grceng.academy
YAML lab 40 bonus XP

Specify the release integrity gate

Start labRead the room

Objectives

Halcyon Clinics is formalising its release gate. The release manager says a valid signature is enough and asks you to allow public fallback for internal packages to improve availability. Translate the approved requirements below instead of implementing that request.

Complete every empty scalar. The gate must freeze resolutions, restrict internal package origins, produce the contracted inventory, verify identity and provenance, and apply the local severity deadlines. The applicability note must describe evidence, not a blanket waiver.

Approved release requirements

resolution: frozen lockfile required; internal namespace must never fall back to public sources
inventory: contract requires SPDX, bound to artefact digest
verification: require signature and provenance; approved builder identity is release-builder
SLA hours from confirmed detection: critical 24; high 168; medium 720; low 2160
applicability: VEX not-affected justification must cite absent vulnerable code or unreachable vulnerable code

Checks the server runs (6)

  • Frozen dependency resolution without public fallback
  • Contracted SBOM bound to artefact digest
  • Signature and provenance from approved builder
  • Critical and high deadlines in hours
  • Medium and low deadlines in hours
  • Evidence-based applicability justification

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Constrain resolution

    For each resolution switch, ask whether enabling it preserves the authorised input graph or expands the trust boundary.

    Frozen dependency resolution without public fallback

  2. Step 2

    Attach the inventory

    Read the contract's format constraint and decide whether the inventory must identify exact output bytes or merely a release name.

    Contracted SBOM bound to artefact digest

  3. Step 3

    Authenticate the build

    Check both required evidence gates and copy the authorised identity from the policy source, not from an untrusted package.

    Signature and provenance from approved builder

  4. Step 4

    Calculate urgent deadlines

    Read the two most urgent severity rows and ensure the numeric values use the starter's time unit.

    Critical and high deadlines in hours

  5. Step 5

    Calculate routine deadlines

    Convert the remaining severity deadlines into the same unit without replacing them with an average.

    Medium and low deadlines in hours

  6. Step 6

    Ground applicability

    Describe the technical condition the fixture permits as justification. A signature or network perimeter alone does not establish that condition.

    Evidence-based applicability justification

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.