{ "schema_version": 2, "meta": { "build_id": "CODEX-SETUP-SQL-SERVER", "slug": "setup-sql-server", "title": "Set Up SQL Server Express", "subtitle": "Install a practice instance, prove a query and restore a backup.", "description": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "one_sentence_description": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "target_user": "A motivated beginner with permission to work in a private practice folder.", "skill_level": "beginner", "estimated_time": "2–3 hours", "category": "Guided Build", "tags": [ "setup-sql-server", "verified practice", "chatgpt_codex" ], "prerequisites": [ "Permission to use a dedicated workspace", "A browser and terminal", "Read each platform-specific prerequisite before installation" ], "required_accounts": [ "An eligible account for the selected tool; sign in personally." ], "required_software": [ "Modern browser", "Python 3.10+ for downloadable drills" ], "required_hardware": [ "A computer with space for the practice files", "Second drive for the disaster-recovery checkpoint" ], "expected_cost": "Free practice; existing tool accounts may have plan limits.", "final_outcome": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "platforms": [ "windows" ], "version": "2.0", "author": "chatgpt_codex", "source_checked": "2026-10-05", "verification_status": "Created; automated browser and project checks recorded separately. Live account/OS verification is never inferred from browser completion." }, "user_outcome": { "before": "The learner has no reproducible, checked workflow for set up sql server express.", "after": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "finished_product": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database." }, "learning_objectives": [ "The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "Setup reports success and the named SQL Server service is running.", "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "The backup is created and checksum verification succeeds for BBBPractice." ], "lessons": [ { "lesson_id": "L01", "title": "Choose Express and a practice host", "purpose": "Express and Developer are different editions. Express does not include SQL Server Agent. Limits differ by major release; consult the linked version-specific table rather than an old 10 GB assumption.", "estimated_time": "6 min", "learning_objective": "The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "lessons_before_this": [], "lessons_after_this": [ "L02" ] }, { "lesson_id": "L02", "title": "Install the database engine", "purpose": "A Windows service instance and LocalDB are not the same deployment. This course uses a real named service; macOS/Linux container paths are separate Builds.", "estimated_time": "6 min", "learning_objective": "Setup reports success and the named SQL Server service is running.", "lessons_before_this": [ "L01" ], "lessons_after_this": [ "L03" ] }, { "lesson_id": "L03", "title": "Install the query client", "purpose": "The server instance name and authentication choice are separate from the SSMS app installation.", "estimated_time": "6 min", "learning_objective": "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "lessons_before_this": [ "L02" ], "lessons_after_this": [ "L04" ] }, { "lesson_id": "L04", "title": "Practice a complete SQL change", "purpose": "The exercise covers table creation, insert, update, ordered select and an objective row-count check.", "estimated_time": "6 min", "learning_objective": "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "lessons_before_this": [ "L03" ], "lessons_after_this": [ "L05" ] }, { "lesson_id": "L05", "title": "Use a least-privilege application login", "purpose": "Installing a database engine does not require every application or agent to become an administrator.", "estimated_time": "6 min", "learning_objective": "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "lessons_before_this": [ "L04" ], "lessons_after_this": [ "L06" ] }, { "lesson_id": "L06", "title": "Back up with verification", "purpose": "SQL Server’s service account must be able to write the destination. A backup on the database’s own disk is not disaster protection.", "estimated_time": "6 min", "learning_objective": "The backup is created and checksum verification succeeds for BBBPractice.", "lessons_before_this": [ "L05" ], "lessons_after_this": [ "L07" ] }, { "lesson_id": "L07", "title": "Restore without overwriting data", "purpose": "RESTORE VERIFYONLY checks backup readability but is not an actual restore. The distinct target turns recovery into a practiced operation.", "estimated_time": "6 min", "learning_objective": "BBBPracticeRestored contains the expected two rows in distinct data/log files.", "lessons_before_this": [ "L06" ], "lessons_after_this": [ "L08" ] }, { "lesson_id": "L08", "title": "Make the daily run repeatable", "purpose": "The checklist lets a new session connect, verify, back up and restore the practice data.", "estimated_time": "6 min", "learning_objective": "The checklist lets a new session connect, verify, back up and restore the practice data.", "lessons_before_this": [ "L07" ], "lessons_after_this": [ "L09" ] }, { "lesson_id": "L09", "title": "Build Bot Better — protect and recover", "purpose": "The September 23 BuildBotsBetter profile wipe removed Desktop, Documents and hidden agent memory together. Repeatable onboarding protects the knowledge needed to recover.", "estimated_time": "30 min", "learning_objective": "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "lessons_before_this": [ "L08" ], "lessons_after_this": [] } ], "steps": [ { "title": "Check the edition and supported OS", "purpose": "Express and Developer are different editions. Express does not include SQL Server Agent. Limits differ by major release; consult the linked version-specific table rather than an old 10 GB assumption.", "user_action": "Open Microsoft’s current SQL Server downloads and edition documentation. Choose Express for a small free practice instance; confirm supported Windows version, CPU, RAM and disk requirements for that installer. Keep the existing live SQL instance unchanged. Record a distinct practice instance name.", "explanation": "Express and Developer are different editions. Express does not include SQL Server Agent. Limits differ by major release; consult the linked version-specific table rather than an old 10 GB assumption.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [], "expected_result": "The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "resources": [], "checkpoint": { "what_is_being_checked": "Check the edition and supported OS", "success_condition": "The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "how_to_verify": "Record the selected Express version, supported Windows host, requirements and practice instance name are recorded. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify check the edition and supported os?", "answer": "The selected Express version, supported Windows host, requirements and practice instance name are recorded. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use your saved work from the previous step. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to check the edition and supported OS. The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "demo": "Open Microsoft’s current SQL Server downloads and edition documentation. Choose Express for a small free practice instance; confirm supported Windows version, CPU, RAM and disk requirements for that installer. Keep the existing live SQL instance unchanged. Record a distinct practice instance name.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate check the edition and supported os", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Open Microsoft’s current SQL Server downloads and edition documentation. Choose Express for a small free practice instance; confirm supported Windows version, CPU, RAM and disk requirements for that installer. Keep the existing live SQL instance unchanged. Record a distinct practice instance name. The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "on_screen_text": [ "Check the edition and supported OS", "The selected Express version, supported Windows host, requirements and practice instance name are recorded." ], "screen_recording_instructions": [ "Open Microsoft’s current SQL Server downloads and edition documentation. Choose Express for a small free practice instance; confirm supported Windows version, CPU, RAM and disk requirements for that installer. Keep the existing live SQL instance unchanged. Record a distinct practice instance name.", "Inspect the result: The selected Express version, supported Windows host, requirements and practice instance name are recorded.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "The selected Express version, supported Windows host, requirements and practice instance name are recorded." