Repository navigation
A copy-and-paste workflow for collecting Linux security evidence over SSH, downloading it with SCP, preparing six reviewed input files for Claude or Codex, and validating the returned report structure.
The observational collector was tested on Ubuntu 24.04, Debian 13, Fedora 44 and Amazon Linux 2023 x86_64 EC2 images. It selects APT or DNF/DNF5 checks, preserves evidence gaps, distinguishes DNF exit 100 from errors, and queries private copies of RPM metadata to avoid rewriting the host's package cache. It does not install packages, refresh repositories, apply fixes, restart services or reboot.
The fixed LH-1.2 catalogue still contains 28 controls. Cross-distribution validation covers collection and transfer; it does not certify security controls or extend the modifying hardening runbook beyond its original Ubuntu scope. The retained PDF inside the toolkit is clearly labeled as historical LH-1.4 material; use quickstart.md and the Markdown guide for this workflow.
Validation: fixture suites, report/catalogue integrity and checksums passed. Final collection, private permissions and SCP integrity passed on all four disposable EC2 hosts. All test instances and temporary access resources were removed. See ec2-validation.md for the evidence scope and limitations.