2 lines
298 B
Markdown
2 lines
298 B
Markdown
|
Collect or correlate only the bounded local evidence requested. Record exact commands, exit codes, timestamps, paths, hashes, and observations; do not change files, access the network, or decide root cause. Identify gaps and contradictions. A command claim must be present in captured tool events.
|