grceng.academy
Review lab 40 bonus XP

Review pull requests against the controls repo

Start labRead the room

Objectives

Six pull requests are open against the controls repository. Your colleague wants them all merged before the release freeze this evening.

Accept the ones that preserve the provenance the repo exists to provide. Reject the ones that break the audit trail, bypass review, or bundle unrelated change into a control edit.

Verdicts are accept or reject. Every rejection needs one reason code from: no-independent-review | breaks-provenance | scope-creep.

Open pull requests

G-1  Adds control AC-07 with owner, frequency and assertion. One reviewer approved. Signed commit.
G-2  Edits the assertion on AC-02. Author approved their own PR to hit the freeze.
G-3  Fixes a typo in a control description. Unsigned commit from a personal address not in the org.
G-4  Updates the evidence query on AC-04 and, in the same PR, rewrites the CI workflow permissions.
G-5  Force-push that rewrites six months of history on main to "tidy up" the log.
G-6  Retires control AC-09 with a deprecation note, linked ticket and one independent approval.

Checks the server runs (3)

  • Every line in the fixture carries a verdict
  • Accept and reject land on the right lines
  • Each rejection cites a valid reason code

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the request before the artefact

    The repository is the control record. Its value is not the YAML: it is the ability to answer who changed what, when, and who agreed.

  2. Step 2

    Judge every line, including the boring ones

    Six PRs, six verdicts. Two are genuinely fine and should be merged; saying so is part of the review.

    Every line in the fixture carries a verdict

  3. Step 3

    Separate what is wrong from what is merely ugly

    Test each PR against three questions: is the author distinct from the approver, is the commit attributable to a known identity, and does the diff do exactly one thing?

    One PR does not fail review on its content at all: it fails because of what it does to the history around it.

    Accept and reject land on the right lines

  4. Step 4

    Say why, in the vocabulary the programme uses

    Separate a missing second pair of eyes from a change that makes attribution impossible, and both from a change that is simply carrying a passenger.

    Each rejection cites a valid reason code

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.