A tested validator under change control

Before you start

You own the laptop-encryption control. A directory of raw evidence records — one JSON file per laptop, plus the inevitable malformed one — needs a tool that judges each record, survives the bad file, and lives in a Git repository whose history is itself change-management evidence. The Git on this box is real: every commit, branch, and merge below is genuine repository state, and the checks verify that state — not the text on your screen. One honest boundary: this box does not execute Python. You will author the validator and its tests here as real, runnable code (the checks read what you wrote), and the module's §6 lab on your own machine is where pytest actually runs it. The pull-request review step has no command-line form anywhere; you will take the solo path §6 allows — self-review, noted — and the merge records the reviewed change.