Production Capstone: Build and Govern a Secure GitLab Software Delivery Platform: Final Operational Review and Handoff

FINAL ACCEPTANCE CONTRACT
Required proof
  [ ] >= 5 critical invariants independently verified
  [ ] >= 4 controlled failures documented and recovered
  [ ] exact commit / tag / artifact identity chain recorded
  [ ] runner and credential trust boundaries documented
  [ ] security evidence scope and limitations documented
  [ ] API/webhook integration verification recorded
  [ ] observability / audit / incident evidence references included
  [ ] recovery objectives and lifecycle boundaries included
  [ ] tier/offering/version assumptions time-stamped
  [ ] complete cleanup / rollback procedure included

Decision values: VERIFIED | SIMULATED | TIER-DEPENDENT | NOT TESTED | FAIL

from pathlib import Path
import json, textwrap, csv
root=Path('gitlab-ch34-handoff')
for name in ['architecture','governance','pipeline','evidence','runbooks','recovery','risk','maintenance','cleanup']:
    (root/name).mkdir(parents=True,exist_ok=True)

(root/'architecture'/'README.md').write_text("""# Architecture evidence\n\n- Namespace/project topology\n- Trust boundaries\n- Delivery flow\n- Evidence flow\n- External Kubernetes/Self-Managed/Duo boundaries marked optional\n""")
(root/'governance'/'roles.csv').write_text("""principal,scope,role_or_authority,reason\napp-dev,project,Developer,normal branch/MR work\nrelease-owner,project,Maintainer,release/ref governance\nplatform-owner,top-level group,Owner,namespace administration only\nrunner-operator,runner fleet,operator,execution isolation and patching\nsecurity-reviewer,security evidence,reviewer,findings/policy decisions\n""")
(root/'pipeline'/'map.md').write_text("""# Pipeline map\n\nMR/default branch -> test -> package -> security evidence\nTag -> release manifest\nSensitive deployment -> separately governed production boundary\n""")
(root/'recovery'/'objectives.json').write_text(json.dumps({
  'RPO':'training example: <= 24h; production value must be business-approved',
  'RTO':'training example: <= 4h; production value must be exercised',
  'restore_rule':'backup is unproven until compatible disposable restore/verification',
  'external_lifecycles':['configuration/secrets','object storage','runner state','external cloud/Kubernetes']
},indent=2))
(root/'maintenance'/'checklist.md').write_text("""# Maintenance checklist\n\n- Review inherited memberships and elevated roles.\n- Review branch/tag rules and paid-tier approval policy if present.\n- Review pipeline-source rules, variables, job-token allowlists, runner trust classes.\n- Review artifact/cache/registry retention and release identity.\n- Review scanner/template/component/image versions and security evidence freshness.\n- Review webhook/API failures, rate-limit behavior, and signing-token rotation.\n- Review audit/log/metric health and backup/restore test status.\n- Re-check GitLab version, deprecations, tier entitlements, and Duo/Agent status.\n""")
(root/'cleanup'/'README.md').write_text("""# Cleanup\n\n1. Export required synthetic evidence.\n2. Revoke/delete any ephemeral lab credential or webhook signing token.\n3. Detach disposable runner/integration resources.\n4. Delete synthetic packages/images/releases if policy allows.\n5. Archive/delete only the verified disposable GitLab project/group.\n6. Delete local fixture directories last.\n""")
print(root.resolve())

