A run passes only under a negative control.

Record the mechanism before the change. Make the change through Invoke-SpnExecutionEngine, not by hand. Record the mechanism after. Ask an independent second oracle. Only NTLM to Kerberos with agreement is a Pass.

If the baseline was already Kerberos, an SPN may have pre-existed and the run proved nothing about the product. That is Inconclusive, not Pass. Most tools in this space report the after-state alone and cannot tell the two apart.

Fifteen provider scenarios are exercised per cloud. Not every scenario passes on every run and the matrix says which did not. The numbers above are best results to date, and the evidence pack for the run is what substantiates them.

Dates of the runs, and the pack downloads, are placeholders until publication: {{ tok.EVIDENCE_PACK_URL }}.

evidence-pack/├── provisioning.log         # forest, hosts, network, timing├── hosts/│   ├── dc01.transcript      # per-host PowerShell transcript│   ├── sql01.transcript│   └── client01.transcript├── oracle/│   ├── baseline.json        # mechanism before, per scenario│   ├── result.json          # mechanism after│   └── second-oracle.json   # independent reading├── results-matrix.json      # scenario × verdict├── teardown.log└── SIGNATURE                # detached signature over the pack

Provisioning log, per-host transcripts, oracle readings, a results matrix, and a teardown log, signed as a unit. The signing key and verification instructions belong on the trust center →.

File names above illustrate the structure; the pack format is described in its own README inside each pack.