◇ OpenCyber Academy
Engineering · Chapter 46 · English

Chapter 46 — Engineering capstone II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 46 — Engineering capstone II

Lesson map

Lesson 46 published. Map, example, EX136.

flowchart TD
  N0["Learning outcomes"]
  N1["46.1 Freeze"]
  N2["46.2 Verify"]
  N3["46.3 Docs"]
  N4["46.2b Operator shadowing"]
  N5["46.3b Demo script"]
  N6["46.1b Handover to ops"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX136"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["46.1 Freeze"]
  N2["46.2 Verify"]
  N3["46.3 Docs"]
  N4["46.2b Operator shadowing"]
  N5["46.3b Demo script"]
  N6["46.1b Handover to ops"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX136"]

[Learning outcomes]
    |
    v
[46.1 Freeze]
    |
    v
[46.2 Verify]
    |
    v
[46.3 Docs]
    |
    v
[46.2b Operator shadowing]
    |
    v
[46.3b Demo script]
    |
    v
[46.1b Handover to ops]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX136]

Learning outcomes

You will (1) finish implementation against the frozen proposal; (2) run Verification Lab II; (3) deliver operator docs.

46.1 Freeze

Feature freeze date is real: after it, only safety fixes. New ideas go to a sequel proposal.

After freeze, feature ideas go to a sequel proposal, not into "small" commits that bypass Lab II. Safety fixes still flow. Sam filed a sequel doc for a nice-to-have export format on freeze day rather than sneaking it into the signed-policy branch. Safety fixes still need Lab II rows that touch the changed path. Sequel proposals cannot reopen the frozen branch without a new Capstone I.

46.2 Verify

Capstone must pass Lab II (Chapter 40) on synthetic fixtures with signed checklist.

Lab II on synthetic fixtures with a signed checklist is the Capstone II gate named earlier. Unit greens are not a substitute. Sam's Capstone II tag points at the checklist hash from the Lab II run the same day the runbook updated. The checklist hash is printed in the Capstone II README next to the tag. README and tag must agree or the release script aborts. A mismatch prints both hashes so the author knows which file drifted.

46.3 Docs

Runbook section, ADR, operator tutorial with screenshots of synthetic UI — no client data.

"""Rebuild a synthetic engagement timeline from event records."""
events = [
    ("09:00", "ROE brief signed", "auth"),
    ("09:15", "scoped host inventory loaded (12 hosts)", "prep"),
    ("10:02", "service enumeration on 10.20.1.0/28", "enum"),
    ("10:45", "finding SYN-001 noted on staging UI", "find"),
    ("11:10", "stop: host 10.20.0.1 probed — out of scope", "stop"),
    ("11:12", "escalated to client contact; confirmed deny-list", "comm"),
    ("13:00", "resume on in-scope hosts only", "auth"),
    ("15:30", "debrief draft shared with client", "report"),
]
# print chronological with phase tags; compute stop latency
print("phase timeline:")
for t, msg, phase in events:
    print(f"  {t} [{phase:6}] {msg}")
t0 = 10*60+45; t1 = 11*60+10
print(f"minutes from SYN-001 note to stop: {t1-t0}")
print(f"stop reason present: yes")
print(f"events={len(events)} phases={len(set(p for _,_,p in events))}")

Expected output:

phase timeline:
  09:00 [auth  ] ROE brief signed
  09:15 [prep  ] scoped host inventory loaded (12 hosts)
  10:02 [enum  ] service enumeration on 10.20.1.0/28
  10:45 [find  ] finding SYN-001 noted on staging UI
  11:10 [stop  ] stop: host 10.20.0.1 probed — out of scope
  11:12 [comm  ] escalated to client contact; confirmed deny-list
  13:00 [auth  ] resume on in-scope hosts only
  15:30 [report] debrief draft shared with client
minutes from SYN-001 note to stop: 25
stop reason present: yes
events=8 phases=7

Synthetic case — Riverstone Transit. Capstone II delivered signed policy distribution; Lab II green; runbook updated the same day.

Runbook, ADR and operator tutorial with synthetic screenshots are part of done. Client data in docs is a fail. Sam's tutorial uses only the Riverstone lab UI and was updated the same day Lab II went green for signed policy distribution. Screenshots are cropped to remove any host wallpaper that could identify a real site.

46.4 Errors and limits

Demo magic on a laptop with hand-waved fail-closed does not pass.

For Capstone II, the silent operator run and Lab II checklist are the proof. Sam's first acceptance attempt failed two documentation steps; magic was not offered as a substitute. The published rubric, which students see in week one, gives zero for a laptop demo without the checklist, so nobody can treat such a demo as a surprise strategy. Graders run the checklist themselves on the submitted build rather than accepting the student's account of a passing run.

46.2b Operator shadowing

Before claiming done, a second engineer follows the runbook cold on synthetic data while the author is silent. Places they stall become doc fixes. Capstone II is not done until the silent run succeeds.

Author silence during the cold run is what surfaces missing steps. Sam's shadowing session stalled on the kill-switch path until the binder page named the file location the tabletop had found earlier. Stall notes are filed as doc tickets before the acceptance script is attempted. The shadowing engineer signs the run log when the silent run finally passes.

46.3b Demo script

Capstone II demo follows a script on synthetic data: show fail-closed, show coverage denominator, show a stopped action. Improvised demos skip safety. Record the script next to the lab report.

A script that shows deny on missing policy, a 5/7 coverage export and a stopped action keeps the defense honest. Sam filed the script next to the Lab II report so examiners could ask for the same path. Examiners may ask to pause the script and inspect the deny reason code live.

46.1b Handover to ops

Capstone code without an ops owner at merge is unfinished. Name the owning squad in the README and CODEOWNERS before Lab II sign-off.

CODEOWNERS and README ownership before Lab II sign-off stop orphan capstones. An ops squad that never agreed cannot be surprised on call. Sam's README named the platform squad and the on-call rotation before the acceptance script ran. Ops acknowledgment is a checkbox on the Lab II sign-off form. Red sign-off is visible on the Capstone II board beside Lab II.

Practice note

The silent runbook test is recorded on video for the advisor (synthetic data only). Watching a peer struggle is uncomfortable and uniquely effective at surfacing missing prerequisites — for example, never documenting that the test policy key is required.

Link the silent-run video hash in the Lab II report for advisor audit.

Ops acceptance is a required signature beside Lab II on the release checklist.

Without ops signature the release tag is not cut, even if Lab II is green.

Advisor review watches the silent-run recording at 1.5x and files doc issues before sign-off.

46.4b Final acceptance test

Before the capstone is handed over, an operator who did not build it runs the acceptance script alone, using only the documentation. Two steps failed in Sam's first attempt because the documentation assumed knowledge he had; both were rewritten and the operator's second run passed.

Assumed knowledge in docs is a defect the cold operator will find. That rewrite is part of the capstone evidence, not an embarrassment to hide. The rewritten steps and the second green run are both sealed in the dossier.

Exercises

Synthesis

Freeze, verify, document — then and only then operate.

Continue studying — chapter 46 of 50

← Chapter 45 (draft) · Course chapter index · Chapter 47 (draft) →