Operate and reproduce safely

The safest first operation is to inspect the contract without contacting a cloud account. This handbook describes commit cbbc807c0c150e106affa89fbb1b9e8349005749, the preserved GCP baseline. Current repository main contains an Azure implementation. Running commands from the wrong revision can answer a different question and create different resources.

These procedures are source-backed guidance. They were not executed against a cloud environment while creating this website. Historical captures show particular earlier operations; they do not establish that an environment is available today.

Choose a useful stopping point

For a review, read the workflows and render the Helm chart locally. For a hands-on reproduction, continue through prerequisites, bootstrap order, identity and GitOps wiring, and first release. Each stage has a checkpoint: a valid source model, a reviewed environment plan, a consistent trust contract, and finally fresh observed results. Keep those claims separate.

Inspect the pinned source

Run these read-only commands in a repository that contains the historical object. They do not switch your current branch or change tracked files.

git status --short
git rev-parse 'final-gcp-commit^{commit}'
git show cbbc807c0c150e106affa89fbb1b9e8349005749:.github/workflows/deploy.yml
git show cbbc807c0c150e106affa89fbb1b9e8349005749:policy/kyverno/block-unsigned-images.yaml
git show cbbc807c0c150e106affa89fbb1b9e8349005749:argocd/supply-chain-demo-app.yaml

The tag resolution should equal the commit printed above. If it differs, stop and record the discrepancy; do not silently combine a policy from one revision with a workflow from another. For broader inspection, create a detached worktree at that exact commit in a new directory. Use it only for local analysis until an owned reproduction environment has been deliberately prepared.

git worktree add --detach ../gcp-baseline-inspection cbbc807c0c150e106affa89fbb1b9e8349005749

In that worktree, chart rendering is local and does not invoke admission:

helm lint k8s/helm/supply-chain-demo
helm template supply-chain-demo k8s/helm/supply-chain-demo
bash policy/tests/check-identity-consistency.sh

The Python provenance-condition test also needs jmespath and pyyaml in an isolated local Python environment. Terraform formatting is local; terraform init -backend=false still downloads providers and writes local installation files. Perform initialization in a disposable inspection directory and never publish its provider cache.

Understand what a local pass means

Rendering proves what the chart asks Kubernetes to create. The identity consistency script checks workflow-name references. The Python test evaluates the shipped JMESPath expressions against a captured predicate. None proves registry access, certificate verification, webhook availability, runtime detection, remote branch protection, or a healthy cluster.

The next operational decision is therefore whether you need a live environment at all. If you do, prepare its authority and cost boundaries first. If you only need to understand an incident, start with troubleshooting by boundary and retain evidence before changing anything.

Source anchors

• GCP baseline tree.
• Identity regression guard and predicate-condition test.