Evidence Pack Index¶
Provenance-first catalog of every reproducible evidence pack in this guide. Each troubleshooting lab under labs/ ships an evidence/ directory containing the raw Azure captures — deployment JSON, CLI output, KQL results, gate verdicts, and curl probes — that back the lab's falsification claim. This page is the single entry point for auditing that evidence.
Use the Lab Finder when you know a symptom and want the matching reproduction lab. Use this page when you want to inspect the raw evidence a lab captured, verify its provenance, or reuse a capture as a baseline instead of redeploying.
What an evidence pack contains¶
Every evidence pack is captured in a single live-Azure window by the lab's own trigger.sh (failure cohort) and fix-and-capture.sh / verify.sh (recovery cohort), then PII-scrubbed before commit. A typical pack carries four artifact classes.
flowchart TD
A[Lab trigger.sh + fix-and-capture.sh] --> B[Raw captures]
B --> C[Deployment + CLI JSON]
B --> D[System + Console log excerpts]
B --> E[KQL result sets]
B --> F[Gate verdict JSON]
C --> G[PII scrub]
D --> G
E --> G
F --> G
G --> H[evidence/ directory + provenance README.md]
H --> I[Lab guide references pack as falsification evidence] | Artifact class | Typical files | Purpose |
|---|---|---|
| Deployment + CLI state | *-deployment-result.json, *-containerapp-show-*.json, *-revisions-list-*.json | Capture the failure cohort and the post-fix recovery cohort as raw resource state. |
| Log excerpts | *-system-logs-*.txt, *-console-logs-*.txt | Preserve the first-observed error signal from ContainerAppSystemLogs_CL / ContainerAppConsoleLogs_CL. |
| KQL result sets | *-kql-*.json, *-kql-*-raw.txt | Quantify the observation (row counts, latency, error rates) against Log Analytics. |
| Gate verdicts | *-gate.json (e.g. 14-h1-gate.json, 32-recovery-materialization-gate.json) | Machine-checkable pass/fail predicates that encode the falsification logic. |
Provenance README is authoritative
Each pack's evidence/README.md documents the exact capture timeline, Azure region, CLI versions, the JSONPath where each smoking-gun value lives, and every PII substitution applied. When the table below and a provenance README disagree, the README wins.
PII-scrubbing guarantee¶
Every committed evidence artifact is scrubbed before it enters the repository, per the AGENTS.md PII rules:
- Subscription, tenant, object, and workspace GUIDs are replaced with the zero-GUID placeholder
00000000-0000-0000-0000-000000000000. - Employee aliases are replaced with
demouser; employee emails withuser@example.com. - Synthetic example identifiers (demo correlation IDs, ACR Tasks build-volume IDs) are retained deliberately to aid readability and are called out as synthetic in each provenance README.
If you find a raw Azure identifier in any evidence artifact, treat it as a P0 leak and open an issue.
Evidence pack catalog¶
All 30 evidence-bearing labs, alphabetical. Files / JSON / Gates are current artifact counts. Provenance marks whether the pack carries a dedicated evidence/README.md. Captured is the live-Azure capture date (from the provenance README, or the gate verdict timestamp where no README exists yet).
