One command, a local kind cluster, about five minutes, and the enforcement guarantee is proved, not assumed, before it reports success. (Prefer to see every step on your own cluster? Install on your cluster.)

0 · Prerequisites
  • Docker, kind, and kubectl on your PATH (kind v0.31–v0.32 tested). No Go toolchain needed; the images build inside containers. Missing something? make quickstart names it and shows the install command.
  • Internet egress from the cluster – the sample agents fetch example.com.
  • ~5 minutes on a first run – the images are always built from your checkout, never pulled, so what runs is exactly what you cloned. Repeats are faster.
1 · Run it
git clone https://github.com/grantbarry29/scrutineer.git
cd scrutineer
make quickstart

Creates a scrutineer-quickstart kind cluster, installs Scrutineer, then runs a canary probe to prove the CNI actually enforces NetworkPolicy. It ends with the verdict:

>> routing-lock enforcement VERIFIED on this cluster (enforced sessions will run).
2 · If it says REFUSED

Your CNI doesn’t enforce NetworkPolicy, so Scrutineer refuses to claim enforcement rather than pretend. Retry on Calico:

make quickstart-down
make quickstart QUICKSTART_CNI=calico
3 · Try a sample session
kubectl apply -f config/samples/scrutineer_v1alpha1_agentsession.yaml
kubectl get agentsessions -w
kubectl get agentsession github-readme-update -o yaml   # the run's record, evidence included
4 · Tear down
make quickstart-down

Next: the demo – a live denial, a dead bypass attempt, and evidence the agent couldn’t forge, in one run.