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Open Microsoft’s current SQL Server downloads and edition documentation. Choose Express for a small free practice instance; confirm supported Windows version, CPU, RAM and disk requirements for that installer. Keep the existing live SQL instance unchanged. Record a distinct practice instance name.", "The selected Express version, supported Windows host, requirements and practice instance name are recorded." ] }, "step_id": "L01-S01", "lesson_id": "L01" }, { "title": "Run the official Express installer", "purpose": "A Windows service instance and LocalDB are not the same deployment. This course uses a real named service; macOS/Linux container paths are separate Builds.", "user_action": "On a disposable practice host, download the signed Microsoft Express installer. Choose a named instance such as BBBPRACTICE, save its exact instance name and complete the engine installation. Keep network access local; do not open firewall ports just to connect locally.", "explanation": "A Windows service instance and LocalDB are not the same deployment. This course uses a real named service; macOS/Linux container paths are separate Builds.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": "Get-Service | Where-Object { $_.Name -like \"MSSQL*\" } | Select-Object Name,Status", "macos": "# This course teaches a Windows Express service; use a prepared Windows practice VM.", "linux": "# This course teaches a Windows Express service; use a prepared Windows practice VM." }, "command_type": "shell", "required_inputs": [], "expected_result": "Setup reports success and the named SQL Server service is running.", "resources": [], "checkpoint": { "what_is_being_checked": "Run the official Express installer", "success_condition": "Setup reports success and the named SQL Server service is running.", "how_to_verify": "Record setup reports success and the named SQL Server service is running. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "Setup reports success and the named SQL Server service is running.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. Setup reports success and the named SQL Server service is running.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify run the official express installer?", "answer": "Setup reports success and the named SQL Server service is running. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use your saved work from the previous step. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to run the official Express installer. Setup reports success and the named SQL Server service is running.", "demo": "On a disposable practice host, download the signed Microsoft Express installer. Choose a named instance such as BBBPRACTICE, save its exact instance name and complete the engine installation. Keep network access local; do not open firewall ports just to connect locally.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate run the official express installer", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "On a disposable practice host, download the signed Microsoft Express installer. Choose a named instance such as BBBPRACTICE, save its exact instance name and complete the engine installation. Keep network access local; do not open firewall ports just to connect locally. Setup reports success and the named SQL Server service is running.", "on_screen_text": [ "Run the official Express installer", "Setup reports success and the named SQL Server service is running." ], "screen_recording_instructions": [ "On a disposable practice host, download the signed Microsoft Express installer. Choose a named instance such as BBBPRACTICE, save its exact instance name and complete the engine installation. Keep network access local; do not open firewall ports just to connect locally.", "Inspect the result: Setup reports success and the named SQL Server service is running.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "Setup reports success and the named SQL Server service is running." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "On a disposable practice host, download the signed Microsoft Express installer. Choose a named instance such as BBBPRACTICE, save its exact instance name and complete the engine installation. Keep network access local; do not open firewall ports just to connect locally.", "Setup reports success and the named SQL Server service is running." ] }, "step_id": "L02-S01", "lesson_id": "L02" }, { "title": "Open SSMS and connect locally", "purpose": "The server instance name and authentication choice are separate from the SSMS app installation.", "user_action": "Install SQL Server Management Studio from Microsoft’s official download. Connect to localhost\\BBBPRACTICE with your own authorized account on the practice host. For a self-signed local certificate, inspect the certificate/trust option only for this known local instance; do not disable certificate validation on remote servers.", "explanation": "The server instance name and authentication choice are separate from the SSMS app installation.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": "# In an SSMS query window:\n# SELECT @@VERSION AS version, SERVERPROPERTY('Edition') AS edition;" }, "command_type": "shell", "required_inputs": [ "connection-checklist.md" ], "expected_result": "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "resources": [ "connection-checklist.md" ], "checkpoint": { "what_is_being_checked": "Open SSMS and connect locally", "success_condition": "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "how_to_verify": "Record sSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "SSMS cannot connect", "likely_cause": "The instance name, service state, login or certificate setting may be wrong.", "diagnostic_question": "Is MSSQL$BBBPRACTICE running, and does your connection string name that instance?", "fix": "Check the service, exact instance name and your own login. Inspect the local certificate error before choosing a known-local trust option.", "alternative_fix": "Ask the practice-host administrator to provision your login. Never use another agent’s credentials or an unapproved admin fallback.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Check the service, exact instance name and your own login. Inspect the local certificate error before choosing a known-local trust option." } ], "faqs": [ { "question": "How do I verify open ssms and connect locally?", "answer": "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use connection-checklist.md. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to open SSMS and connect locally. SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "demo": "Install SQL Server Management Studio from Microsoft’s official download. Connect to localhost\\BBBPRACTICE with your own authorized account on the practice host. For a self-signed local certificate, inspect the certificate/trust option only for this known local instance; do not disable certificate validation on remote servers.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Check the service, exact instance name and your own login. Inspect the local certificate error before choosing a known-local trust option.", "help": "Is MSSQL$BBBPRACTICE running, and does your connection string name that instance?" }, "video": { "purpose": "Demonstrate open ssms and connect locally", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Install SQL Server Management Studio from Microsoft’s official download. Connect to localhost\\BBBPRACTICE with your own authorized account on the practice host. For a self-signed local certificate, inspect the certificate/trust option only for this known local instance; do not disable certificate validation on remote servers. SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "on_screen_text": [ "Open SSMS and connect locally", "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version." ], "screen_recording_instructions": [ "Install SQL Server Management Studio from Microsoft’s official download. Connect to localhost\\BBBPRACTICE with your own authorized account on the practice host. For a self-signed local certificate, inspect the certificate/trust option only for this known local instance; do not disable certificate validation on remote servers.", "Inspect the result: SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Install SQL Server Management Studio from Microsoft’s official download. Connect to localhost\\BBBPRACTICE with your own authorized account on the practice host. For a self-signed local certificate, inspect the certificate/trust option only for this known local instance; do not disable certificate validation on remote servers.", "SSMS connects to the exact practice instance and SELECT @@VERSION reports the chosen edition/version." ] }, "step_id": "L03-S01", "lesson_id": "L03" }, { "title": "Run the session-local SQL exercise", "purpose": "The exercise covers table creation, insert, update, ordered select and an objective row-count check.", "user_action": "Open practice.sql in the same SSMS connection and execute the whole file as one batch. The temporary table exists only in this session; it does not edit an application’s tables. Read the ordered results.", "explanation": "The exercise covers table creation, insert, update, ordered select and an objective row-count check.