Chapter 30 — Laboratory II
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes"]
N1["30.1 Build"]
N2["30.2 Stop drill"]
N3["30.3 Honesty"]
N4["30.4 Peer pressure"]
N5["30.5 Time box"]
N6["30.6 Pass bar"]
N7["30.7 Hash mismatch refusal"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["30.1 Build"]
N2["30.2 Stop drill"]
N3["30.3 Honesty"]
N4["30.4 Peer pressure"]
N5["30.5 Time box"]
N6["30.6 Pass bar"]
N7["30.7 Hash mismatch refusal"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX088"]
[Learning outcomes]
|
v
[30.1 Build]
|
v
[30.2 Stop drill]
|
v
[30.3 Honesty]
|
v
[30.4 Peer pressure]
|
v
[30.5 Time box]
|
v
[30.6 Pass bar]
|
v
[30.7 Hash mismatch refusal]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes
You will (1) run ranking and retest labs; (2) pass a stop drill; (3) file a mini report.
30.1 Build
lab_rank + lab_retest + one-page report.
Laboratory II asks learners to rank findings with lab_rank, retest them with lab_retest and write a one-page report that a busy owner could act on. The build is intentionally small so honesty and stop discipline stay visible. Sam fails flashy reports that hide a STILL OPEN item behind confident prose. Scripts are pinned; learners do not bring private forks. The lab rewards coherent closure language more than clever pivoting. Owners should finish the page knowing what to patch first and what remains open.
30.2 Stop drill
Compliant message within two minutes.
"""Lab 30: compare synthetic before/after statuses for a TRB retest."""
before={"F1":"open","F3":"open","F4":"open"}; after={"F1":"closed","F3":"open","F4":"closed"}
for k in sorted(before): print(k, before[k], "->", after[k], "FIXED" if after[k]=="closed" else "STILL OPEN")
print("fixed", sum(after[k]=="closed" for k in before), "of", len(before))
Run with python3 lab_retest.py. Verified output:
F1 open -> closed FIXED
F3 open -> open STILL OPEN
F4 open -> closed FIXED
fixed 2 of 3
The stop drill times how quickly a learner can send the compliant stop message when the facilitator calls time. Two minutes is the bar; fumbling for the template fails the drill even if the technical work was strong. Sam wants the message to be muscle memory before real windows begin. Learners who argue during the drill practice the wrong skill. Speed here is about respect for the clock, not about typing contests.
30.3 Honesty
Leave STILL OPEN open.
If lab_retest still shows an open path, the report must say STILL OPEN and explain what remains. Closing on hope or on an owner's verbal assurance fails the lab. Sam's automated check looks for the status words when the synthetic after-state is open. Learners sometimes feel honesty costs them a grade; in this course honesty is the grade. The habit transfers to real tickets where false FIXED claims are expensive. A painful STILL OPEN today prevents a false FIXED in next week's audit pack.
30.4 Peer pressure
Refuse mismatched evidence.
Peers may offer a screenshot whose hash is "only off by one character" or a log from a different build. The correct move is to refuse and re-capture. Sam scripts this pressure into the lab so refusal gets practiced out loud. Close-enough evidence is how trust dies in front of auditors and regulators. Learners who accept mismatched files fail even if their prose is polished. Saying no in front of peers is the skill the script is really grading.
30.5 Time box
Two hours.
The lab fits in two hours including the stop drill and the report. Scope creep inside the exercise is a self-inflicted fail. Sam watches for learners who chase a fourth finding instead of finishing the page. Time boxes teach prioritization the same way engagement windows do. Finishing cleanly inside the box beats a brilliant draft that misses the clock. Learners who finish early help peers with wording, not with extra hunting. Leaving with a coherent page beats leaving with unfinished brilliance.
30.6 Pass bar
Stop + honesty + coherent report.
Passing requires a timely stop, honest statuses and a report an owner could use without calling the learner. Clever chains that miss any of the three still fail. Sam publishes the bar before the lab so nobody discovers it in the debrief. The bar mirrors production expectations at TRB in miniature. Technical theatre without operational discipline does not clear the course. Facilitators score the three legs separately so a dazzling chain cannot hide a soft stop.
30.7 Hash mismatch refusal
Lab II peer pressure scripts include "the hash is only off by one character". Sam's refused answer is always re-capture. Close-enough hashes are how evidence loses court and regulator trust.
The scripted line sounds reasonable under time pressure, which is why it is taught. Sam's model answer is short: re-capture, do not patch the hash. Learners rehearse the sentence until it feels ordinary. Evidence integrity is not a vibe; it is a digest that matches. Courses that never practice refusal produce polite people who accept bad files.
