Compare firewall and workload policy intent with flow, DNS and bounded laboratory reachability evidence.
Add bounded artifact inspection, synthetic correction fixtures and portable playback.
