Generated directly from final module app-data • 42 guided CLI work orders • module version 1.0.0. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Confirm portal case workspace | pwd | Establish the current virtual workspace before relative-path queries. |
| CLI-02 Read the examiner’s allowed portal scope | cat Incoming/EXAMINER_PORTAL_ASSIGNMENT.txt | Read authority and restrictions before examining protected witness records. |
| CLI-03 List assigned portal sources | ls -lah Incoming | Inventory the case file set, including the named source derivative. |
| CLI-04 Find source files without making new evidence | find Incoming -type f | Inventory all assigned files using a path-scoped find. |
| CLI-05 Calculate SHA-256 for the portal JSON derivative | sha256sum Incoming/witness_support_portal_export_student_v1.json | Establish the digest of supplied reviewed JSON bytes. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-06 Identify umbrella case ID | jq -r '.case.case_id' Incoming/witness_support_portal_export_student_v1.json | Verify this portal record belongs to the assigned case. |
| CLI-07 Read original controlled consult location | jq -r '.appointment_record.original.location' Incoming/witness_support_portal_export_student_v1.json | Identify the location before the suspected reroute. |
| CLI-08 Read current reported destination | jq -r '.appointment_record.current.location' Incoming/witness_support_portal_export_student_v1.json | Identify the new destination recorded in the export. |
| CLI-09 Read the stated reschedule rationale | jq -r '.appointment_record.current.reason' Incoming/witness_support_portal_export_student_v1.json | Read the portal’s reason label without accepting it as truth. |
| CLI-10 Distinguish the displayed requester | jq -r '.appointment_record.current.requester' Incoming/witness_support_portal_export_student_v1.json | Identify the initiating service label. |
| CLI-11 Read the displayed approval name | jq -r '.appointment_record.current.approver_display' Incoming/witness_support_portal_export_student_v1.json | Read the approval label without attributing a person. |
| CLI-12 Read the approver account identifier | jq -r '.appointment_record.current.approver_account_id' Incoming/witness_support_portal_export_student_v1.json | Link the display label to the portal’s account ID. |
| CLI-13 Read directory status of the approver account | jq -r '.policy_and_account_snapshot.approver_account.directory_status' Incoming/witness_support_portal_export_student_v1.json | Inspect the claimed directory life-cycle state. |
| CLI-14 Read configured policy fallback result | jq -r '.policy_and_account_snapshot.policy_result' Incoming/witness_support_portal_export_student_v1.json | Identify the platform acceptance path. |
| CLI-15 Read the approval MFA snapshot | jq -r '.policy_and_account_snapshot.mfa_state_at_approval' Incoming/witness_support_portal_export_student_v1.json | Inspect whether a fresh personal factor is recorded. |
| CLI-16 Read current witness confirmation state | jq -r '.appointment_record.current.confirmation_status' Incoming/witness_support_portal_export_student_v1.json | Check whether the witness confirmed the notice. |
| CLI-17 Read structured appointment start | jq -r '.appointment_record.scheduled_start' Incoming/witness_support_portal_export_student_v1.json | Find the actual scheduled calendar date/time in structured evidence. |
| CLI-18 Read required observer fields | jq -r '.appointment_record.original.required_observers[]' Incoming/witness_support_portal_export_student_v1.json | Observe the original required observers. |
| CLI-19 Read recorded approval time | jq -r '.change_event.approval_recorded_at' Incoming/witness_support_portal_export_student_v1.json | Record the approval event’s source-time value. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-20 List all audit CSV columns | csvcut -n Incoming/appointment_change_audit.csv | Inspect CSV structure before filtering. |
| CLI-21 Select a bounded audit view | csvcut -c seq,event_time,action,actor_display Incoming/appointment_change_audit.csv | Read chronological audit actions without manual comma splitting. |
| CLI-22 Inspect staged field updates | csvgrep -c action -m field_update Incoming/appointment_change_audit.csv | Identify location, reason, route class and observer changes. |
| CLI-23 Find the approval request | csvgrep -c action -m approval_requested Incoming/appointment_change_audit.csv | Locate the event in which an approver display was requested. |
| CLI-24 Find the account-level approval record | csvgrep -c action -m approval_recorded Incoming/appointment_change_audit.csv | Locate the logged account-level acceptance. |
| CLI-25 Find the committed record revision | csvgrep -c action -m record_committed Incoming/appointment_change_audit.csv | Locate the appointment record version change after approval. |
| CLI-26 Locate transport notification sent | csvgrep -c action -m notification_sent Incoming/appointment_change_audit.csv | Find the logged notification-send event. |
| CLI-27 Locate the witness portal view | csvgrep -c action -m portal_view Incoming/appointment_change_audit.csv | Find the recorded display in a witness session. |
| CLI-28 Locate the pending confirmation check | csvgrep -c action -m confirmation_state_check Incoming/appointment_change_audit.csv | Find the latest confirmation-state event in the audit. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-29 Read pending confirmation from screen-text source | grep -n -F 'Confirmation status: PENDING' Incoming/portal_screenshot_text_dump.txt | Corroborate displayed PENDING status with another artifact type. |
| CLI-30 Read previous location on screen text | grep -n -F 'Previous location:' Incoming/portal_screenshot_text_dump.txt | Compare the displayed old location with structured JSON. |
| CLI-31 Inspect transport email header block | head -n 16 Incoming/transport_update_email.eml | Inspect the top of the synthetic .eml source including Received and Date. |
| CLI-32 Read displayed approver email header | grep -n -F 'X-WSP-Approver-Display:' Incoming/transport_update_email.eml | Compare the email’s displayed approval label with portal and audit. |
| CLI-33 Read transport Message-ID | grep -n -F 'Message-ID:' Incoming/transport_update_email.eml | Identify the email’s source Message-ID for comparison to audit notes. |
| CLI-34 Identify relative-day wording in email | grep -n -F 'Tomorrow' Incoming/transport_update_email.eml | Find ambiguous relative date wording rather than silently repairing it. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-35 Calculate the weekday of the received date | date -d '2211-09-18' '+%A' | Independently calculate the calendar weekday for the synthetic incident date. |
| CLI-36 Convert approval event source clock to UTC | date -u -d '2211-09-18T02:11:43-06:00' '+%Y-%m-%dT%H:%M:%SZ' | Preserve the offset while normalizing the audit approval time to UTC. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-37 Prepare authorized working and report directories | mkdir -p Evidence/Working Reports | Create writable derivative directories without touching Incoming. |
| CLI-38 Copy audit CSV into the working area | cp Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Copy source bytes before preserving a selected result. |
| CLI-39 Hash original and working copies independently | sha256sum Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Compute current SHA-256 digests for source and copy. |
| CLI-40 Directly compare source and working CSV | cmp -s Incoming/appointment_change_audit.csv Evidence/Working/appointment_change_audit.csv | Use a quiet byte comparison independent of hash output. |
| CLI-41 Read immediate comparison exit status | echo $? | Associate the printed exit code with the immediately prior comparison. |
| CLI-42 Preserve a narrow approval row as derived CSV | csvgrep -c action -m approval_recorded Evidence/Working/appointment_change_audit.csv | csvcut -c event_time,actor_display,account_state,policy_result | tee Reports/approval_row.csv | Preserve one source-labeled selected row for later report review. |