Linux Hardening Toolkit LH-1.2.1 — evidence-only assessment workflow

This revision makes the execution workflow explicit throughout the guide, PDF, README and assessment prompt:

1. An authorized operator runs bash collect-report.sh ./assess.sh on the approved Linux server.
2. The operator retains the original, redacts a copy and transfers it through an approved channel.
3. On a different machine, supply the full prompt, redacted report, completed policy and target context to the approved AI tool.
4. Review the 28-control report before approving any remediation.

The prompt must not download or execute collectors, connect to the server, request SSH/sudo access or inspect the analysis workstation. Missing evidence is requested from the operator; it does not trigger live collection. The guide and README include an explicit instruction to paste alongside the full prompt.

Download the complete ZIP or the PDF/prompt assets. Release SHA256SUMS checks these downloads; the ZIP includes its own file manifest. The revised PDF has 28 visually reviewed pages. Local artifact, fixture and checksum checks passed. A prompt is not an execution permission boundary: the analysis environment should have no server credentials or production execution access.

Collector, inventory, report-validation and VM fixture code are unchanged. The fixed control catalogue remains LH-1.2. This documentation/prompt release does not claim a new VM test or production assessment. The earlier LH-1.2 release remains available. The website post has a separate local preview/release process.