Runtime field notes

Surface: Find the trust boundary and capability.
Test: Predict and run a bounded proof.
Measure: Put an owned control in code.
Prove: Repeat the test and preserve evidence.

Recall the path, the signal and the stopping control.

These pages are the same content as the interactive course, on one page per module, for reading and printing.

Keep the evidence connected

Piece	What it is
Attacker notebook	Record objective, trust, path, pivot, signal and evidence.
Attack surface register	Keep control status and retest evidence in the shared map.

Commands in these notes use these values (shared with the interactive course, stored only in this browser).

GitHub user

Module	Part	Time	You are	You will
00 Re-enter the lab	Re-entry	10 min	Platform team	Check the shared repository, kind cluster and course A evidence before changing runtime policy.
01 A pod in a box	Runtime and cloud	40 min	Platform team	Inspect the checkout security context and NetworkPolicy, test service-account access and egress, then prove the namespace boundary.
02 Cloud metadata and OIDC	Runtime and cloud	55 min	Platform team	Use the local metadata mock and fake role credentials, close the path with an application host allowlist, IMDSv2 and network policy, then narrow OIDC trust to a production environment.
03 Incident response	When it happens	50 min	Platform team	Work three seeded incident cases: moved action reference, unknown workflow and denied image. Disable the affected path, rotate the fake credential, capture evidence and update the register.
04 Capstone: team-catalog	When it happens	60 min	Platform team	Identify fourteen seeded gaps across seven surfaces, rank the cheapest path, test a harmless canary, close two independent boundaries and update both evidence files.