| Lab | Evidence pack | Provenance | Files / JSON / Gates | Captured | Lab guide |
|---|---|---|---|---|---|
| aca-secret-kv-ref-mi-network-path | evidence/ | Yes | 1 / 0 / 0 | in progress | guide |
| acr-network-path-dns-forwarder-bypass | evidence/ | Yes | 17 / 16 / 4 | 2026-06-29 | guide |
| acr-network-path-firewall-allowlist | evidence/ | Yes | 17 / 15 / 4 | 2026-06-29 | guide |
| acr-network-path-pe-direct | evidence/ | Yes | 17 / 15 / 4 | 2026-06-26 | guide |
| acr-network-path-pe-forced-inspection | evidence/ | Yes | 17 / 15 / 4 | 2026-06-29 | guide |
| acr-network-path-record-split-brain | evidence/ | Yes | 17 / 15 / 4 | 2026-06-28 | guide |
| acr-pull-failure | evidence/ | Yes | 29 / 24 / 6 | 2026-06-22 | guide |
| appgw-to-internal-aca-nsg-mismatch | evidence/ | Yes | 12 / 8 / 0 | 2026-07-03 | guide |
| appinsights-connection-string-missing | evidence/ | Yes | 25 / 20 / 4 | 2026-06-22 | guide |
| cd-reconnect-rbac-conflict | evidence/ | No | 20 / 15 / 2 | 2026-06-23 | guide |
| cpu-throttling | evidence/ | Yes | 20 / 17 / 4 | 2026-06-22 | guide |
| dapr-integration | evidence/ | Yes | 17 / 15 / 4 | 2026-06-03 | guide |
| diagnostic-settings-missing | evidence/ | Yes | 25 / 18 / 4 | 2026-06-22 | guide |
| image-size-startup-delay | evidence/ | Yes | 16 / 13 / 4 | 2026-06-22 | guide |
| ingress-target-port-mismatch | evidence/ | Yes | 30 / 23 / 4 | 2026-06-22 | guide |
| keda-no-metrics-returned | evidence/ | Yes | 23 / 16 / 4 | 2026-06-20 | guide |
| managed-identity-key-vault-failure | evidence/ | Yes | 17 / 15 / 4 | 2026-06-26 | guide |
| memory-leak-oomkilled | evidence/ | Yes | 40 / 25 / 4 | 2026-06-20 | guide |
| memory-percentage-vs-keda-utilization | evidence/ | Yes | 26 / 24 / 4 | 2026-06-24 | guide |
| observability-tracing | evidence/ | Yes | 27 / 22 / 2 | 2026-06-24 | guide |
| probe-and-port-mismatch | evidence/ | Yes | 28 / 19 / 2 | 2026-06-23 | guide |
| replica-node-spread | evidence/ | Yes | 20 / 5 / 4 | 2026-06-14 | guide |
| revision-failover | evidence/ | No | 24 / 17 / 2 | 2026-06-22 | guide |
| revision-history-limit | evidence/ | Yes | 19 / 14 / 4 | 2026-06-22 | guide |
| revision-provisioning-failure | evidence/ | Yes | 17 / 15 / 4 | 2026-06-20 | guide |
| scale-rule-mismatch | evidence/ | No | 26 / 22 / 2 | 2026-06-22 | guide |
| startup-degraded-transient-failure | evidence/ | Yes | 96 / 41 / 4 | 2026-06-12 | guide |
| traffic-routing-canary | evidence/ | Yes | 28 / 21 / 2 | 2026-06-24 | guide |
| zone-redundancy-best-effort | evidence/ | Yes | 60 / 18 / 4 | 2026-06-12 | guide |
Special-case packs
metrics-load-testis intentionally omitted from the catalog above. It is the data source for the metrics reference rather than a trigger/fix/falsification lab, so it has no lab guide and emits no gate verdicts (47 files, 46 JSON, 0 gates).aca-secret-kv-ref-mi-network-pathis an in-progress reproducer (single provenance file, no cohort captured yet). Its evidence pack will be populated when the reproduction lands.cd-reconnect-rbac-conflict,revision-failover, andscale-rule-mismatchcarry full gate-verdict cohorts but do not yet ship a dedicatedevidence/README.md. Their capture dates above are read from the gate verdict timestamps; a provenance README is a tracked follow-up.
How to use an evidence pack¶
- Audit a falsification claim. Open the lab guide's Falsification / Experiment Log section, then open the matching
*-gate.jsonto see the exact predicate that was evaluated and its pass/fail verdict. - Reuse a capture as a baseline. When a smoking-gun signal is deterministic (for example
MANIFEST_UNKNOWNinacr-pull-failure), the provenance README documents the JSONPath so you can validate a new predicate against the captured schema instead of redeploying. - Verify PII hygiene. Every artifact is scrubbed; the provenance README lists every substitution. Use it to confirm no raw Azure identifier survives before citing an artifact externally.
See Also¶
- Lab Finder — Symptom-first routing to the matching reproduction lab
- Lab Guides catalog — Browse every lab by difficulty and duration
- Evidence Map — Signal-to-lab evidence mapping
- Methodology — Detector map and the evidence-integrity model behind every gate
- KQL Query Library — Production queries that generated the KQL result sets in these packs
- Contributing Guide — PII rules and evidence-capture standards