16 — FEDERAL CLOUD · 2025–2026
Deployment Evidence Console
A PowerShell and WinForms console that runs a regulated cloud upgrade step by step, enforces its gates, and exports an assessor-ready evidence package.
- Built
- A console that runs a regulated upgrade step by step and exports the audit evidence.
- Stack
- Windows PowerShell 5.1, WinForms, one JSON manifest, no external modules.
- State
- In use; v2.
IN USE · UPDATED 1 OCT 2026
v2, rebuilt in June 2026 from my own usability review of v1.
Carter Barnes · cloud engineer, federal Azure · Contact
Built at work for a federal client. I describe how it works and why; no client, system names, data or results.
What it is
A deployment runbook you execute inside the tool instead of beside it. The operator opens a run and works the steps; the console collects the proof as they go (screenshots, attachments, command output, timestamps) and exports the whole thing as an audit package.
It runs on Windows PowerShell 5.1 with WinForms and no external modules, because it has to work in a locked-down environment where you cannot install anything.
How it works
- Operator console
- Home page, a new-run wizard and guided execution.
- Admin console
- Edits and publishes the configuration that drives runs. One JSON manifest is the whole runbook.
- Manifest store
- Load, validate, publish, back up and roll back, with dependency-cycle detection.
- Step engine
- Dependency enforcement, outcomes and finalize gates.
- Evidence
- Non-blocking screenshot capture, attachments and an evidence index.
- Run state
- Run lifecycle, an audit log and crash recovery; one self-contained folder per run.
- Exports
- Markdown, CSV, Word and Excel, all generated from state. Word and Excel come from Office when it is present, with a silent Markdown and CSV fallback when it is not.
By the numbers
- 0 modules
- to install: PowerShell 5.1 and WinForms only
- 6 gates
- enforced, two of them with no override
- 1 manifest
- JSON file that is the whole runbook
Decisions
- 01
The runbook and the evidence are the same job
Regulated deployments already produce a document nobody enjoys writing, assembled after the fact. If the tool that executes the steps also captures them, the compliance artifact is a byproduct instead of a second project.
- 02
The steps that protect you are enforced, not advisory
Gates are enforced, not advisory. Six of them encode the run's non-negotiables: the safety-critical ones cannot be overridden at all, and the rest take an override only with a logged reason, an approver and a timestamp. The backup step is required, because at 2 a.m. an optional step gets skipped.
- 03
Evidence capture never blocks the operator
A modal 'take a screenshot now' prompt gets clicked through on muscle memory. Capture is non-blocking and indexed automatically.
What I learned
- 01
The real product is that no one person has to run the release
The measurable outcome was not speed. It was removing the requirement that a specific person be present.
- 02
v2 started from a usability review of v1
I wrote an honest assessment of my own first version, and v2 is a redesign driven by it, not a feature release.
- 03
Recovery is built in
A console that loses a half-finished run in a change window is worse than a paper checklist. Recovery is built in because the first version lacked it.