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": "# SSMS: open resources/practice.sql, connect to the practice instance, then Execute." }, "command_type": "shell", "required_inputs": [ "practice.sql" ], "expected_result": "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "resources": [ "practice.sql" ], "checkpoint": { "what_is_being_checked": "Run the session-local SQL exercise", "success_condition": "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "how_to_verify": "Record sQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "I can repeat this action from the saved input." ], "tokens": [ "SQL PRACTICE PASS" ], "user_visible_success_message": "Evidence saved. SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify run the session-local sql exercise?", "answer": "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use practice.sql. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to run the session-local SQL exercise. SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "demo": "Open practice.sql in the same SSMS connection and execute the whole file as one batch. The temporary table exists only in this session; it does not edit an application’s tables. Read the ordered results.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate run the session-local sql exercise", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Open practice.sql in the same SSMS connection and execute the whole file as one batch. The temporary table exists only in this session; it does not edit an application’s tables. Read the ordered results. SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "on_screen_text": [ "Run the session-local SQL exercise", "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done." ], "screen_recording_instructions": [ "Open practice.sql in the same SSMS connection and execute the whole file as one batch. The temporary table exists only in this session; it does not edit an application’s tables. Read the ordered results.", "Inspect the result: SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Open practice.sql in the same SSMS connection and execute the whole file as one batch. The temporary table exists only in this session; it does not edit an application’s tables. Read the ordered results.", "SQL PRACTICE PASS reports 2 rows, one completed; the result shows task 1 done and task 2 not done." ] }, "step_id": "L04-S01", "lesson_id": "L04" }, { "title": "Write the connection contract", "purpose": "Installing a database engine does not require every application or agent to become an administrator.", "user_action": "In connection-checklist.md, document the app’s needed database/schema and minimal read/write permissions. Have the administrator provision that dedicated login; keep its secret in a user-scoped environment/secret store. Do not enable a shared sa workflow. Verify the login can run its allowed query and cannot write a protected schema.", "explanation": "Installing a database engine does not require every application or agent to become an administrator.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "connection-checklist.md" ], "expected_result": "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "resources": [ "connection-checklist.md" ], "checkpoint": { "what_is_being_checked": "Write the connection contract", "success_condition": "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "how_to_verify": "Record the app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify write the connection contract?", "answer": "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use connection-checklist.md. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to write the connection contract. The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "demo": "In connection-checklist.md, document the app’s needed database/schema and minimal read/write permissions. Have the administrator provision that dedicated login; keep its secret in a user-scoped environment/secret store. Do not enable a shared sa workflow. Verify the login can run its allowed query and cannot write a protected schema.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate write the connection contract", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "In connection-checklist.md, document the app’s needed database/schema and minimal read/write permissions. Have the administrator provision that dedicated login; keep its secret in a user-scoped environment/secret store. Do not enable a shared sa workflow. Verify the login can run its allowed query and cannot write a protected schema. The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "on_screen_text": [ "Write the connection contract", "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded." ], "screen_recording_instructions": [ "In connection-checklist.md, document the app’s needed database/schema and minimal read/write permissions. Have the administrator provision that dedicated login; keep its secret in a user-scoped environment/secret store. Do not enable a shared sa workflow. Verify the login can run its allowed query and cannot write a protected schema.", "Inspect the result: The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "In connection-checklist.md, document the app’s needed database/schema and minimal read/write permissions. Have the administrator provision that dedicated login; keep its secret in a user-scoped environment/secret store. Do not enable a shared sa workflow. Verify the login can run its allowed query and cannot write a protected schema.", "The app login is scoped to the practice data, credentials stay outside source, and allowed/denied checks are recorded." ] }, "step_id": "L05-S01", "lesson_id": "L05" }, { "title": "Create a disposable practice database backup", "purpose": "SQL Server’s service account must be able to write the destination. A backup on the database’s own disk is not disaster protection.", "user_action": "In SSMS create BBBPractice on the disposable instance and add a small table with two known rows. Review backup-restore.sql and the default backup directory. Run the COPY_ONLY checksum backup and RESTORE VERIFYONLY. Record the backup path and successful checks.", "explanation": "SQL Server’s service account must be able to write the destination. A backup on the database’s own disk is not disaster protection.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "backup-restore.sql", "connection-checklist.md" ], "expected_result": "The backup is created and checksum verification succeeds for BBBPractice.", "resources": [ "backup-restore.sql", "connection-checklist.md" ], "checkpoint": { "what_is_being_checked": "Create a disposable practice database backup", "success_condition": "The backup is created and checksum verification succeeds for BBBPractice.", "how_to_verify": "Record the backup is created and checksum verification succeeds for BBBPractice. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The backup is created and checksum verification succeeds for BBBPractice.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. The backup is created and checksum verification succeeds for BBBPractice.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "BACKUP reports access denied", "likely_cause": "The SQL service identity may not have access to the selected folder.", "diagnostic_question": "Does Server Properties show an existing writable default backup directory?", "fix": "Use the instance’s default backup directory on the disposable host or have its administrator grant narrowly scoped access.", "alternative_fix": "Use SSMS Back Up with the default destination, then copy the verified backup to a separate drive.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Use the instance’s default backup directory on the disposable host or have its administrator grant narrowly scoped access." } ], "faqs": [ { "question": "How do I verify create a disposable practice database backup?", "answer": "The backup is created and checksum verification succeeds for BBBPractice. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use backup-restore.sql, connection-checklist.md. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to create a disposable practice database backup. The backup is created and checksum verification succeeds for BBBPractice.", "demo": "In SSMS create BBBPractice on the disposable instance and add a small table with two known rows. Review backup-restore.sql and the default backup directory. Run the COPY_ONLY checksum backup and RESTORE VERIFYONLY. Record the backup path and successful checks.