30.8 Report skeleton
Lab II reports use a skeleton with REQUIRED markers. Missing STILL OPEN explanation fails the automated check Sam wrote.
The skeleton removes debates about formatting so attention stays on content. REQUIRED markers make omissions obvious to both humans and CI. Sam's checker fails empty sections rather than guessing intent. Learners who delete a marker to hide a gap learn that the pipeline notices. Structure is an honesty aid, not bureaucracy for its own sake. Empty REQUIRED blocks fail loudly before a human ever opens the file.
30.9 Skeleton CI
PRs of Lab II reports fail CI if REQUIRED sections are empty. Sam likes mechanical honesty.
Continuous integration on prose feels odd until the first time it catches a missing status. Sam would rather a bot reject the pull request than rely on a tired facilitator alone. Mechanical honesty scales across cohorts without losing its temper. Learners can iterate until the check passes, which teaches revision under a clear rule. Facilitators still read for quality; CI only enforces presence. The pipeline is a patient tutor that repeats the same standard every time.
30.10 CI rejects owner-said-so
Lab II CI rejects a report that marks F3 closed with comment "owner said so". Sam's error message quotes the course rule. Mechanical enforcement beats sermonising.
The scene is funny the first time and sobering the second. Verbal assurance is not retest evidence, and the checker knows the difference. Sam's error text cites the handbook rule so appeals are about the rule, not about the bot's mood. Learners update the status to STILL OPEN and write what remains. Sermons fade; failing checks teach.
30.11 STILL OPEN when retest open
Skeleton CI looks for the string STILL OPEN when lab_retest would show open items. Students cannot hide openness by omission.
Omission is the softest form of false closure. The checker compares the synthetic after-state to the report text and demands the uncomfortable words when paths remain. Sam tuned the check after a cohort quietly dropped open items from the page. Hiding work does not fix systems. Making openness mechanically required keeps the lab aligned with production ethics. Forced words on the page become forced honesty in the learner's next real ticket.
30.12 Rule numbers in CI
CI message quotes the rule number from the course handbook.
Error messages that only say "invalid report" invite arguments with the tool. Quoting the handbook rule lets a learner look up the expectation and fix the work. Sam keeps rule numbers stable across terms so old threads still make sense. Appeals cite the rule; they do not petition the facilitator to override a clear miss. Transparent automation earns grudging respect. Clear citations turn a red X into a study guide instead of a dead end.
30.13 Appeals cite the rule
Handbook rule numbers in CI make appeals easy: cite the rule, do not argue with the bot.
A clean appeal path reduces heat in the room. Learners who disagree must show how the rule was misapplied, which is rarer than they expect. Sam would rather debate handbook language in a curriculum meeting than debate every failing check ad hoc. The bot is not the villain; unclear rules would be. Numbered expectations keep both sides honest. Process fairness matters as much as technical correctness in a graded lab.
30.14 Best refusal of the day
Laboratory II debriefs vote on the best refusal of the day. The winner explains their wording. Celebrating refusal makes the next one easier.
Refusal is socially awkward, so the course celebrates it on purpose. The winning learner reads the exact sentence they used when evidence did not match. Peers steal good wording the way they steal good payloads in other cultures. Sam wants refusal to feel like craft. A room that cheers a clean no will produce cleaner evidence packs.
30.15 Refusal example card
Best-refusal vote winners get to update the refusal example card.
The example card in the lab pack is a living document owned by recent winners. Updating it keeps the language current and gives recognition without grades inflation. Sam reviews edits for tone and accuracy before they ship. Learners take the card more seriously when peers wrote the lines. Ownership of small artifacts builds the culture faster than posters alone. Peer-authored examples travel farther than facilitator lectures after the term ends.
Worked example (synthetic TRB)
lab_retest shows F1/F4 FIXED, F3 STILL OPEN; Sam's report keeps F3 open.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX088 — Retest counts. How many FIXED vs STILL OPEN? Rubric: 3 = 2 FIXED, 1 STILL OPEN; 2 = partial; 1 = all fixed; 0 = none.
- EX089 — Stop limit. Stop message time limit? Rubric: 3 = two minutes; 2 = fast; 1 = next day; 0 = none.
- EX090 — F3 handling. May the report close F3 without evidence? Rubric: 3 = no; F3 stays open; 2 = no, without saying F3 stays open; 1 = yes; 0 = none.
Synthesis
Lab II stresses stopping fast and reporting honest retest results.
Continue studying — chapter 30 of 40
← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →