Reduced content

Author: olivomarco

docs/assets/data/delivery-assurance.md

@@ -0,0 +1,21 @@
+# Delivery Assurance Standard
+
+Delivery assurance confirms that a customer-owned outcome is safe to adopt. It is a review overlay, not a second delivery guide.
+
+## Record four things
+
+1. **Authorized scope** — the customer tenant, repository, service, or migration wave, and the named customer owner who approved it.
+2. **Evidence** — the completed items in the delivery guide's Definition of Done, with links or locations for the evidence.
+3. **Open risk** — an unresolved constraint, its control, and the person accountable for it. Record "none" when no material risk remains.
+4. **Next decision** — the handover, pilot, rollout, cutover, or follow-up action, with its owner and target date.
+
+## Review principles
+
+- The delivery guide is the canonical source for tasks, acceptance criteria, commands, and troubleshooting. Do not duplicate its checklist here.
+- Inspect evidence independently where practical. A completed task is not sufficient when the outcome, scope, or control cannot be demonstrated.
+- Use a customer-owned environment whenever authorized. A sample environment is evidence of a pattern, not evidence of customer adoption.
+- Keep session guidance exception-only: record controls or risks that are specific to this product, tenant, or migration. Put general coaching and teaching material in facilitator notes, not delivery assurance.
+
+## Completion
+
+The reviewer accepts the outcome when the guide's Definition of Done is evidenced, the four records above are complete, and the customer owner agrees to the next decision.

docs/assets/js/delivery-assurance.js

@@ -0,0 +1,17 @@
+/* Shared delivery-assurance standard page. */
+(function () {
+  'use strict';
+
+  document.addEventListener('DOMContentLoaded', async () => {
+    const body = document.getElementById('assuranceBody');
+    if (!body) return;
+
+    try {
+      const response = await fetch('assets/data/delivery-assurance.md', { cache: 'no-cache' });
+      if (!response.ok) throw new Error('HTTP ' + response.status);
+      FP.renderMd(await response.text(), body);
+    } catch (error) {
+      body.innerHTML = '<p class="text-dim">Could not load the delivery assurance standard.</p>';
+    }
+  });
+})();

docs/build.js

@@ -12,6 +12,7 @@
  *   docs/assets/data/dependency-graph.json               — prereq graph (nodes + edges)
  *   docs/assets/data/challenges/<id>/README.md           — delivery guide copy
  *   docs/assets/data/challenges/<id>/COACH.md            — coach guide copy
+ *   docs/assets/data/delivery-assurance.md               — shared assurance standard
  *   docs/resources/<moduleId>/...                        — module resource files
  *
  * Validation (exits non-zero on errors):
@@ -79,6 +80,7 @@ const ROOT           = path.resolve(__dirname, '..');
 const MODULES_DIR    = path.join(ROOT, 'modules');
 const OUT_DATA_DIR   = path.join(__dirname, 'assets', 'data');
 const OUT_GUIDES_DIR = path.join(OUT_DATA_DIR, 'challenges');
+const ASSURANCE_STANDARD_PATH = path.join(ROOT, 'modules', 'DELIVERY_ASSURANCE.md');
 const OUT_RESOURCES_DIR = path.join(__dirname, 'resources');
 const OUTCOMES_PATH  = path.join(ROOT, 'outcomes.json');
 const CURRENT_SOURCE_REPO = 'microsoft/frontier-agentic-devops-rvas';
@@ -251,6 +253,9 @@ function validateLocalSourceAttribution(meta, metaPath) {
 function rewriteResourceLinksForPages(text, moduleId) {
   const moduleResources = `resources/${moduleId}/`;
   return text.replace(
+    /(\]\()(?:\.\.\/)+DELIVERY_ASSURANCE\.md/g,
+    '$1delivery-assurance.html',
+  ).replace(
     /(\]\()(https:\/\/microsoft\.github\.io\/resources\/|(?:\.\.\/)+[Rr]esources\/|\/[Rr]esources\/|(?:\.\/)?[Rr]esources\/)/g,
     `$1${moduleResources}`,
   ).replace(
@@ -401,6 +406,8 @@ function main() {
   fs.rmSync(OUT_RESOURCES_DIR, { recursive: true, force: true });
   fs.rmSync(OUT_GUIDES_DIR, { recursive: true, force: true });
   fs.mkdirSync(OUT_RESOURCES_DIR, { recursive: true });
+  fs.mkdirSync(OUT_DATA_DIR, { recursive: true });
+  fs.copyFileSync(ASSURANCE_STANDARD_PATH, path.join(OUT_DATA_DIR, 'delivery-assurance.md'));
 
