Skip to main content

Provenance, Policy, Telemetry, Cost, and Carbon

Competency Contract​

  • Primary competency: SEC-SECURE-001
  • Mastery: explain, apply, develop, and evaluate as required by the semester assessment
  • Status: required evidence extension; it does not add a semester or increase the advertised duration

Required Work​

Generate an SBOM; sign and verify an artifact; preserve build provenance; enforce policy as code and workload identity; use OpenTelemetry conventions; measure cost and carbon per functional unit.

Evidence Contract​

  • SBOM
  • signature
  • provenance attestation
  • denied-policy test
  • identity trace
  • telemetry contract
  • cost/carbon report.

Assessment Integration​

  • Project: produce the evidence in the semester repository rather than as detached prose.
  • Checkpoint: show the evidence exists and identify its highest-risk gap.
  • Cumulative review: connect the work to current, previous, and two-semesters-back knowledge.
  • Exam: evaluate a new case and reject an attractive but unsafe or unsupported alternative.
  • Rubric: every required evidence category must pass; strengths cannot average away a missing category.
  • Answer key: calibrate the shape of evidence without prescribing one implementation.

Oral Defense​

Prove the running artifact came from reviewed source and explain one supply-chain or telemetry blind spot.

AI-Use Declaration​

Record tools and models used, material output accepted, rejected suggestions, and independent verification. Undeclared generated evidence fails the integrity gate.

Reading Route​

Start with the linked semester concepts and labs. Use local books selectively for conceptual depth and current official standards for normative requirements. Stop reading when you can produce and defend the required evidence.