from pathlib import Path
import json, hashlib
root=Path('gitlab-ch34-handoff'); ev=root/'evidence'
items=[
 {'id':'E-001','type':'membership','status':'SIMULATED','identity':'membership-snapshot-v1'},
 {'id':'E-002','type':'merge-governance','status':'SIMULATED','identity':'main-protection+review-record'},
 {'id':'E-003','type':'pipeline','status':'SIMULATED','identity':'commit-c0ffee01/pipeline-local'},
 {'id':'E-004','type':'artifact','status':'VERIFIED','identity':'sha256:aaa111-fixture'},
 {'id':'E-005','type':'security','status':'SIMULATED','identity':'security-report-fixture'},
 {'id':'E-006','type':'release','status':'SIMULATED','identity':'v0.1.0-capstone'},
 {'id':'E-007','type':'webhook','status':'VERIFIED','identity':'evt-capstone-001-signature-fixture'},
 {'id':'E-008','type':'recovery','status':'SIMULATED','identity':'four-drill-recovery-record'},
]
raw=json.dumps(items,indent=2)
(ev/'inventory.json').write_text(raw)
(ev/'inventory.sha256').write_text(hashlib.sha256(raw.encode()).hexdigest()+'\n')
print(raw)

from pathlib import Path
import json
root=Path('gitlab-ch34-handoff'); out=root/'evidence'/'invariant_results.json'
results=[
 {'invariant':'least_privilege','status':'SIMULATED','proof':'role matrix + inherited-access drill'},
 {'invariant':'reviewed_default_branch','status':'SIMULATED','proof':'branch rule + reviewer evidence; required approvals not enforced on Free'},
 {'invariant':'runner_isolation','status':'SIMULATED','proof':'runner trust-class design + failure drill'},
 {'invariant':'artifact_identity','status':'VERIFIED','proof':'independent checksum comparison'},
 {'invariant':'release_traceability','status':'SIMULATED','proof':'tag/commit/pipeline/digest tuple fixture'},
 {'invariant':'security_evidence','status':'VERIFIED','proof':'report hash + declared scope'},
 {'invariant':'webhook_integrity','status':'VERIFIED','proof':'HMAC fixture + duplicate-event control'},
 {'invariant':'recovery','status':'SIMULATED','proof':'backup lifecycle + recovery fixture; no live Self-Managed restore'},
]
# Acceptance: at least five invariants have evidence, but production readiness later distinguishes VERIFIED from SIMULATED.
assert sum(r['status'] in {'VERIFIED','SIMULATED'} for r in results) >= 5
out.write_text(json.dumps(results,indent=2))
for r in results: print(f"{r['status']:10} {r['invariant']:28} {r['proof']}")

{
  "reference_date": "2026-08-22",
  "gitlab_reference_release": "19.3",
  "mandatory_path": "GitLab Free + local fixtures",
  "constraints": {
    "protected_branches": "Free/Premium/Ultimate",
    "required_merge_request_approval_rules": "Premium/Ultimate",
    "code_owner_enforcement": "Premium/Ultimate",
    "protected_environments_and_deployment_approvals": "Premium/Ultimate",
    "basic_sast_and_downloadable_report": "Free/Premium/Ultimate with supported runner",
    "pipeline_secret_detection_report": "Free/Premium/Ultimate with supported runner",
    "security_policies_and_dependency_scanning": "Ultimate",
    "releases_and_release_evidence": "Free/Premium/Ultimate",
    "self_managed_backup_restore": "Self-Managed administration",
    "duo_agent_platform": "feature/status/credits/add-on/offering dependent; no mandatory AI use"
  }
}

from pathlib import Path
import csv
root=Path('gitlab-ch34-handoff'); p=root/'risk'/'register.csv'
rows=[
 ['R-01','Required approval enforcement not tested on Free path','medium','project maintainer','upgrade/paid pilot or external policy before regulated production'],
 ['R-02','Runner isolation represented by design/fixture','high','runner operator','test real executor/network/ephemeral lifecycle before sensitive jobs'],
 ['R-03','Security fixture does not equal full production scanner coverage','high','security owner','enable supported scanners and verify coverage/report ingestion'],
 ['R-04','No live Self-Managed restore performed','high','Self-Managed operator','schedule compatible disposable restore drill and measure RPO/RTO'],
 ['R-05','Kubernetes boundary not live-tested','medium','platform owner','use disposable cluster/agent before production cluster access'],
 ['R-06','Duo/Agent Platform not required/tested','low','AI governance owner','re-verify status/credits/privacy/tool governance before adoption'],
 ['R-07','GitLab feature/tier semantics can change after 19.3','medium','platform owner','review release/deprecation notes on upgrade cadence'],
]
with p.open('w',newline='') as f:
    w=csv.writer(f); w.writerow(['id','risk','severity','owner','next_action']); w.writerows(rows)
print(p.read_text())

