Domain 3 capstone: an engineering pack that proves its own controls

capstone · 160 min · Objective 3.5

Task

Assemble the domain's engineering into one runnable suite: every automation demonstrably fails closed, every measurement was actually measured, and every cryptographic control was observed both working and refusing.

Steps

  1. Write lab/engineering-register.csv with header control,claim,proof_command,observed_pass,observed_fail,measured_on covering at least ten controls from this domain: the mutating script's three refusals, the pagination assertion, the enrichment three-state, the response cap, the patch gate, the scan coverage, the SCAP outcome split, the forward-secrecy pair, the KDF work factor, the mTLS deny, the certificate expiry check, the signature verification, the key destruction.
  2. Every row must have BOTH observed_pass and observed_fail filled with real results. A control observed only succeeding has been observed doing nothing in particular.
  3. Write lab/engineering-runner.sh executing every proof command in sequence, exiting non-zero if any control fails to demonstrate BOTH states.
  4. Run it. Then break one control deliberately and run it again to confirm it goes non-zero.
  5. Write lab/measurements.md collecting every number this domain produced -- pagination gap, scan coverage fraction, SCAP evaluated versus total, KDF milliseconds, crypto inventory unknowns, certificate count -- each with the date measured and the date it becomes stale.
  6. Write lab/engineering-gaps.md naming the three controls you could NOT demonstrate failing, and what it would take to demonstrate each. That list is the honest output.

Verify

awk -F, 'NR>1 {n++} END {print n" control(s)"}' lab/engineering-register.csv
awk -F, 'NR>1 && ($4=="" || $5=="") {n++} END {print n+0" without both states"}' lab/engineering-register.csv
sh lab/engineering-runner.sh; echo "engineering suite exit=$?"
grep -Ec '[0-9]' lab/measurements.md
grep -Ec . lab/engineering-gaps.md

Ten or more controls, ZERO without both states observed, the runner exiting 0 when everything holds and non-zero when one is broken, every measurement carrying a date, and the gaps named. The gaps file is not a failure of the exercise -- it is the part a real programme never writes down.

Notes

lab/engineering-runner.sh and lab/boundary-runner.sh from domain 2 are the two artefacts worth keeping past the exam. Between them they convert every claim these two domains make into something with an exit code and a date, which is the difference the final lesson argues is the whole of this level.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.