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Use the instance’s default backup directory on the disposable host or have its administrator grant narrowly scoped access.", "help": "Does Server Properties show an existing writable default backup directory?" }, "video": { "purpose": "Demonstrate create a disposable practice database backup", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "In SSMS create BBBPractice on the disposable instance and add a small table with two known rows. Review backup-restore.sql and the default backup directory. Run the COPY_ONLY checksum backup and RESTORE VERIFYONLY. Record the backup path and successful checks. The backup is created and checksum verification succeeds for BBBPractice.", "on_screen_text": [ "Create a disposable practice database backup", "The backup is created and checksum verification succeeds for BBBPractice." ], "screen_recording_instructions": [ "In SSMS create BBBPractice on the disposable instance and add a small table with two known rows. Review backup-restore.sql and the default backup directory. Run the COPY_ONLY checksum backup and RESTORE VERIFYONLY. Record the backup path and successful checks.", "Inspect the result: The backup is created and checksum verification succeeds for BBBPractice.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "The backup is created and checksum verification succeeds for BBBPractice." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "In SSMS create BBBPractice on the disposable instance and add a small table with two known rows. Review backup-restore.sql and the default backup directory. Run the COPY_ONLY checksum backup and RESTORE VERIFYONLY. Record the backup path and successful checks.", "The backup is created and checksum verification succeeds for BBBPractice." ] }, "step_id": "L06-S01", "lesson_id": "L06" }, { "title": "Practice a distinct database restore", "purpose": "RESTORE VERIFYONLY checks backup readability but is not an actual restore. The distinct target turns recovery into a practiced operation.", "user_action": "Use RESTORE FILELISTONLY and SSMS Restore Database to restore the backup as BBBPracticeRestored. Relocate data/log files to unique paths. Never use WITH REPLACE over a live database. Query the restored practice table and compare the original two rows.", "explanation": "RESTORE VERIFYONLY checks backup readability but is not an actual restore. The distinct target turns recovery into a practiced operation.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "backup-restore.sql" ], "expected_result": "BBBPracticeRestored contains the expected two rows in distinct data/log files.", "resources": [ "backup-restore.sql" ], "checkpoint": { "what_is_being_checked": "Practice a distinct database restore", "success_condition": "BBBPracticeRestored contains the expected two rows in distinct data/log files.", "how_to_verify": "Record bBBPracticeRestored contains the expected two rows in distinct data/log files. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "BBBPracticeRestored contains the expected two rows in distinct data/log files.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. BBBPracticeRestored contains the expected two rows in distinct data/log files.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify practice a distinct database restore?", "answer": "BBBPracticeRestored contains the expected two rows in distinct data/log files. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use backup-restore.sql. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to practice a distinct database restore. BBBPracticeRestored contains the expected two rows in distinct data/log files.", "demo": "Use RESTORE FILELISTONLY and SSMS Restore Database to restore the backup as BBBPracticeRestored. Relocate data/log files to unique paths. Never use WITH REPLACE over a live database. Query the restored practice table and compare the original two rows.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate practice a distinct database restore", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Use RESTORE FILELISTONLY and SSMS Restore Database to restore the backup as BBBPracticeRestored. Relocate data/log files to unique paths. Never use WITH REPLACE over a live database. Query the restored practice table and compare the original two rows. BBBPracticeRestored contains the expected two rows in distinct data/log files.", "on_screen_text": [ "Practice a distinct database restore", "BBBPracticeRestored contains the expected two rows in distinct data/log files." ], "screen_recording_instructions": [ "Use RESTORE FILELISTONLY and SSMS Restore Database to restore the backup as BBBPracticeRestored. Relocate data/log files to unique paths. Never use WITH REPLACE over a live database. Query the restored practice table and compare the original two rows.", "Inspect the result: BBBPracticeRestored contains the expected two rows in distinct data/log files.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "BBBPracticeRestored contains the expected two rows in distinct data/log files." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Use RESTORE FILELISTONLY and SSMS Restore Database to restore the backup as BBBPracticeRestored. Relocate data/log files to unique paths. Never use WITH REPLACE over a live database. Query the restored practice table and compare the original two rows.", "BBBPracticeRestored contains the expected two rows in distinct data/log files." ] }, "step_id": "L07-S01", "lesson_id": "L07" }, { "title": "Record the connection and backup routine", "purpose": "The checklist lets a new session connect, verify, back up and restore the practice data.", "user_action": "Fill connection-checklist.md with instance, own login, driver/certificate assumptions, query proof, backup verification and restore result. Express has no SQL Server Agent: plan a reviewed external scheduler with logs and failure alerts for future backups.", "explanation": "Keep the input and the observed result together so you can reproduce this action later.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "connection-checklist.md" ], "expected_result": "The checklist lets a new session connect, verify, back up and restore the practice data.", "resources": [ "connection-checklist.md" ], "checkpoint": { "what_is_being_checked": "Record the connection and backup routine", "success_condition": "The checklist lets a new session connect, verify, back up and restore the practice data.", "how_to_verify": "Record the checklist lets a new session connect, verify, back up and restore the practice data. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The checklist lets a new session connect, verify, back up and restore the practice data.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. The checklist lets a new session connect, verify, back up and restore the practice data.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify record the connection and backup routine?", "answer": "The checklist lets a new session connect, verify, back up and restore the practice data. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use connection-checklist.md. Work in the same practice folder." } ], "quiz": { "question": "Does RESTORE VERIFYONLY prove you practiced restoration?", "answer_type": "single_choice", "choices": [ "No; restore to a distinct practice database and query it.", "Yes; the verification command restores everything." ], "correct_answer": 0, "explanation": "Verification reads the backup; restoration reconstructs a database that you must query." }, "coach": { "intro": "We are going to record the connection and backup routine. The checklist lets a new session connect, verify, back up and restore the practice data.", "demo": "Fill connection-checklist.md with instance, own login, driver/certificate assumptions, query proof, backup verification and restore result. Express has no SQL Server Agent: plan a reviewed external scheduler with logs and failure alerts for future backups.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate record the connection and backup routine", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Fill connection-checklist.md with instance, own login, driver/certificate assumptions, query proof, backup verification and restore result. Express has no SQL Server Agent: plan a reviewed external scheduler with logs and failure alerts for future backups. The checklist lets a new session connect, verify, back up and restore the practice data.", "on_screen_text": [ "Record the connection and backup routine", "The checklist lets a new session connect, verify, back up and restore the practice data." ], "screen_recording_instructions": [ "Fill connection-checklist.md with instance, own login, driver/certificate assumptions, query proof, backup verification and restore result. Express has no SQL Server Agent: plan a reviewed external scheduler with logs and failure alerts for future backups.", "Inspect the result: The checklist lets a new session connect, verify, back up and restore the practice data.