Instructor walkthrough

The initial application has high findings in the captured complete reports. The solution has zero findings in the snapshots. Local gates should reject the former and accept the latter, but live data can change.

The strict gate script requires complete:true and status:ok before checking severity. Treat missing files, parse errors and incomplete lookups as failures. A threshold only handles findings; separately verifying completeness avoids mistaking a partial report for success.

Workflow templates install only the chosen manager, restore its own lockfile without lifecycle scripts, run the benign tests, invoke the pinned scanner, and validate report completeness. They do not run fixes automatically. The CI platform itself is optional; templates are not proof of a hosted run.

Keep both a starter and worked application. For teaching, do not replace a failed gate with continue-on-error or remove its threshold. Use a copy of the student app for the repair; the solution's REMEDIATION.md provides the reference command.

Grade observed outcomes with attached logs if hosted; otherwise grade local evidence or clearly identified report analysis. Hosted runs have not been performed by this build unless the verification matrix later states otherwise.