# Console Forensics (stub)

> Status: BLOCKED awaiting timeline/evidence viewer assets and payloads from Console Guild. Follow this outline when assets arrive.

## Scope
- Timeline explorer, evidence viewer, attestation verifier flows.
- Imposed rule banner and offline-friendly walkthroughs.
- Troubleshooting section with deterministic repro steps.

## Pending inputs
- Deterministic captures (command-rendered or approved screenshots) for timeline and evidence viewer states.
- Sample NDJSON/JSON payloads for evidence/attestation, with hashes.
- Error taxonomy and retry/backoff guidance for user-facing errors.

## Determinism checklist
- Hash all captures/payloads in co-located `SHA256SUMS` when provided.
- Use UTC timestamps and stable ordering in tables and examples.

## Outline
1. Overview + banner
2. Timeline explorer walkthrough (filters, drilldowns)
3. Evidence viewer (attestations, signatures, DSSE bundle) examples
4. Attestation verifier steps and expected outputs
5. Troubleshooting + error taxonomy
6. Offline/air-gap operation steps
7. Verification (hash check + replay commands)