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "The checklist lets a new session connect, verify, back up and restore the practice data." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Fill connection-checklist.md with instance, own login, driver/certificate assumptions, query proof, backup verification and restore result. Express has no SQL Server Agent: plan a reviewed external scheduler with logs and failure alerts for future backups.", "The checklist lets a new session connect, verify, back up and restore the practice data." ] }, "step_id": "L08-S01", "lesson_id": "L08" }, { "title": "Write a repeatable onboarding checklist", "purpose": "The September 23 BuildBotsBetter profile wipe removed Desktop, Documents and hidden agent memory together. Repeatable onboarding protects the knowledge needed to recover.", "user_action": "Fill in onboarding-checklist.md for your agent. Record AGENTS.md, the tool’s user settings and memory folder, the assigned workspace, permissions, guard location, backup schedule, and a final proof task. Keep the checklist in your project.", "explanation": "The September 23 BuildBotsBetter profile wipe removed Desktop, Documents and hidden agent memory together. Repeatable onboarding protects the knowledge needed to recover.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "onboarding-checklist.md" ], "expected_result": "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "resources": [ "onboarding-checklist.md" ], "checkpoint": { "what_is_being_checked": "Write a repeatable onboarding checklist", "success_condition": "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "how_to_verify": "Record the checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "I can repeat this action from the saved input." ], "tokens": [], "user_visible_success_message": "Evidence saved. The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify write a repeatable onboarding checklist?", "answer": "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use onboarding-checklist.md. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to write a repeatable onboarding checklist. The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "demo": "Fill in onboarding-checklist.md for your agent. Record AGENTS.md, the tool’s user settings and memory folder, the assigned workspace, permissions, guard location, backup schedule, and a final proof task. Keep the checklist in your project.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate write a repeatable onboarding checklist", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Fill in onboarding-checklist.md for your agent. Record AGENTS.md, the tool’s user settings and memory folder, the assigned workspace, permissions, guard location, backup schedule, and a final proof task. Keep the checklist in your project. The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "on_screen_text": [ "Write a repeatable onboarding checklist", "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification." ], "screen_recording_instructions": [ "Fill in onboarding-checklist.md for your agent. Record AGENTS.md, the tool’s user settings and memory folder, the assigned workspace, permissions, guard location, backup schedule, and a final proof task. Keep the checklist in your project.", "Inspect the result: The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Fill in onboarding-checklist.md for your agent. Record AGENTS.md, the tool’s user settings and memory folder, the assigned workspace, permissions, guard location, backup schedule, and a final proof task. Keep the checklist in your project.", "The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification." ] }, "step_id": "L09-S01", "lesson_id": "L09" }, { "title": "Demonstrate the variable-path limit safely", "purpose": "A command-text hook can miss a target computed inside a script or variable. This demonstrator checks resolved paths but is not an operating-system sandbox. For a real operation, enforce the resolved boundary at the operation itself; symlinks and races still require care.", "user_action": "Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text.", "explanation": "A command-text hook can miss a target computed inside a script or variable. This demonstrator checks resolved paths but is not an operating-system sandbox. For a real operation, enforce the resolved boundary at the operation itself; symlinks and races still require care.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": "python workspace_guard.py --self-test", "macos": "python3 workspace_guard.py --self-test", "linux": "python3 workspace_guard.py --self-test" }, "command_type": "shell", "required_inputs": [ "workspace_guard.py" ], "expected_result": "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "resources": [ "workspace_guard.py" ], "checkpoint": { "what_is_being_checked": "Demonstrate the variable-path limit safely", "success_condition": "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "how_to_verify": "Record gUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "I can repeat this action from the saved input." ], "tokens": [ "GUARD PASS" ], "user_visible_success_message": "Evidence saved. GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify demonstrate the variable-path limit safely?", "answer": "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use workspace_guard.py. Work in the same practice folder." } ], "quiz": { "question": "Does a command-text hook guarantee safety for a path computed inside a script?", "answer_type": "single_choice", "choices": [ "No; add enforcement at the resolved operation boundary and independent recovery.", "Yes, because the command looks harmless." ], "correct_answer": 0, "explanation": "The profile-wipe failure can involve a runtime variable whose value the text hook cannot see." }, "coach": { "intro": "We are going to demonstrate the variable-path limit safely. GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "demo": "Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate demonstrate the variable-path limit safely", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text. GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "on_screen_text": [ "Demonstrate the variable-path limit safely", "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed." ], "screen_recording_instructions": [ "Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text.", "Inspect the result: GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text.", "GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed." ] }, "step_id": "L09-S02", "lesson_id": "L09" }, { "title": "Verify the actual protection in your tool", "purpose": "A broken hook that blocks everything can look like protection. Some tools fail open when hooks fail. Codex hook changes need review/trust; Grok Build needs its own deny protocol; Antigravity uses a different JSON protocol. Never treat a prompt rule or an inactive hook as enforcement.", "user_action": "For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; the BBB working reference is linked in Sources. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. Grok Bot has no proven local shell guard here: use project-only tasks and reviewed actions, with backups.", "explanation": "A broken hook that blocks everything can look like protection. Some tools fail open when hooks fail. Codex hook changes need review/trust; Grok Build needs its own deny protocol; Antigravity uses a different JSON protocol. Never treat a prompt rule or an inactive hook as enforcement.", "estimated_time": "6 min", "action_type": "inspect", "commands": { "all": "" }, "command_type": "shell", "required_inputs": [ "workspace_guard.py", "onboarding-checklist.md" ], "expected_result": "A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "resources": [ "workspace_guard.py", "onboarding-checklist.md" ], "checkpoint": { "what_is_being_checked": "Verify the actual protection in your tool", "success_condition": "A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "how_to_verify": "Record a harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The harmless command succeeds.", "The boundary dry-run denies a profile target.", "I recorded the tool’s active hook state, or explicitly recorded that this tool has no working local guard." ], "tokens": [], "user_visible_success_message": "Evidence saved. A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I install a guard for this tool?", "answer": "Use the linked BBB safety reference for the exact tool/version protocol. Merge into the existing hooks instead of overwriting settings. Review/trust the hook if required, then verify a harmless call and a denied dry-run. The workspace_guard.py file is a teaching demonstration, not a universal hook adapter." }, { "question": "Does Grok Bot have a working local delete guard?", "answer": "The project’s live September 29 tests found no working shell hook. Restrict the tasks and workspace you hand it, keep independent backups, and do not claim local deletion is guarded." } ], "quiz": null, "coach": { "intro": "We are going to verify the actual protection in your tool. A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "demo": "For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; the BBB working reference is linked in Sources. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. Grok Bot has no proven local shell guard here: use project-only tasks and reviewed actions, with backups.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate verify the actual protection in your tool", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; the BBB working reference is linked in Sources. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. Grok Bot has no proven local shell guard here: use project-only tasks and reviewed actions, with backups. A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "on_screen_text": [ "Verify the actual protection in your tool", "A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation." ], "screen_recording_instructions": [ "For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; the BBB working reference is linked in Sources. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. Grok Bot has no proven local shell guard here: use project-only tasks and reviewed actions, with backups.", "Inspect the result: A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; the BBB working reference is linked in Sources. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. Grok Bot has no proven local shell guard here: use project-only tasks and reviewed actions, with backups.", "A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation." ] }, "step_id": "L09-S03", "lesson_id": "L09" }, { "title": "Enable a real backup of memory and project files", "purpose": "System Restore alone is not a personal-file backup. Previous Versions can disappear as shadow storage fills; OneDrive’s common-folder backup omits hidden agent folders.", "user_action": "Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials.", "explanation": "System Restore alone is not a personal-file backup. Previous Versions can disappear as shadow storage fills; OneDrive’s common-folder backup omits hidden agent folders.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": ".\\profile-backup.ps1 -Destination D:\\Backups\\llm-profiles", "macos": "bash profile-backup.sh /Volumes/YourBackup/llm-profiles", "linux": "bash profile-backup.sh /media/YourBackup/llm-profiles" }, "command_type": "shell", "required_inputs": [ "profile-backup.ps1", "profile-backup.sh", "onboarding-checklist.md" ], "expected_result": "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "resources": [ "profile-backup.ps1", "profile-backup.sh", "onboarding-checklist.md" ], "checkpoint": { "what_is_being_checked": "Enable a real backup of memory and project files", "success_condition": "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "how_to_verify": "Record a backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The destination is a mounted second drive.", "The hidden memory/settings folders and project files are included.", "An automated backup is enabled and its latest successful run is recorded." ], "tokens": [], "user_visible_success_message": "Evidence saved. A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The backup drive is missing or the script reports a failure", "likely_cause": "The destination may be on the same volume, unmounted, or unwritable.", "diagnostic_question": "Can you create a scratch file on the actual second drive?", "fix": "Mount the drive and choose an accessible backup directory. Inspect every error; robocopy codes 8 and higher are failures.", "alternative_fix": "Use the operating system backup application and verify the same folder coverage and successful run.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Mount the drive and choose an accessible backup directory. Inspect every error; robocopy codes 8 and higher are failures." } ], "faqs": [ { "question": "How do I verify enable a real backup of memory and project files?", "answer": "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use profile-backup.ps1, profile-backup.sh, onboarding-checklist.md. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to enable a real backup of memory and project files. A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "demo": "Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Mount the drive and choose an accessible backup directory. Inspect every error; robocopy codes 8 and higher are failures.", "help": "Can you create a scratch file on the actual second drive?" }, "video": { "purpose": "Demonstrate enable a real backup of memory and project files", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials. A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "on_screen_text": [ "Enable a real backup of memory and project files", "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded." ], "screen_recording_instructions": [ "Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials.", "Inspect the result: A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials.", "A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded." ] }, "step_id": "L09-S04", "lesson_id": "L09" }, { "title": "Practice a hash-verified restore", "purpose": "A backup becomes useful only when restoration has been practiced. A same-volume practice copy proves the procedure but not protection against disk failure.", "user_action": "Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile.", "explanation": "A backup becomes useful only when restoration has been practiced. A same-volume practice copy proves the procedure but not protection against disk failure.", "estimated_time": "6 min", "action_type": "command", "commands": { "windows": "python restore_drill.py --backup-root D:\\Backups\\bbb-practice --work-root practice", "macos": "python3 restore_drill.py --backup-root /Volumes/YourBackup/bbb-practice --work-root practice", "linux": "python3 restore_drill.py --backup-root /media/YourBackup/bbb-practice --work-root practice" }, "command_type": "shell", "required_inputs": [ "restore_drill.py" ], "expected_result": "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "resources": [ "restore_drill.py" ], "checkpoint": { "what_is_being_checked": "Practice a hash-verified restore", "success_condition": "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "how_to_verify": "Record rESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch. Include the actual result or a specific observation; do not paste credentials.", "criteria": [ "The proof file SHA256 hashes match.", "I restored and opened a non-secret memory/settings file from my real backup.", "The restored file is in scratch; the live profile was not overwritten." ], "tokens": [ "RESTORE PASS" ], "user_visible_success_message": "Evidence saved. RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "failure_message": "Compare the observed output with the required result before continuing.", "troubleshooting_path": "Open the help for this step." }, "troubleshooting": [ { "problem": "The result differs from the checkpoint", "likely_cause": "You may be in a different folder or using a different input/version.", "diagnostic_question": "What is the current directory, exact command, exit code and complete output?", "fix": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "alternative_fix": "Open the supplied resource and inspect the input manually; use the expected-result example to narrow the difference.", "when_to_escalate": "Stop after two explained attempts if the problem needs account access, permissions or changes outside this workspace. Share redacted evidence.", "bot_coach_response": "Compare the input filename and working directory with this step. Rerun only after correcting that difference." } ], "faqs": [ { "question": "How do I verify practice a hash-verified restore?", "answer": "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch. Keep the command or observation with your evidence." }, { "question": "Which files do I need for this step?", "answer": "Use restore_drill.py. Work in the same practice folder." } ], "quiz": null, "coach": { "intro": "We are going to practice a hash-verified restore. RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "demo": "Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile.", "handoff": "Try this in your own practice workspace, then compare