<a id="ch-05"></a>

## Chapter 5 — The vendor's agreement is not a verified fix

<!-- open-cyber-academy:lesson-figures:start ch-05 -->
### Lesson map

Lesson 05. Map, example, EX051.

```mermaid
flowchart TD
  A["Source: three checks still unmet"] --> B["Print: 5 of 8 and three gap lines"]
  B --> C{"Does the vendor's promise rewrite that print?"}
  C -->|No| D["Keep the promise and the print apart"]
  C -->|Yes| E["The file does not show that rewrite"]
```

A promise about a later setup is not a second run of the checklist.

### Logical drawing

```text
source booleans
    three privileged checks unmet
print
    passed 5/8 (62.5%)
    three gap lines
narrative
    vendor agrees to fix the three before launch
    contractor verification is required and not filed
```
<!-- open-cyber-academy:lesson-figures:end ch-05 -->

### Learning outcomes

After this chapter, you should be able to:

1. Separate a vendor's promise from the checklist the script already scored.
2. Keep the printed score and the three gap lines.
3. Leave the contractor's verification undone in this file.

### 5.1 A promise does not rewrite the checklist.

The loyalty script reads eight yes-or-no lines. Five are met, so the embedded run prints `passed 5/8 (62.5%)` and then three gap lines: administrator changes have no timelock of at least 48 hours, vendor access has not been reviewed in the last 90 days, and role changes and pauses are not monitored. Chapter 4 also records a conversation. Elena discusses each gap, and the vendor agrees to fix all three before launch. That sentence is a promise about a setup this file does not yet contain. The script never reads the promise. It reads the booleans written beside the checklist, and those three remain unmet. The same chapter allows a pilot only after the café's IT contractor verifies the fixes. A verification would be a later note, written by the contractor, that the booleans had changed. No such note is in the manuscript. If a reader treats the agreement as a new score of eight, the open gaps disappear on the page while they remain in the source. Elena can keep the promise in the decision story and still quote today's print exactly. `lab_loyalty.py` stays the program that produced this run.

### 5.2 Worked example

The agreement and the print answer different questions, so both stay.

| What someone cites | What the file holds | Decision |
|---|---|---|
| `passed 5/8 (62.5%)` | The embedded run | Keep the line |
| The three gap lines | The unmet privileged checks | Keep the lines |
| "The vendor agrees to fix all three before launch." | A promise, not a new run | Keep it as a promise |
| "So the score is already eight." | No second run | Refuse |

> **Synthetic case.** The vendor, the agreement and the checklist are synthetic. The print is this run, not a later one.

### Errors and limits

A sincere promise can sit beside an unmet check. The contractor's verification is still required, and this manuscript does not show it done.

### Apply

- **EX051 — Promise or print?** The embedded run prints `passed 5/8 (62.5%)` and three gap lines. The vendor agrees to fix those gaps before launch, and the contractor is supposed to verify the fixes. Has that agreement already replaced the print? *Rubric:* 3 = no; the print and the three gap lines stay; the agreement stays a promise; the contractor's verification is not filed; do not edit the script;; 2 = the promise and the print stay different;; 1 = one line;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-05 -->
### Continue studying — lesson 05 (chapter 05 of 20)

[← Chapter 04](#ch-04) · [Course chapter index](../SUBJECTS.md) · [Chapter 06 →](#ch-06)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex051"></a>
**EX051.** No. The print stays `passed 5/8 (62.5%)` and the three gap lines stay. The vendor's agreement is not the contractor's verification. Do not edit the script.