   /* ── 1. Collect all challenges from all modules ── */
   for (const [moduleId, moduleCfg] of Object.entries(MODULE_CONFIG)) {

docs/challenge.html

@@ -77,7 +77,7 @@ <h1 id="challengeTitle">Loading…</h1>
             <!-- Coach warning banner (shown only in coach view) -->
             <div class="coach-flag" role="alert" aria-live="polite">
               <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2l3 7h7l-5.5 4 2 7L12 16l-6.5 4 2-7L2 9h7z"/></svg>
-              Delivery assurance view — implementation controls, evidence expectations, and verification. Keep this out of the delivery-team room.
+              Delivery assurance view — reviewer controls and evidence expectations. <a href="delivery-assurance.html">Read the shared standard.</a>
             </div>
 
             <!-- Rendered Markdown guide -->

docs/delivery-assurance.html

@@ -0,0 +1,48 @@
+<!doctype html>
+<html lang="en" data-theme="light">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Delivery Assurance Standard — Agentic DevOps</title>
+  <meta name="description" content="The shared delivery assurance standard for Agentic DevOps work packages." />
+  <link rel="preconnect" href="https://fonts.googleapis.com" />
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=Outfit:wght@500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
+  <link rel="stylesheet" href="assets/css/styles.css" />
+  <link rel="stylesheet" href="assets/css/shell.css" />
+  <link rel="icon" href="assets/img/logo-mark-white.png" />
+  <script src="assets/js/marked.min.js"></script>
+</head>
+<body>
+  <header class="nav" role="banner">
+    <div class="nav-inner">
+      <a class="brand" href="index.html" aria-label="RVAS — Agentic DevOps">
+        <img src="assets/img/logo-full.png" alt="RVAP" class="rvap-nav-logo" height="32">
+      </a>
+      <nav class="nav-links" aria-label="Primary">
+        <a href="index.html">Home</a>
+        <a href="catalog.html">Catalog</a>
+      </nav>
+    </div>
+  </header>
+  <main id="mainContent">
+    <section class="ch-detail-hero">
+      <div class="wrap">
+        <nav class="breadcrumbs" aria-label="Breadcrumb"><a href="index.html">Home</a><span>›</span><span>Delivery assurance</span></nav>
+        <h1>Delivery Assurance Standard</h1>
+        <p>Shared controls for every customer delivery work package.</p>
+      </div>
+    </section>
+    <section class="section-tight">
+      <div class="wrap">
+        <article class="guide-body" id="assuranceBody" aria-live="polite">
+          <p class="text-dim">Loading standard…</p>
+        </article>
+      </div>
+    </section>
+  </main>
+  <script src="assets/js/core.js"></script>
+  <script src="assets/js/delivery-assurance.js"></script>
+  <script src="assets/js/shell.js"></script>
+</body>
+</html>

modules/DELIVERY_ASSURANCE.md

@@ -0,0 +1,21 @@
+# Delivery Assurance Standard
+
+Delivery assurance confirms that a customer-owned outcome is safe to adopt. It is a review overlay, not a second delivery guide.
+
+## Record four things
+
+1. **Authorized scope** — the customer tenant, repository, service, or migration wave, and the named customer owner who approved it.
+2. **Evidence** — the completed items in the delivery guide's Definition of Done, with links or locations for the evidence.
+3. **Open risk** — an unresolved constraint, its control, and the person accountable for it. Record "none" when no material risk remains.
+4. **Next decision** — the handover, pilot, rollout, cutover, or follow-up action, with its owner and target date.
+
+## Review principles
+
+- The delivery guide is the canonical source for tasks, acceptance criteria, commands, and troubleshooting. Do not duplicate its checklist here.
+- Inspect evidence independently where practical. A completed task is not sufficient when the outcome, scope, or control cannot be demonstrated.
+- Use a customer-owned environment whenever authorized. A sample environment is evidence of a pattern, not evidence of customer adoption.
+- Keep session guidance exception-only: record controls or risks that are specific to this product, tenant, or migration. Put general coaching and teaching material in facilitator notes, not delivery assurance.
+
+## Completion
+
+The reviewer accepts the outcome when the guide's Definition of Done is evidenced, the four records above are complete, and the customer owner agrees to the next decision.

modules/ghas/challenges/00-environment-setup/COACH.md

@@ -1,78 +1,14 @@
-# Coach Guide: Activity S00 — Environment Setup
+# Activity S00 — Environment Setup — Delivery Assurance
 
-## Objectives
+This is a concise review overlay. Apply the [Delivery Assurance Standard](../../../DELIVERY_ASSURANCE.md); the paired `README.md` is the canonical source for tasks, evidence, commands, and Definition of Done.
 
-- Facilitate a GHAS configuration and ownership record in `modules/ghas/resources/ghas-governance-practice.template.md`, not merely a completed setup.
-- Help the delivery team select a real repository or service, or explicitly use Juice Shop as the fallback practice target.
-- Ensure the baseline records scope and criticality, enabled and missing GHAS capabilities, and the repository or service owner, security partner, and delivery team.
-- Ensure the baseline records least privilege, human accountability for approval and merge, and normal GHAS and PR validation for agent-originated changes.
-- Ensure the GHAS target repository is created in a participant/team/organizer-owned org, not a Microsoft-provided shared repo.
-- Verify GHAS enablement, access, `gh` authentication, branch creation, and the Codespaces or local environment; validate Juice Shop on port 3000 when used as the fallback.
-- Surface access and licensing blockers early, assign each an owner and target date, and apply fallback paths before Activity S01.
+## Assurance record
 
----
+- **Authorized scope:** record the customer target and approving owner.
+- **Evidence:** inspect the completed Definition of Done in `README.md`; link or attach the evidence.
+- **Open risk:** record the unresolved risk and accountable owner, or `none`.
+- **Next decision:** record the handover, pilot, rollout, cutover, or follow-up action with owner and date.
 
