Generated directly from final module app-data • 56 guided CLI work orders • module version 1.8.1. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Confirm capstone case directory | pwd | Establish the current virtual case and record it in methods. |
| CLI-02 Read the independent examiner assignment | cat Incoming/EXAMINER_CAPSTONE_ASSIGNMENT.txt | Confirm authority and examiner—not Nico—role. |
| CLI-03 Inventory released capstone fixtures | ls -l Incoming | List 06 source files without treating all as originals. |
| CLI-04 Inspect the released 01–05 source crosswalk | csvcut -n Incoming/released_source_register.csv | Identify columns for source provenance, digest, module ID and limitation. |
| CLI-05 Locate Module 04 evidence rows | csvgrep -c module -m 04 Incoming/released_source_register.csv | Find previously released hospital evidence IDs and expected digests. |
| CLI-06 Verify case register bytes | sha256sum Incoming/released_source_register.csv | Compute actual SHA-256 of this derivative crosswalk; not provenance of original 113 files. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-07 Inventory event-claim timeline fields | csvcut -n Incoming/case_timeline_claims.csv | Review event time, stream, row key and source reference as separate fields. |
| CLI-08 Order the supplied clock claims | csvsort -c reported_local_time Incoming/case_timeline_claims.csv | Sort the claims by their recorded local timestamps. This is not independent clock validation. |
| CLI-09 Isolate portal events | csvgrep -c stream -m portal Incoming/case_timeline_claims.csv | Find approval, sent notification, portal view and pending-confirmation claims. |
| CLI-10 Isolate apartment and responder events | csvgrep -c stream -m apartment Incoming/case_timeline_claims.csv | Compare apartment responder entry and later technical arrival. |
| CLI-11 Isolate hospital purge events | csvgrep -c stream -m hospital Incoming/case_timeline_claims.csv | Correlate reported handshake, purge and clear-state timing. |
| CLI-12 Isolate provider-side event claims | csvgrep -c stream -m provider Incoming/case_timeline_claims.csv | Separate pre-purge service access from later exported records. |
| CLI-13 Read discrepancy-matrix fields | csvcut -n Incoming/unresolved_source_conflicts.csv | Read source pairs, issue type and unresolved status. No conflicting source is silently corrected. |
| CLI-14 Cross-check Kato custody discrepancy | csvgrep -c type -m custody Incoming/unresolved_source_conflicts.csv | Distinguish custody 02:38 from scene entry 03:06 and disclose missing reconciliation. |
| CLI-15 Cross-check medical-arrival contradiction | csvgrep -c type -m hospital Incoming/unresolved_source_conflicts.csv | Retain 02:31 hospital versus 02:34 apartment EMS contradiction. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-16 Read signed handling-error statement | cat Incoming/nico_incident_statement_signed.txt | Document Nico’s admitted unauthorized NIF-BRIDGE use and prior warning. |
| CLI-17 Find acknowledgment of proceeding despite warning | grep -F 'I proceeded anyway.' Incoming/nico_incident_statement_signed.txt | An admitted choice corroborates handling error but does not itself authenticate sidecar telemetry. |
| CLI-18 Read evidence restriction record | cat Incoming/restriction_order.txt | Record the ongoing prohibition on Nico acquiring/viewing raw evidence. |
| CLI-19 Read review board source summary | cat Incoming/review_board_findings.txt | A review-board assertion is not an independent substitute for the device or scene chain. |
| CLI-20 Inventory loss-versus-survivor fields | csvcut -n Incoming/lost_vs_remaining_student.csv | Distinguish disappeared content classes from retained metadata classes. |
| CLI-21 Identify evidence-loss rows | csvgrep -c category -m lost Incoming/lost_vs_remaining_student.csv | List reported lost fragments/index; do not infer their contents. |
| CLI-22 Identify surviving evidence rows | csvgrep -c category -m survived Incoming/lost_vs_remaining_student.csv | Identify remaining records and their need for separate integrity checks. |
| CLI-23 Read final book-alignment note | cat Incoming/final_controlled_assessment_narrative_note.txt | Narrative says controlled assessment recovered no readable cache; this is not independent tool output. |
| CLI-51 Read a specific hospital workstation-side tamper event from SQLite | sqlite3 -readonly Incoming/sidecar_tamper_student.sqlite "SELECT event_id,event_class,state FROM tamper_events WHERE event_id='TE-0001';" | Read-only SQL projection of one actual SQLite row; cannot recover cache. |
| CLI-53 Inspect controlled baseline differences | diff -u Incoming/witness_intake_original.txt Incoming/recorder_transcript_original.txt | Difference between two texts does not establish contradiction or speaker identity; compare declared provenance. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-24 Inventory reduced sealed comparison columns | csvcut -n Incoming/sealed_phrase_comparison_student.csv | Identify source context, score and phrase-family fields; scoring provenance is not provided. |
| CLI-25 Examine self-induced phrase overlap | csvgrep -c phrase_family -m self-induced Incoming/sealed_phrase_comparison_student.csv | Compare self-induced instability phrasing without accusing a named organization. |
| CLI-26 Examine open-book family overlap | csvgrep -c phrase_family -m open-book Incoming/sealed_phrase_comparison_student.csv | Treat the open-book match as a reduced text label, not an authenticated image. |
| CLI-27 Sort authored similarity scores | csvsort -c similarity_score -r Incoming/sealed_phrase_comparison_student.csv | Numeric-looking similarity scores are authored attributes; no validated probability or attribution follows. |
