One command, a local kind cluster, about five minutes — and the enforcement guarantee is proved, not assumed, before it reports success. (Prefer to see every step on your own cluster? Install on your cluster.)

0 · Prerequisites
  • Docker, kind, kubectl, and Go ≥ 1.21 on your PATH (kind v0.31–v0.32 tested). Any modern Go works — the build pins its own exact toolchain. Missing something? make quickstart names it and shows the install command.
  • Internet egress from the cluster — the sample agents fetch example.com.
  • ~5 minutes on a first run — the images are always built from your checkout, never pulled, so what runs is exactly what you cloned. Repeats are faster.
1 · Run it
git clone https://github.com/grantbarry29/scrutineer.git
cd scrutineer
make quickstart

Creates a scrutineer-quickstart kind cluster, installs Scrutineer, then runs a canary probe to prove the CNI actually enforces NetworkPolicy. It ends with the verdict:

>> routing-lock enforcement VERIFIED on this cluster (enforced sessions will run).
2 · If it says REFUSED

Your CNI doesn’t enforce NetworkPolicy, so Scrutineer refuses to claim enforcement rather than pretend. Retry on Calico:

make quickstart-down
make quickstart QUICKSTART_CNI=calico
3 · Try a sample session
kubectl apply -f config/samples/scrutineer_v1alpha1_agentsession.yaml
kubectl get agentsessions -w
kubectl get agentsession github-readme-update -o yaml   # the run's record, evidence included
4 · Tear down
make quickstart-down

Next: the demo — a live denial, a dead bypass attempt, and evidence the agent couldn’t forge, in one run.