the result.", "success": "Keep that result with your evidence.", "failure": "Compare the input filename and working directory with this step. Rerun only after correcting that difference.", "help": "What is the current directory, exact command, exit code and complete output?" }, "video": { "purpose": "Demonstrate practice a hash-verified restore", "duration_target": "45–75 seconds", "visual_type": "step walkthrough with optional browser narration; no rendered video is claimed", "narration_script": "Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile. RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "on_screen_text": [ "Practice a hash-verified restore", "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch." ], "screen_recording_instructions": [ "Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile.", "Inspect the result: RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.", "Record the evidence and check each criterion." ], "animation_instructions": "Highlight the action, then the corresponding result; avoid motion during command copying.", "cursor_instructions": "Point to the exact input and checkpoint; do not hide errors.", "important_visuals": [ "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch." ], "bot_position": "right sidebar", "bot_expression": "calm", "transition": "Continue after checkpoint", "captions": [ "Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile.", "RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch." ] }, "step_id": "L09-S05", "lesson_id": "L09" } ], "resources": [ { "resource_id": "R001", "name": "workspace_guard.py", "type": "py", "purpose": "Working resource used by this Build; inspect before running.", "contents": "# VERSION HISTORY\n# 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: learner resource.\n\"\"\"Dry-run resolved-path boundary demonstration. This script never deletes anything.\"\"\"\nimport argparse\nfrom pathlib import Path\n\ndef permitted(target, workspace):\n root = Path(workspace).resolve()\n candidate = Path(target).resolve()\n home = Path.home().resolve()\n if root == home or root == root.anchor or root in home.parents:\n return False\n return candidate != root and root in candidate.parents and candidate != home and candidate not in home.parents\n\ndef main():\n p=argparse.ArgumentParser(description=__doc__)\n p.add_argument('--workspace',default='practice')\n p.add_argument('--target')\n p.add_argument('--self-test',action='store_true')\n a=p.parse_args()\n root=Path(a.workspace).resolve()\n if a.self_test:\n assert permitted(root/'proof.txt',root)\n assert not permitted(Path.home(),root)\n assert not permitted(root.parent/'outside.txt',root)\n assert not permitted(root,root)\n variable_target=Path.home()\n assert not permitted(variable_target,root)\n print('GUARD PASS: inside allowed; profile, variable-derived profile, outside, workspace root denied; no deletion executed')\n else:\n if not a.target:p.error('--target required')\n allowed=permitted(a.target,a.workspace)\n print(('ALLOW' if allowed else 'DENY')+': resolved boundary; dry-run only')\n raise SystemExit(0 if allowed else 2)\nif __name__=='__main__':main()\n", "filename": "workspace_guard.py", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R002", "name": "restore_drill.py", "type": "py", "purpose": "Working resource used by this Build; inspect before running.", "contents": "# VERSION HISTORY\n# 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: learner resource.\n\"\"\"Backup and restore a new proof file only; never edits an existing file or profile.\"\"\"\nimport argparse,hashlib,json,logging\nfrom datetime import datetime,timezone\nfrom pathlib import Path\nimport shutil\ndef digest(p):return hashlib.sha256(p.read_bytes()).hexdigest()\ndef main():\n a=argparse.ArgumentParser(description=__doc__)\n a.add_argument('--backup-root',required=True)\n a.add_argument('--work-root',default='practice')\n x=a.parse_args()\n run=datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%S%fZ')\n work=Path(x.work_root).resolve()/('restore-'+run)\n backup=Path(x.backup_root).resolve()/('restore-'+run)\n if work==backup or work in backup.parents or backup in work.parents:raise SystemExit('Use separate, non-overlapping work and backup roots')\n work.mkdir(parents=True,exist_ok=False);backup.mkdir(parents=True,exist_ok=False)\n logging.basicConfig(filename=work/'drill.log',encoding='utf-8',level=logging.INFO)\n source=work/'proof.txt';source.write_text('BuildBotsBetter restore proof '+run,encoding='utf-8')\n shutil.copy2(source,backup/'proof.txt')\n restored=work/'restored.txt';shutil.copy2(backup/'proof.txt',restored)\n assert digest(source)==digest(restored)\n receipt={'result':'RESTORE PASS','source_sha256':digest(source),'restored_sha256':digest(restored),'backup_root':str(backup),'off_volume':work.anchor.lower()!=backup.anchor.lower(),'scope':'new proof file only; does not establish a scheduled profile backup'}\n (work/'receipt.json').write_text(json.dumps(receipt,indent=2),encoding='utf-8')\n logging.info('Proof backup and hash-verified restore completed')\n print(json.dumps(receipt,indent=2))\n if not receipt['off_volume']:print('SAME VOLUME: practice passed; configure a second drive for disaster recovery')\nif __name__=='__main__':main()\n", "filename": "restore_drill.py", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R003", "name": "onboarding-checklist.md", "type": "md", "purpose": "Working resource used by this Build; inspect before running.", "contents": "# Repeatable agent onboarding\nagent:\ntool version:\nrules file:\nmemory/settings location:\nassigned workspace:\npermissions / actions needing approval:\nhook location and protocol:\nguard active (harmless command + denied dry-run):\nvariable-derived path limit understood:\nbackup destination (second drive):\nbackup schedule / last successful run:\nrestored memory file / matching SHA256:\nfinal task / evidence / reviewer:\n\nProtect memory/settings and project files. A prompt rule is not an operating-system boundary.\nA command-text hook can miss a path computed in a script or variable. Resolve paths at the\noperation boundary and fail closed; keep independent backups and monitoring.\nWindows System Restore reverts system components, not a reliable personal-file backup.\nOneDrive folder backup does not automatically include hidden agent folders.\nmacOS: check Time Machine includes hidden agent folders. Linux: Timeshift excludes /home by\ndefault; use a separate home backup or explicitly include it.\n", "filename": "onboarding-checklist.md", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R004", "name": "profile-backup.ps1", "type": "ps1", "purpose": "Working resource used by this Build; inspect before running.", "contents": "# VERSION HISTORY\n# 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: copy-only explicit profile backup.\nparam([Parameter(Mandatory=$true)][string]$Destination,[string]$ProjectPath=(Get-Location).Path)\n$ErrorActionPreference='Stop'\n$destRoot=[IO.Path]::GetFullPath($Destination)\n$profileRoot=[IO.Path]::GetFullPath($env:USERPROFILE)\nif ([IO.Path]::GetPathRoot($destRoot) -eq [IO.Path]::GetPathRoot($profileRoot)) { throw 'Choose a backup destination on a second drive.' }\nif (-not (Test-Path -LiteralPath ([IO.Path]::GetPathRoot($destRoot)))) { throw 'Backup drive is unavailable.' }\n$runDir=Join-Path $destRoot (Get-Date -Format 'yyyyMMdd-HHmmss-fff')\nNew-Item -ItemType Directory -Path $runDir -ErrorAction Stop | Out-Null\nforeach ($folderName in @('.codex','.claude','.grok','.qwen','.gemini')) {\n $sourceDir=Join-Path $profileRoot $folderName\n if (Test-Path -LiteralPath $sourceDir) {\n $copyDir=Join-Path $runDir $folderName\n & robocopy $sourceDir $copyDir /E /XJ /R:1 /W:1 /COPY:DAT /DCOPY:DAT /NP\n if ($LASTEXITCODE -ge 8) { throw \"Backup failed for $folderName (robocopy $LASTEXITCODE).\" }\n }\n}\n$projectSource=[IO.Path]::GetFullPath($ProjectPath)\nif (-not (Test-Path -LiteralPath $projectSource -PathType Container)) { throw 'Project directory is unavailable.' }\n& robocopy $projectSource (Join-Path $runDir 'project') /E /XJ /R:1 /W:1 /COPY:DAT /DCOPY:DAT /NP\nif ($LASTEXITCODE -ge 8) { throw \"Project backup failed (robocopy $LASTEXITCODE).\" }\n\"PROFILE BACKUP PASS: $runDir\"\n# Copy-only: no /MIR, /PURGE or deletion. Backup may contain credentials; protect the drive.\n# Add the Grok Bot profile and project path explicitly after finding them in your own installation.\n", "filename": "profile-backup.ps1", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R005", "name": "profile-backup.sh", "type": "sh", "purpose": "Working resource used by this Build; inspect before running.", "contents": "#!/usr/bin/env bash\n# VERSION HISTORY\n# 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: copy-only explicit profile backup.