{
  "_comment": "Fictional dates for the lab, the one program-dates file Chapters 03 and 06 both read. In a real run the identity engineering lead copies them from the program master schedule: D08 (end dates for legacy authentication and NTLM) bounds an account kept on Kerberos (NP3.6); G5 (AD retired) bounds every account kept in Active Directory (NP7.3); D11 is the provisional target end state set at G0 (AdRetired, or KerberosIsland with an end-of-life date), which Chapter 06 reconciles every gMSA and dMSA against. Chapter 06 refuses a copy whose SHA-256 isn't the one Chapter 03's run recorded.",
  "d08LegacyAuthEndDate": "2027-06-30",
  "g5AdRetired": "2027-09-30",
  "d11": { "decision": "KerberosIsland", "status": "Provisional", "islandEndOfLife": "2028-06-30" }
}
