Review six release claims

Objectives

A release coordinator has assembled six independent assurance claims. The coordinator argues that any green check is enough and that exceptions can be approved after deployment. Review each claim as written, not as you wish it had been implemented.

Accept claims supported by their stated evidence. Reject each unsupported claim using its single most specific reason code: category-mismatch, missing-evidence, stale-binding or invalid-exception.

Verdicts are accept or reject. Every rejection needs one reason code from: category-mismatch | missing-evidence | stale-binding | invalid-exception.

ASD-1 | A third-party component inventory proves custom authorization logic is correct; no authorization tests exist.
ASD-2 | Independent code review checked the permission constraint and denial path; reviewer and reviewed revision are retained. This supports the code-review control.
ASD-3 | A required source scan timed out with no results; the release claim is that the source gate passed.
ASD-4 | Authenticated external request tests covered both allowed downloads and cross-patient denials on the proposed artifact; report records roles, routes and digest. This supports the authorization test requirement.
ASD-5 | All gate evidence is for digest A; digest B was built afterward and proposed for deployment. No evidence-reuse policy exists; approval of A is claimed to cover B.
ASD-6 | A critical-finding exception has a remediation plan and compensating controls but no risk-owner approval or expiry; it is claimed to satisfy the time-limited exception policy.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Read the stated contract and identify exactly what each claim says its evidence establishes. Do not add imaginary test runs or approvals.

2. Step 2

   Judge every line, including the boring ones

   Give every fixture row one verdict. Keep identifiers intact and avoid duplicate rows.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Ask whether the observation supports that particular control, whether it completed, and whether it applies to the proposed build. A narrow supported claim need not prove total security.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   For each rejected claim, isolate the decisive defect: observation type, absent result, artifact identity or exception governance. Choose the corresponding reason from the supplied vocabulary.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.