-## Facilitation Hints
+## Session-specific reviewer focus
 
-- Push Codespaces first. If local setup consumes more than 10 minutes, redirect to Codespaces.
-- Start with the GHAS configuration and ownership record. Ask which real repository or service is in scope, why its criticality matters, and whether Juice Shop is only the fallback practice target.
-- Ask for a show-of-hands check after the first 10 minutes: successful commands and a completed record with named owners.
-- Pair any blocked participant with a working neighbor; one blocker should not stall the group.
-- Start by having the responsible participant, team lead, or organizer run:
-  `./setup.sh provision ghas-00 --org <org>` or `./setup.ps1 provision ghas-00 -Org <org>`.
-- Verify that Codespaces is enabled for the org before the event starts (org Settings → Codespaces → Allow for all members). If not enabled, participants see no Codespace option.
-- If Copilot is not yet licensed for all participants, pair them so every team still practices the Copilot-assisted review loop in S01–S06.
-- Confirm GHAS is enabled on the provisioned org repo (Settings → Code security and analysis). CodeQL, secret scanning, Dependabot alerts, and push protection must all be on — S01–S06 depend on them.
-- Confirm the repository access list includes every participant or team that needs to push a branch. The script creates/configures the repo; it does not guess workshop roster membership.
-- Do not accept a feature toggle or a running storefront as completion by itself. Validate that enabled and missing GHAS capabilities, accountable roles, agentic delivery principles, and blocker ownership and dates are recorded in the baseline.
-- When discussing agentic delivery, keep the scope to the documented principles: least privilege; humans remain accountable for approval and merge; and agent-originated changes receive normal GHAS and PR validation.
-
----
-
-## Common Blockers & Fixes
-
-| Symptom | Cause | Fix |
-|---|---|---|
-| `gh auth status` fails | Not logged in | Run `gh auth login` again; choose HTTPS |
-| Codespace build times out | Network / quota | Retry once; fall back to local clone |
-| `npm start` fails | Node deps not installed | Run `npm install` from the Juice Shop repo root first, then `npm start` |
-| Port 3000 not accessible in Codespace | Port not forwarded | Open Ports tab in VS Code; forward port 3000 manually if needed |
-| Branch push rejected | Branch protection misconfigured | Check that push protection only blocks `main`, not participant branches |
-| Org repo not accessible | Participant not added to repo/org | Add participant or team under repo Settings → Collaborators and teams; or provide read-only clone baseline |
-| Codespaces option missing | Codespaces not enabled for org | Enable under org Settings → Codespaces before the event |
-| Juice Shop shows only `Cannot GET /` | App started from wrong directory or partial install | Ensure the participant is in the provisioned Juice Shop repo root and rerun `npm install && npm start` |
-| GHAS setup script warns on feature enablement | Missing license or insufficient admin permission | Have an org owner or repo admin enable the feature manually in Settings → Code security and analysis |
-
----
-
-## Success Check
-
-Before releasing the group to Activity S01, validate the following evidence with the
-delivery team:
-
-- [ ] A real repository or service is selected, or Juice Shop is recorded as the fallback practice target
-- [ ] `modules/ghas/resources/ghas-governance-practice.template.md` records the in-scope repository or service and its criticality
-- [ ] Enabled and missing GHAS capabilities are recorded
-- [ ] The repository or service owner, security partner, and delivery team are recorded as accountable roles
-- [ ] The GHAS configuration and ownership record includes least privilege, human accountability for approval and merge, and normal GHAS and PR validation for agent-originated changes
-- [ ] Access or licensing blockers are recorded with an owner and target date
-- [ ] The target repository is accessible, GHAS enablement is verified or recorded as missing, and the working branch is pushed
-- [ ] The delivery environment is usable: `gh auth status` and `gh repo view` succeed, and Juice Shop loads on port 3000 when using the fallback
-
----
-
-## Access-Blocked Fallback
-
-If a participant cannot reach the full environment, apply the smallest unblock:
-
-1. Codespaces quota: Use a local clone with Node.js installed, or request org Codespaces billing before the event.
-2. Org access: Coach adds participant to the repo or org team, or provides a pre-cloned repo baseline branch via `git bundle`.
-3. Juice Shop unavailable (Docker blocked locally, Codespace quota exhausted):
-   - Participants can still complete S01–S06 review steps by reading the pre-populated alert corpus in the Security tab — no live app required for the code-review loop.
-   - Coach provides a pre-scanned results packet: export of CodeQL SARIF results + Dependabot alert JSON + secret scanning summary so participants can proceed with the analysis tasks even without a running app.
-   - For fixes: participants write and submit PRs; CodeQL runs on the PR branch in GitHub Actions and validates the fix without needing a local running instance.
-4. GitHub Actions / CodeQL not running: Coach triggers a manual workflow run (`gh workflow run codeql.yml`) or shares pre-generated SARIF results for the alert-reading portion.
-
-## Useful references for coaching
-
-- [Codespaces quickstart](https://docs.github.com/en/codespaces/getting-started/quickstart), [GitHub CLI manual](https://cli.github.com/manual/).
+- No additional assurance exception: review the delivery guide’s Definition of Done.