Specify the control delivery pipeline

Objectives

The bucket-exposure control is written, reviewed and running in CI. It has been green for six weeks and it missed a public bucket, because the suite only ever feeds it compliant input and nothing keeps the runs.

Specify the delivery pipeline properly: a versioned definition with a stable id, tests that can fail, a gate that cannot be skipped in silence, and evidence emitted by the pipeline on both outcomes.

control          : public object storage must not be readable by anyone
catalog id       : CC-STORAGE-PUBLIC
repo             : controls/storage/public-read.rego (reviewed, versioned)
suite today      : 4 tests, all compliant inputs, all assert "run completed"
gate today       : advisory; SKIP_POLICY_CHECKS=true present since week 3
evidence today   : written on pass only: timestamp, repo, commit, "pass"
auditor question : "for CC-STORAGE-PUBLIC on 3 March, what ran, what did it
                    evaluate, and what did it decide?"

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Name the control once

   Take the catalog id from the fixture and declare it, then mark the definition as versioned: the repository already is, the specification simply has to say so.

   A stable control id is declaredThe definition is versioned

2. Step 2

   Write the test that can fail

   Four compliant inputs prove the evaluator executes. Add negative cases that supply a public bucket and expect a deny, and pin the fixtures so a drifting environment cannot silently change what was tested.

   The suite contains a failing case with pinned fixtures

3. Step 3

   Make the gate the control

   An advisory gate is a comment. Set it to block and fail closed so an error in the evaluator stops the release rather than waving it through.

   The gate blocks and fails closed

4. Step 4

   Keep the bypass, lose the silence

   Leave bypasses possible, but require them to be documented and to carry an expiry date, so a Friday-night skip cannot survive eleven weeks of releases.

   Bypasses are documented and expire

5. Step 5

   Emit evidence on both outcomes

   Write the artefact on fail as well as pass, and carry the fields the auditor asked for: control id, run id, the decision, the inputs evaluated and the population covered.

   Evidence is emitted on both outcomes with run metadata

Rules summary

• XP on pass

  50 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 13 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.