\nset -euo pipefail\ndest=${1:?Pass a mounted external-drive backup directory}\nproject=${2:-$PWD}\nmkdir -p \"$dest\"\nif [ \"$(df -P \"$HOME\" | tail -1 | awk '{print $1}')\" = \"$(df -P \"$dest\" | tail -1 | awk '{print $1}')\" ]; then\n echo 'Choose a destination on another mounted filesystem.' >&2; exit 2\nfi\nrun=\"$dest/$(date -u +%Y%m%dT%H%M%SZ)-$$\"\nmkdir \"$run\"\nfor name in .codex .claude .grok .qwen .gemini; do\n if [ -d \"$HOME/$name\" ]; then cp -pR \"$HOME/$name\" \"$run/$name\"; fi\ndone\nif [ ! -d \"$project\" ]; then echo 'Project directory is unavailable.' >&2; exit 2; fi\ncp -pR \"$project\" \"$run/project\"\necho \"PROFILE BACKUP PASS: $run\"\n# This backup can contain credentials; protect access to the backup drive.\n", "filename": "profile-backup.sh", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R006", "name": "practice.sql", "type": "sql", "purpose": "Working resource used by this Build; inspect before running.", "contents": "-- VERSION HISTORY\n-- 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: session-local SQL practice; no server configuration changes.\nSET NOCOUNT ON;\nCREATE TABLE #bbb_tasks (task_id int NOT NULL PRIMARY KEY, title nvarchar(100) NOT NULL, done bit NOT NULL DEFAULT 0);\nINSERT #bbb_tasks(task_id,title) VALUES (1,N'Verify a connection'),(2,N'Back up a practice database');\nUPDATE #bbb_tasks SET done=1 WHERE task_id=1;\nSELECT task_id,title,done FROM #bbb_tasks ORDER BY task_id;\nIF (SELECT COUNT(*) FROM #bbb_tasks)<>2 THROW 50000,'Unexpected row count',1;\nPRINT 'SQL PRACTICE PASS: 2 rows, one completed';\n", "filename": "practice.sql", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R007", "name": "backup-restore.sql", "type": "sql", "purpose": "Working resource used by this Build; inspect before running.", "contents": "-- VERSION HISTORY\n-- 2026-10-05 EDT | chatgpt_codex | overnight-catalog | v1: administrator-reviewed learner-only practice commands.\n-- Run only on your disposable practice SQL instance, with DBA authorization.\n-- Create BBBPractice in SSMS first. Use the instance default backup directory shown in Server Properties.\nBACKUP DATABASE [BBBPractice] TO DISK=N'BBBPractice-full.bak' WITH COPY_ONLY, CHECKSUM, INIT;\nRESTORE VERIFYONLY FROM DISK=N'BBBPractice-full.bak' WITH CHECKSUM;\nRESTORE FILELISTONLY FROM DISK=N'BBBPractice-full.bak';\n-- A verified .bak is not a restore drill. In SSMS Restore Database, select the backup,\n-- choose destination BBBPracticeRestored, and relocate data/log files to unique paths.\n-- Never choose WITH REPLACE or restore over your live database.\n-- Then connect to BBBPracticeRestored and compare your practice table row count.\n", "filename": "backup-restore.sql", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" }, { "resource_id": "R008", "name": "connection-checklist.md", "type": "md", "purpose": "Working resource used by this Build; inspect before running.", "contents": "# SQL connection checklist\nEdition and version:\nInstance name (default or named SQLEXPRESS):\nAuthentication: your least-privilege login, never another agent/admin fallback.\nSSMS connection success:\nSELECT @@VERSION result:\nDriver / certificate settings:\nPractice query results:\nBackup checksum verified:\nDistinct restored database row count:\nExpress has no SQL Server Agent: choose a reviewed external scheduler for backups.\n", "filename": "connection-checklist.md", "generated_from": "BUILD_SPEC.json.resources", "version": "2.0" } ], "bot_coach": { "bot_name": "Buzz", "bot_role": "Offline reviewed step coach", "personality": "patient and concrete", "tone": "plain", "teaching_style": "hint, diagnostic, action, checkpoint", "introduction": "Ask about the current step. I use reviewed local answers and queue unknown questions for review.", "encouragement_style": "Focus on observed results.", "troubleshooting_style": "Ask for the smallest reproducible evidence.", "limits": "This offline coach does not call an LLM or inspect your computer. Unknown questions enter a local exportable review queue, not a shared SQL FAQ." }, "coach_interaction_model": { "stuck": "current diagnostic and first repair", "meaning": "current explanation", "error": "current troubleshooting", "why": "purpose", "skip": "require equivalent evidence", "alternative": "documented alternative", "finished": "record actual output", "start_over": "export then reset only this Build", "progressive_assistance": [ "hint", "diagnostic", "walkthrough", "resource solution" ] }, "website_specification": { "layout": "Lesson outline, actionable step, current-context coach", "features": [ "platform selectors", "command copy with selection fallback", "evidence checklist", "practical quiz", "downloadable resource ZIP", "local progress", "evidence export", "unknown-question review queue" ], "checkpoint_model": "Learner supplies observations/output; tokens check expected shape only, not host truth.", "navigation": "Browse freely; checked next-button progression retains evidence.", "video": "spec-driven walkthrough and optional speech; full rendered media is a downstream production task." }, "final_test": { "test_name": "Repeat the core workflow and restore its evidence", "instructions": "Repeat the last product-specific checkpoint from a fresh practice input, preserve actual output, then complete the Build Bot Better guard and restore checks. Export the evidence.", "required_inputs": [ "workspace_guard.py", "restore_drill.py", "onboarding-checklist.md", "practice.sql", "backup-restore.sql", "connection-checklist.md" ], "success_conditions": [ "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "Core output can be reproduced", "Guard limit explained", "Backup and restoration evidence retained" ], "automated_tests": "catalog_check.py records browser behavior and executable resources, with explicit scope.", "manual_tests": [ "Review actual account sign-in where needed", "Check source/data assumptions", "Restore one real non-secret memory file" ], "expected_output": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "failure_paths": "Use the specific step diagnostic, retain failure evidence and stop when access is required." }, "extensions": [ { "title": "Use your own input", "action": "Replace the sample with one permitted real input and rerun the same checks." }, { "title": "Add one failure case", "action": "Create a malformed or missing input; prove the workflow fails visibly and recovers." }, { "title": "Automate after review", "action": "Write a bounded schedule with logging and a stop condition; obtain approval for external actions separately." } ], "metadata": { "SEO_title": "Set Up SQL Server Express | BuildBotsBetter", "SEO_description": "A Windows SQL Server Express practice instance with a verified connection, session-local SQL exercise, least-privilege connection plan, checksum-verified backup and separate restored practice database.", "SEO_keywords": [ "setup-sql-server", "guided build", "verified outcome" ], "difficulty": "beginner", "related_builds": [ "dogfooding", "buildbotsbetter-onboarding" ], "next_recommended_build": "dogfooding" }, "automation_map": [ { "output": "website", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "walkthrough", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "bot dialogue", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "resources", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "quiz", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "captions", "generated_from": "BUILD_SPEC.json", "human_review_required": true }, { "output": "metadata", "generated_from": "BUILD_SPEC.json", "human_review_required": true } ], "quality_assurance_report": { "scope": "Original instructional content, reviewed against shared brief; execution and browser receipts are stored under logs/catalog-acceptance.", "known_limits": [ "SQL exercise can be tested under our own login on the existing host, but that does not prove a clean Express engine install.", "A Windows practice VM and administrator-provisioned identity are needed for a fully verified setup walk." ] }, "sources": [ { "title": "Microsoft SQL Server downloads", "url": "https://www.microsoft.com/en-us/sql-server/sql-server-downloads" }, { "title": "Current SQL Server edition features", "url": "https://learn.microsoft.com/en-us/sql/sql-server/editions-and-components-of-sql-server-2025?view=sql-server-ver17" }, { "title": "SQL Server Management Studio download", "url": "https://learn.microsoft.com/en-us/ssms/install/install" }, { "title": "SQL backup and restore", "url": "https://learn.microsoft.com/en-us/sql/relational-databases/backup-restore/back-up-and-restore-of-sql-server-databases" } ], "known_uncertainties": [ "SQL exercise can be tested under our own login on the existing host, but that does not prove a clean Express engine install.", "A Windows practice VM and administrator-provisioned identity are needed for a fully verified setup walk." ] }