06 · CLI-49 | Examiner report & closure | date -u -d 2211-09-18T03:25:24-06:00 +%Y-%m-%dT%H:%M:%SZ | Module 06 |
| 06 · CLI-50 | Examiner report & closure | sha256sum -c Incoming/capstone_sha256_checksums.txt | Module 06 |
| 06 · CLI-51 | Handling & loss | sqlite3 -readonly Incoming/sidecar_tamper_student.sqlite "SELECT event_id,event_class,state FROM tamper_events WHERE event_id='TE-0001';" | Module 06 |
| 06 · CLI-52 | Examiner report & closure | csvjoin -c source_ref Incoming/case_timeline_claims.csv Incoming/claim_source_link_index_student.csv | Module 06 |
| 06 · CLI-53 | Handling & loss | diff -u Incoming/witness_intake_original.txt Incoming/recorder_transcript_original.txt | Module 06 |
| 06 · CLI-54 | Examiner report & closure | csvgrep -c required_source -m approved_cradle Incoming/examiner_source_availability.csv | Module 06 |
| 06 · CLI-55 | Examiner report & closure | cat Incoming/sealed_method_and_negative_controls.txt | Module 06 |
| 06 · CLI-56 | Examiner report & closure | csvgrep -c required_source -m provider_preservation_submission Incoming/examiner_source_availability.csv | Module 06 |