The gate that blocks the bad change

Before you start

Module 01 asked a live machine "is this disk encrypted?" and kept the answer. This lab asks the same claim-class question — is storage encrypted at rest, and never public — against the CODE that will create the storage, before anything exists. Your workspace is the CI pipeline's working directory, staged exactly as `bash labs/setup.sh ./lab08` leaves it: the proposed Terraform change, the scanner's structured result for it, the control map you own, and the gate. The "Run validator" button IS the pipeline's gate step — it runs `gate.sh lab08/scan-under-gate.json lab08/control-map.csv HIGH`, a port of the committed gate.sh verified byte-for-byte in CI against real bash runs of the same script, so the record and exit code you see here are the ones a real machine produces. `lab08/scan-under-gate.json` is the scan step's output for the change under review; this pipeline pins its severity floor at HIGH (one owned value in its config — the MEDIUM-floor exploration runs on your own machine with the lab's setup script).