Can your evidence distinguish a blocked operation from an unexplained timeout, while keeping a healthy peer available?

This toolkit accompanies Operate Through Compromise, a six-article series planned for January 26-February 11, 2027. It is available independently so you can inspect the code and safety constraints before using it.

Download and start offline

Download toolkit 1.0.0 and its SHA-256 checksum.

Extract the ZIP, read README.md, and begin with the Node.js 22+ offline exercise. It needs no Azure account or dependencies. The archive includes the guide, tests, Bicep templates, PowerShell runner, token-free Python probe, incident runbook and tabletop pack.

The sample is explicitly illustrative. The validator rejects malformed or non-comparable evidence and preserves INCONCLUSIVE when a worker receives no service response. A structurally valid record is not an authenticated approval or an isolation certificate.

Inspect individual artifacts

These are downloadable Markdown documents; the same files are included in the ZIP:

• Lab and offline usage guide
• Incident runbook and empty worksheets
• Six-inject tabletop and observer pack
• Redacted Azure verification report

What was observed, and what was not

An authorized disposable Australia East lab and a corrected-workflow replay were exercised on October 27, 2026 (Sydney). Both workers initially returned HTTP 200. During the worker-scoped restriction, the worker received no response within approximately 15 seconds while its healthy peer returned HTTP 200. Both returned HTTP 200 after restoration. Both lab groups were deleted and their resource inventories confirmed empty.

The timeout is compatible with containment, not proof of its cause or universal isolation. The experiment did not establish token revocation, identity rebuilding, existing-session termination, automatic drift detection, production DNS/route recovery or workshop performance.

Before any cloud execution

Use only a disposable environment you own or are explicitly authorized to operate. Read every approval, permission, cost, rollback and cleanup requirement in the guide. The optional lab incurs Azure charges and requires current region/SKU, quota, policy and permission checks. An illustrative approval record is not permission to deploy.

The code was exercised against the versions and configuration in the report, not every subscription. Recheck current authoritative documentation before use. Do not copy production credentials or confidential incident evidence into the sample, commit them to Git, or publish them with the worksheets.