Module 07

Labs

Practical, hands-on labs. Each lab has a concrete goal, a setup you can reproduce locally, and an explicit proof boundary so you know exactly what completing the lab does and does not prove.

Module curriculum

Lessons in Labs

Follow the sequence to build the model, then use the exercises to test the boundary.

Lesson 0115 min read

Lab: Build a first contract

Start from a bare repo and build a complete, valid ota.yaml — step by step — using ota init, ota detect, and ota validate.

Create a valid ota.yaml for a Node repo
Verify it with ota validate

Lesson 0212 min read

Lab: Diagnose a broken repository

Given a repo with intentional contract and environment problems, use ota doctor to identify each issue in priority order.

Run ota doctor and read all blocker findings
Distinguish blockers from warnings from informational results

Lesson 0310 min read

Lab: Interpret a bounded receipt

Read a real receipt from a not_proved boundary and explain what it does and does not certify.

Identify the not_proved entries in a receipt
Explain why the bounded scope is honest

Lesson 0412 min read

Lab: Add a refusal canary

Write a canary that proves a protected task is correctly refused by agents, then verify it fires.

Add a canary declaration to a contract
Run the canary and confirm the refusal fires

Lesson 0511 min read

Lab: Detect contract-to-CI drift

Use the GitHub projection check to detect stale generated governance and reconcile it without making workflow YAML canonical.

Introduce controlled drift in an Ota-owned generated workflow
Detect drift with ota ci github check