Evidence from behind an endpoint

Before you start

The truth of the control "every workforce user has MFA enabled" no longer sits in a file you can ls — it sits behind a vendor's API. Your job: walk up to the counter, prove who you are, pull EVERY page of the answer, compute the metric, and keep evidence an auditor can re-run. This terminal is the lab's Linux box with one addition: curl is wired to the (fictional) vendor acme.example — its responses are the lab's committed fixture bytes and its documented error shapes, never invented. The vendor's API documentation is on the box as ~/lab06/vendor-docs.md. Two honest boundaries: bun and git are not installed here (exactly as the pinned lab container lacks them), so the module's aggregator runs as its PATH port `aggregate-mfa` — byte-locked to the real `bun aggregate-mfa.ts` output — and the §6 Git step happens on your real machine. The lab folder arrives exactly as `bash labs/setup.sh` writes it.