Python used to glue two steps

request_id,account,action
Q7,lea,read
Q8,sam,write
Q9,ida,list

Download the request rows

request_id,result,note
Q9,allowed,list right
Q7,allowed,read right

Download the evidence rows

#!/usr/bin/env python3
"""Join request rows to evidence rows by request_id.

The printed rows are in predicted-join.txt.
The owned requests.csv and evidence.csv are the inputs for those rows.
A later run that disagrees with that card should correct the card.

Later use, only on the owned files in this folder:
  python3 join-evidence.py requests.csv evidence.csv

Standard library only. No network. No password field.
Duplicate ids are reported. The first row is kept. Later copies do not overwrite.
A request with no evidence row is unmatched. It is not printed as a denial.
""",

import csv
import sys


def load(path, required):
    with open(path, newline="", encoding="utf-8") as handle:
        reader = csv.DictReader(handle)
        if reader.fieldnames is None:
            raise SystemExit(f"{path}: missing header")
        missing = [name for name in required if name not in reader.fieldnames]
        if missing:
            raise SystemExit(path + ": missing columns " + ", ".join(missing))
        rows = []
        seen = {}
        duplicates = []
        for row in reader:
            key = row["request_id"]
            if key in seen:
                duplicates.append(key)
                continue
            seen[key] = row
            rows.append(row)
        return rows, seen, duplicates


def main(argv):
    if len(argv) != 3:
        raise SystemExit("usage: join-evidence.py requests.csv evidence.csv")
    requests, request_map, request_dups = load(
        argv[1], ["request_id", "account", "action"]
    )
    _evidence_rows, evidence_map, evidence_dups = load(
        argv[2], ["request_id", "result", "note"]
    )
    print("joined")
    print("request_id,account,action,result,note")
    unmatched = []
    for row in requests:
        key = row["request_id"]
        evidence = evidence_map.get(key)
        if evidence is None:
            unmatched.append(key)
            continue
        print(
            ",".join(
                [
                    key,
                    row["account"],
                    row["action"],
                    evidence["result"],
                    evidence["note"],
                ]
            )
        )
    print("unmatched_requests")
    for key in unmatched:
        print(key)
    print("evidence_without_request")
    for key in evidence_map:
        if key not in request_map:
            print(key)
    print("duplicate_request_ids")
    for key in request_dups:
        print("requests:" + key)
    for key in evidence_dups:
        print("evidence:" + key)


if __name__ == "__main__":
    main(sys.argv)

Download the unrun join script

Historical sample output: join-evidence.py with Python 3.12.3 against the supplied CSV files, recorded 2026-10-12.
 The rows below are that output.
If a later run differs, investigate input/source differences before changing the record.

joined
request_id,account,action,result,note
Q7,lea,read,allowed,read right
Q9,ida,list,allowed,list right
unmatched_requests
Q8
evidence_without_request
duplicate_request_ids

Download the observed join rows

Activity files, as printed
requests: Q7 lea read, then Q8 sam write, then Q9 ida list
evidence: Q9 allowed, then Q7 allowed
Predicted joined rows: Q7, then Q9
Predicted unmatched request: Q8
Predicted evidence without a request: none
Predicted duplicates: none
A position pairing would attach Q9's result to Q7.

Stage evidence note
Label: ungraded. Counted inside this lesson's activity estimate.
This note does not certify a penetration test, a directory design, or tool proficiency.

Passwords: budget 3 on the local label card, stop after the third candidate, no service named.
Framework: proposal M-1 was a version lead. This card does not depend on running it.
Privilege: lea has write on run.bat, and NightIndex is recorded as LocalSystem. The file was not changed.
Directory: assigned host vm-desk-3.lab.invalid. Excluded host vm-other-9.lab.invalid. No connection.
Reporting: joined rows are Q7 and Q9. Unmatched request Q8 has no evidence row, so it is not a denial and not a finding.

Rubric: one line from each module, the unmatched id, and a limit. Leave out passwords, tickets, and module commands.

Download the ungraded stage evidence note