RUNBOOK — RELEASE IDENTITY MISMATCH
Trigger: tag/commit/pipeline/artifact digest disagreement
1. Stop promotion/deployment.
2. Preserve release/tag/pipeline/artifact evidence.
3. Recompute artifact digest independently.
4. Resolve tag to commit; map commit to expected pipeline.
5. Identify wrong object; do not rewrite evidence to match.
6. Rebuild/retag/correct metadata through authorized workflow.
7. Re-run security/tests as required.
8. Verify final immutable tuple and record root cause/prevention.

RUNBOOK — POSSIBLE CREDENTIAL EXPOSURE
1. Revoke/rotate/disable credential.
2. Contain affected automation/sessions.
3. Identify scope and exposure window.
4. Review audit/log/API evidence for misuse.
5. Remove source/log/history exposure where required.
6. Verify old credential unusable; issue least-privilege replacement.

RUNBOOK — PIPELINE / RUNNER TRUST FAILURE
1. Identify pipeline source and commit.
2. Freeze sensitive job/deployment path.
3. Inspect runner executor, tags/protection, network and mounts.
4. Inspect variable/job-token availability without printing values.
5. Re-route to appropriate isolated runner / narrow credentials.
6. Re-run from known commit and verify evidence.

PRODUCTION-READINESS DECISION — TRAINING CAPSTONE
VERIFIED IN LAB
  - deterministic application tests
  - local artifact checksum identity
  - local security-evidence hash/scope
  - signed-webhook HMAC verification and duplicate-event logic
  - evidence-package integrity

SIMULATED / REQUIRES REAL ENVIRONMENT PROOF
  - inherited membership governance at target organization scale
  - runner isolation and production network boundary
  - end-to-end release/deployment promotion
  - Self-Managed restore and measured RPO/RTO
  - Kubernetes Agent authorization/deployment path

TIER-DEPENDENT
  - required MR approval rules / Code Owner enforcement
  - protected-environment deployment approvals
  - centralized security policies / advanced vulnerability workflows

OPTIONAL / NOT REQUIRED
  - GitLab Duo or Agent Platform execution

FINAL DECISION
  TRAINING OBJECTIVES: PASS when all evidence and drills are complete.
  PRODUCTION DEPLOYMENT: CONDITIONAL — only after every high-risk SIMULATED/TIER-DEPENDENT item required by the target organization is verified at its real boundary.

from pathlib import Path
import hashlib, json
root=Path('gitlab-ch34-handoff')
required=[
 'architecture/README.md','governance/roles.csv','pipeline/map.md','evidence/inventory.json',
 'evidence/invariant_results.json','recovery/objectives.json','risk/register.csv',
 'maintenance/checklist.md','cleanup/README.md'
]
missing=[x for x in required if not (root/x).exists()]
if missing: raise SystemExit('missing: '+', '.join(missing))
manifest=[]
for rel in required:
    p=root/rel
    manifest.append({'path':rel,'sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'bytes':p.stat().st_size})
(root/'evidence'/'handoff_manifest.json').write_text(json.dumps(manifest,indent=2))
print('HANDOFF_OK')
for x in manifest: print(x['sha256'][:12],x['bytes'],x['path'])

# Local cleanup: REVIEW the absolute path first.
pwd
ls -la gitlab-ch34-capstone gitlab-ch34-drills gitlab-ch34-handoff 2>/dev/null || true

# Delete only after the evidence package has been reviewed/exported:
# rm -rf gitlab-ch34-capstone gitlab-ch34-drills gitlab-ch34-handoff