Artifact promotion and release decisions
This required 20–30-hour integrated package strengthens the existing guided labs. Allocation: lessons/predictions 5–7 hours, pipeline experiments 9–15, assessment/repair 6–8. Author estimates require learner timing pilots and are included in the semester workload contract. Reuse the same service and evidence; avoid creating a second portfolio.
Prerequisite bridge
Bring the preceding module's implementation, risk record and failure observations. Separate assumptions, model results and actual runtime evidence. Review the specific prerequisite named in each lesson before its exercise. Missing runtime tools leave execution evidence pending; a written prediction is not an executed experiment.
Lesson sequence
- Verify identity before promoting an artifact.
- Make canary decisions with sufficient exposure.
- Separate software rollback from data recovery.
Integrated experiment
Extend the existing build-once pipeline with a release evidence record: reviewed revision, artifact digest, SBOM/provenance/signature identities, selected verification policy, deployment target, canary counts, decision and recovery observations. Inject identity mismatch, candidate failure and data incompatibility separately. Reuse the original five-metric DORA baseline; keep service-level definitions and distinguish deployment rework from ordinary planned delivery. Do not count a newly rebuilt artifact as promotion of the tested one.
Complete the assessment. Original guided labs, security controls, deployment/testing and peer requirements remain mandatory. Use synthetic data and a disposable local environment where supported; no cloud purchase is required by this extension.
Selective resources
SLSA v1.2 verification; Google SRE canarying; DORA metric definitions.