Validate an explained tiny-API plan

The capstone combines all earlier boundaries into one explained plan. Two edge placements and two API placements span fictional zones a/b. A private single-zone database remains a known dependency. Only public TLS reaches the edge; the API and database accept traffic from the immediately preceding group.

The validator checks this documented teaching rubric. A clean result means its local fixture assumptions are consistent, not that AWS resources exist, bills are zero or a production system is ready. Your explanation must retain the single-zone database limitation and the work required to replace assumptions with operational evidence.

The local command prints a validated plan, traffic decisions, policy decisions and a failure matrix. It also emits broken-plan findings for a publicly exposed database and an excessive workload grant, so a green report is not the only demonstrated path.

The optional CloudFormation file creates only a small networking skeleton: a VPC, public/private subnets, a gateway, route table and explicit security groups. It does not create a load balancer, EC2 instance, database, NAT gateway, secret or running service. The plan describes those application responsibilities; the AWS continuation teaches fuller provisioning.

tiers={"edge":{"a","b"},"api":{"a","b"},"database":{"a"}}
for failed in ("a","b"):
    alive={tier for tier,zones in tiers.items() if zones-{failed}}
    print("zone lost",failed,"complete path",set(tiers)<=alive)

A validator is strongest when its scope is named. It checks healthy tier placement, zone diversity, intended ingress, secret-reference shape, literal identity grants and the operations checklist. It does not prove routing, TLS, deployment identity, managed failover, security compliance or production reliability.

Treat the output as a reviewable plan to improve. Explain which dependency fails in each scenario, which costs remain uncertain and what real tests would replace assumptions. You can complete the course without provisioning any paid cloud resource; the optional account lab is clearly separate.

expected={"public TLS","private API","private database","scoped secret read","recovery assumptions","cost inventory"}
print("review decisions",len(expected))
print("local plan validation is not deployed-resource verification")

Run the downloadable plan command, its public contract tests and the negative fixtures. Explain the topology, allowed flows, role scope, secret retrieval boundary, zone-a database dependency, recovery assumptions, cost drivers and cleanup.

If you choose the optional AWS networking exercise, follow its account/profile, region, preview, inventory and exact stack teardown instructions. No cloud action is required by the hosted exercises, and this course does not provision resources on your behalf.

Download the complete lab. The archive includes runnable code, tests, fixtures and a README.