AZ-400 Source Audit — Source Control
The Git route provides a good conceptual start—branches, pull requests, review, and policy. Current evidence is thin for recovery, data removal, large-repository operations, and enforcing the strategy on both GitHub and Azure Repos.
| Official source bullet (paraphrased) | Inspected vault evidence | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger | |---|---|---|---|---|---|---|---| | Design trunk-based, feature-branch, and release-branch strategy | branching-strategy, github-flow, Git MOC | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add a scenario that selects a strategy from release cadence, compliance, and hotfix constraints. | Source effective date or product behavior changes. | | Implement PR workflow with branch policies/protection | pull-request, branch-protection, 1-git-enterprise-moc, az400-repository-protection-permissions-tags-lab | Dedicated lab configures GitHub and Azure Repos protection, verifies blocked and successful PR completion, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Implement branch-merge restrictions | branch-protection, az400-repository-protection-permissions-tags-lab | Dedicated lab requires review/status, blocks force/direct push, and scopes bypass decisions separately in both platforms | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Manage large files with Git LFS and git-fat | az400-git-lfs-and-recovery-lab | Lab tracks a disposable binary with LFS, inspects pointer/object behavior, breaks ordering safely, covers recovery boundaries, and cleans up; git-fat is explicitly historical context | Embedded configuration/diagnosis/distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute with a disposable remote and retain client/remote evidence before verified. | Source effective date or product behavior changes. | | Scale and optimize Git repository with Scalar and cross-repository sharing | git-repository-scaling, az400-git-recovery-removal-scale-lab | Dedicated lab records measurements, LFS/policy/Scalar decision, and shared-component alternatives | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Configure source-control repository permissions | azure-devops-security-groups, az400-repository-protection-permissions-tags-lab | Dedicated lab assigns least privilege, verifies allowed/denied actions in both platforms, and removes access | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Configure repository tags | semantic-versioning, az400-repository-protection-permissions-tags-lab | Dedicated lab creates/pushes annotated release tag, restricts tag creation, and verifies its reference | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Recover specific data with Git commands | git, az400-git-recovery-removal-scale-lab | Dedicated lab performs restore/revert/reflog recovery and distinguishes local from shared recovery | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. | | Remove specific data from source control | git, secret-scanning, az400-git-recovery-removal-scale-lab | Dedicated lab rewrites fake-secret history with coordination, force-update safeguards, and fresh-clone verification | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain platform evidence before verified. | Source effective date or product behavior changes. |
Audit result
0 missing, 0 thin, 0 covered, 9 verified. Every source-control row now has a dedicated route, source-linked procedure, safe failure, cleanup, and three practice modes. Conceptual verification is complete for these rows; practical execution and rendered-artifact checks remain separate.
Related
Source-to-Vault Audit · Git and source-control path · git · branch-protection · azure-devops-security-groups