| CLI-28 Read reduced comparison return | cat Incoming/sealed_comparison_return_student.txt | Review what the reduced, protected-source comparison actually claimed and did not release. |
| CLI-29 Read reduced icon/header notes | cat Incoming/sealed_symbol_notes_student.txt | Inspect note provenance; original icon artwork is absent. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-30 Locate provider pre-purge access record | csvgrep -c event_type -m pre_purge_service_access Incoming/provider_access_log.csv | Distinguish pre-purge service access from hospital tamper and identity of the actor. |
| CLI-31 Locate retained remote receipt row | csvgrep -c event_type -m remote_receipt_marker Incoming/provider_access_log.csv | This is an external record marker, not the cleared sensory buffer. |
| CLI-32 Read final protected-person query phrase | jq -r '.audit_field_recorded.search_phrase' Incoming/municipal_identity_audit.json | Identify the source field PRIMARY TARGET — STILL ALIVE as an unresolved query term. |
| CLI-33 Read target identity withholding field | jq -r '.audit_field_recorded.target_identity' Incoming/municipal_identity_audit.json | Document NOT DISCLOSED / NOT ESTABLISHED. The final lead does not identify Nico, Liora or Park. |
| CLI-34 Locate source-reported audit query rows | csvgrep -c search_phrase_recorded -m 'PRIMARY TARGET' Incoming/protected_person_status.csv | Correlate a source field without claiming target identity, intent, requester or seller. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-35 Prepare authorized working and report folders | mkdir -p Evidence/Working Reports | Prepare file-copy destination without altering Incoming. |
| CLI-36 Create exact working copy of timeline | cp Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Copy actual bytes; native success has no standard output. |
| CLI-37 Compute source and copy digests | sha256sum Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Matching SHA-256 demonstrates equality to a supplied version, not forensic event truth. |
| CLI-38 Compare the two current files silently | cmp -s Incoming/case_timeline_claims.csv Evidence/Working/case_timeline_claims.csv | Read the status of this exact comparison immediately; silence is normal. |
| CLI-39 Interpret immediate comparison status | echo $? | Report an observed zero status only after this comparison, not a later command. |
| CLI-40 Create hospital stream extract | csvgrep -c stream -m hospital Evidence/Working/case_timeline_claims.csv | tee Reports/hospital_timeline_extract.csv | Create a source-labeled derivative with actual current bytes; do not call it an original hospital log. |
| CLI-41 Reopen saved hospital stream | cat Reports/hospital_timeline_extract.csv | Confirm the saved report fragment contains selected current source rows. |
| CLI-42 Hash derived hospital stream | sha256sum Reports/hospital_timeline_extract.csv | Preserve digest of the newly produced timeline extract for analyst handoff. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-43 Corrected prior-module source register | csvgrep -c module -m 05 Incoming/released_source_register.csv | The corrected register contains all 14 Module 05 source records; count does not prove independent receipt identity. |
| CLI-44 Inspect human witness intake without audio | cat Incoming/witness_intake_original.txt | A witness intake statement is separate from device telemetry. This is a byte-identical cross-module mirror, not independent sensor evidence. |
| CLI-45 Inspect received analog recorder transcript | cat Incoming/recorder_transcript_original.txt | A text transcript cannot authenticate the missing original audio or identify a speaker. |
| CLI-46 Read surviving tamper DB tables | sqlite3 -readonly Incoming/sidecar_tamper_student.sqlite ".tables" | SQLite database tables are real training bytes, not recovered sensory cache. |
| CLI-47 Audit preservation EML provenance | grep -F Subject: Incoming/preservation_email_original.eml | Header/body reflect assertions; absent send-side legal submission requires explicit gap entry. |
| CLI-48 Examine authored negative controls | csvcut -n Incoming/sealed_negative_controls_student.csv | Control phrases are authored unrelated examples; none is original sealed evidence or a calculated score. |
| CLI-49 Convert hospital source time to UTC | date -u -d 2211-09-18T03:25:24-06:00 +%Y-%m-%dT%H:%M:%SZ | UTC conversion is mathematical; it does not cure a bad original clock. |
| CLI-50 Verify supplied source bytes via manifest | sha256sum -c Incoming/capstone_sha256_checksums.txt | Verify all eight selected source rows against actual fixture bytes. Hash success does not authenticate fictional acquisition. |
| CLI-52 Join event claims to source-hash register | csvjoin -c source_ref Incoming/case_timeline_claims.csv Incoming/claim_source_link_index_student.csv | Inner join actual CSV keys, preserving repeated claim rows and clearly marking derived source-index metadata. |
| CLI-54 Identify missing final cradle transfer | csvgrep -c required_source -m approved_cradle Incoming/examiner_source_availability.csv | The book has a relative arrival claim; released logistics omit an independently verified transfer event. |
| CLI-55 Review sealed-method caveats | cat Incoming/sealed_method_and_negative_controls.txt | Methods note explains why original authored score is not calibrated. |
| CLI-56 Compare available provider artifacts | csvgrep -c required_source -m provider_preservation_submission Incoming/examiner_source_availability.csv | No authenticated request transmission/submission record was received; preserve the absence. |