Skip to main content

World-Class Graduation Evidence

Competency Contract​

  • Primary competency: SE-ENGINEERING-001
  • Mastery: explain, apply, develop, and evaluate as required by the semester assessment
  • Status: required evidence extension; explicitly included in the reconciled semester workload

Required Work​

Integrate accessibility, ethical impact, SSDF/ASVS review, supply-chain provenance, usability evidence, external feedback, remediation, and oral defense into the final system.

Evidence Contract​

  • WCAG report
  • ethical decision record
  • SSDF/ASVS matrix
  • SBOM/signature/provenance
  • usability retest
  • external review
  • remediation log.

Assessment Integration​

  • Project: produce the evidence in the semester repository rather than as detached prose.
  • Checkpoint: show the evidence exists and identify its highest-risk gap.
  • Cumulative review: connect the work to current, previous, and two-semesters-back knowledge.
  • Exam: evaluate a new case and reject an attractive but unsafe or unsupported alternative.
  • Rubric: every required evidence category must pass; strengths cannot average away a missing category.
  • Answer key: calibrate the shape of evidence without prescribing one implementation.

Oral Defense​

Defend the system under user, accessibility, security, operational, ethical, cost, and failure questioning.

AI-Use Declaration​

Record tools and models used, material output accepted, rejected suggestions, and independent verification. Undeclared generated evidence fails the integrity gate.

Reading Route​

Start with the linked semester concepts and labs. Use local books selectively for conceptual depth and current official standards for normative requirements. Stop reading when you can produce and defend the required evidence.

G1–G7 graduation evidence​

Budget 50–75 hours of additional integration/review: G1 10–15, G2 6–9, G3 9–13, G4 7–10, G5 6–9, G6 7–11, G7 5–8. Reuse module artifacts and charge only new investigation/retest. Score 0 absent, 1 prompted, 2 independently evidenced with limits, 3 fresh transfer; every category requires at least 2.

G1 — Accessibility and task usability (10–15 hours)​

Select the critical user workflow and document its start/end, browser/device and applicable WCAG 2.2 criteria. Test keyboard operation, focus order/visibility, semantic names and errors, reflow, contrast and relevant assistive-technology behavior, with automated checks as a supplement. Conduct a consented task observation, repair an observed barrier and retest. Record criteria not tested or not applicable with reasons. A clean scanner output is not WCAG conformance. For an API-only project, provide and evaluate the real human-facing client/documentation workflow and explicitly bound the scope rather than inventing a UI audit. WCAG 2.2 and focus-order understanding are primary references.

G2 — Ethical decision (6–9 hours)​

Revisit the actual design with affected and excluded stakeholders, plausible differentiated harms, duties/constraints, alternatives, safeguards and an owner/trigger. Obtain a different-perspective review. Show one decision that changed or a reasoned decision retained after challenge. Generic principles without a system-specific action fail. Reuse the existing ethical record; do not replace it with a new detached essay.

G3 — SSDF/ASVS evidence (9–13 hours)​

Use identified teaching versions NIST SSDF 1.1 and OWASP ASVS 5.0.0, recording relevant requirement IDs and applicability. Map selected controls to code/config, actual positive/negative tests, findings and repair. Include authorization across tenants/roles and secret/dependency handling where applicable. Uncovered requirements remain visible. This scoped educational review is not certification or a legal compliance claim. Sources: NIST SSDF, OWASP ASVS releases.

G4 — Provenance at the running boundary (7–10 hours)​

Carry the actual SBOM, signature and provenance from Semester 09 into the capstone release. Independently verify expected signer/builder/source and artifact digest, then show that the running version matches. Test tamper and wrong-identity rejection with the chosen tool. Merely copying an attestation file into the portfolio fails. Keep secrets and private infrastructure details out of public evidence.

G5 — Usability retest and observation limits (6–9 hours)​

After the G1 repair, ask a consenting person to attempt a fresh task variant without coached steps. Record completion, errors, help and what the small participant sample cannot establish. Keep personal details private. A second author walkthrough or AI role-play is rehearsal, not participant evidence. Distinguish accessibility criteria from general usability findings; both matter.

G6 — External review and remediation (7–11 hours)​

Use a credible engineer who can challenge architecture, reproduce a key claim and inspect a failure/restore record. Record scope, actual findings, severity, owner and retest. Close every blocker with evidence and reviewer-visible disposition; disagreements need reasons, not silent deletion. No reviewer available means pending graduation, not a fabricated endorsement.

G7 — Independent defense and honest handoff (5–8 hours)​

After at least 48 hours, defend an unseen change card connecting user impact, data integrity, deployment and operations. Show one failed experiment and its repair. Audit public claims against measured/implemented/modeled/proposed status, and carry limitations into the next learning plan. The final packet must be reproducible without private author state. All original project/runtime and exam criteria still apply.

Calibration​

A keyboard-accessible happy path with an inaccessible validation error is incomplete workflow evidence. A signature checked against an untrusted identity is not a trusted release. An 18-minute restore that fails the declared 10-minute target remains a failed target even if every record is correct. A strong portfolio cannot average away a missing real-cloud deployment, restore, accessibility retest or external review required by the project.

Foundation transfer at graduation​

Use the foundation transfer audit within the existing G7 defense and project-assembly budgets. It connects earlier required evidence to fresh capstone changes without extra hours or forced AI/parallel features. All original runtime and independent-review gates remain.