Skip to main content

Provenance, Policy, Telemetry, Cost, and Carbon

Competency Contract​

  • Primary competency: SEC-SECURE-001
  • Mastery: explain, apply, develop, and evaluate as required by the semester assessment
  • Status: required evidence extension; explicitly included in the reconciled semester workload

Required Work​

Generate an SBOM; sign and verify an artifact; preserve build provenance; enforce policy as code and workload identity; use OpenTelemetry conventions; measure cost and carbon per functional unit.

Evidence Contract​

  • SBOM
  • signature
  • provenance attestation
  • denied-policy test
  • identity trace
  • telemetry contract
  • cost/carbon report.

Assessment Integration​

  • Project: produce the evidence in the semester repository rather than as detached prose.
  • Checkpoint: show the evidence exists and identify its highest-risk gap.
  • Cumulative review: connect the work to current, previous, and two-semesters-back knowledge.
  • Exam: evaluate a new case and reject an attractive but unsafe or unsupported alternative.
  • Rubric: every required evidence category must pass; strengths cannot average away a missing category.
  • Answer key: calibrate the shape of evidence without prescribing one implementation.

Oral Defense​

Prove the running artifact came from reviewed source and explain one supply-chain or telemetry blind spot.

AI-Use Declaration​

Record tools and models used, material output accepted, rejected suggestions, and independent verification. Undeclared generated evidence fails the integrity gate.

Reading Route​

Start with the linked semester concepts and labs. Use local books selectively for conceptual depth and current official standards for normative requirements. Stop reading when you can produce and defend the required evidence.

P1–P5 execution and assessment​

Budget 45–65 hours: P1 10–14, P2 9–13, P3 10–14, P4 8–12, P5 8–12. Every category must reach 2 (independent evidence with limits); 0 is absent, 1 prompted, 3 fresh transfer.

P1 — Supply-chain evidence (10–14 hours)​

Generate an SBOM for the selected artifact, sign and verify with actual tooling, and record provenance linking expected builder/source to its digest. Test valid, changed bytes, wrong identity and missing signature. Retain verifier version/policy and the running artifact digest. A hand-written signature field or checksum alone does not pass. Reuse RL1–RL2; additional work is independent reproduction and evidence coverage, not another build pipeline. Calibration: signed by an unexpected builder is not acceptable merely because the signature is mathematically valid.

P2 — Policy and workload identity (9–13 hours)​

Map deployment and runtime identities to allowed actions and trust conditions. Implement policy-as-code for a selected privilege or exposure boundary, then show allowed and denied cases in the actual enforcement path. Exercise a mismatched environment or workload identity. Preserve scoped credential issuance/revocation evidence without values. A policy file that never runs does not pass. Reuse original IAM/RBAC work and document what the local substitute cannot establish.

P3 — Telemetry contract (10–14 hours)​

Pin relevant OpenTelemetry conventions and instrumentation versions. Trace a synthetic API-to-worker operation; retain correlation, a useful failure classification, bounded attribute domains, sampling/retention rules and collector health. Inject a sensitive sentinel and collection failure. Show both useful diagnostic output and absence of the sentinel in every tested sink. A single redacted log line does not establish pipeline-wide coverage.

P4 — Cost per completed operation (8–12 hours)​

Define a functional unit and include idle, failed/retried, storage, transfer and retained-resource costs in the chosen boundary. Use current dated prices or clearly fictional local estimates. Compare two configurations under the same workload and quality target; report total and per-unit cost plus uncertainty. Example: 12 fictional currency units / 600 completed operations = 0.02 per operation. Dividing by 800 attempted operations instead changes the denominator and hides failed-user cost.

P5 — Carbon and tradeoffs (8–12 hours)​

Reuse Semester 08 SCI-style analysis with this deployment's boundary and functional unit. Separate measured energy from modeled estimates, carbon intensity and allocated embodied emissions; disclose missing data. Compare total and unit intensity under a workload change. Never infer emissions from price alone or drop availability/privacy constraints to lower a carbon estimate. Obtain one reviewer challenge and revise an assumption. SCI specification supplies the calculation framework; no claim of full standard conformance is implied.

After 48 hours, defend a changed artifact identity, missing telemetry and higher retry volume. Preserve all five categories independently. Actual tools and evidence remain required; author content checks are not learner execution.

Concrete assistance/release comparison​

Use the required comparison and calibration within the stated category allocation. It specifies existing evidence rather than replacing other strand requirements. Keep hypothetical fixtures separate from actual tool observations.