How this repository is actually run. Not learner-facing — it lives here rather than in docs/ because it is operational, and it changes as the tooling does.

The account-ID check is the one to never weaken. It greps for any 12-digit number that is not the placeholder 123456789012. It has already caught a real leak.

1. modules/NN-topic/ with slides/ notebooks/ exercises/ solutions/ activities/ src/
2. A README.md matching the existing shape — objectives, concept table, ordered sequence, recording row, common mistakes, folder map, navigation
3. An LLD at docs/architecture/lld/NN-topic.md
4. Rows in the root README.md table, modules/README.md, and the relevant learning paths
5. A Field guide for this module section linking the relevant frameworks

Seven files; labctl verify enforces the two rules that matter.

python labs/runner/labctl.py verify          # references pass, starters fail, DAG acyclic
python labs/runner/labctl.py index --write   # regenerate the catalog table

Then mark it ✅ in PATHWAY.md. Full guide: CONTRIBUTING-A-LAB.md.

verify caught four real bugs in the labs' own reference solutions during authoring. Never bypass it.

Every practice thread needs a track, a level and a format label, and a row in the index.

Titles: <Topic> <N> · <what it teaches>. No day numbers, no cohort references, no schedule artefacts — discussions are a large part of how people find this repository, and those mean nothing in a search result.

Taxonomy and conventions: docs/DISCUSSIONS.md.

Three things have leaked before and are now checked:

Notebook outputs are committed on purpose — seeing expected output is part of the teaching. That is exactly why they leak. Before committing a notebook you ran:

grep -rlE '[0-9]{12}' --include='*.ipynb' .
grep -rl "$(whoami)" --include='*.ipynb' .

Discussions are not covered by CI. They were scrubbed by hand once, after a real account ID was found in a thread. Check any long paste before posting.

Save the rediscovery:

One secret, PROJECT_TOKEN, turns on two of the three boards. It is the only secret this repository needs, and the only maintenance it asks of you is a rotation when it expires.

Two dead ends, both worth remembering so they are not rediscovered:

• GITHUB_TOKEN — the token Actions provides automatically — has no access to Projects v2 at all.
• A fine-grained PAT has no permission that covers user-owned Projects. It works for organisation-owned projects; these boards belong to a user account, so it does not.

That leaves a classic PAT. Its project scope covers every project on the account and cannot be narrowed, which is exactly why the token carries no other scope and a short expiry.

gh secret list -R akash-coded/aws-bedrock-agentcore-strands

PROJECT_TOKEN should be listed. That proves the secret exists, not that the token behind it is still valid — for that, read the last run:

gh run view --log $(gh run list --workflow=pulse.yml --limit 1 --json databaseId --jq '.[0].databaseId') | grep -E "tracker board|pulse board|Boards not synced"

The run does not fail. The sync emits a warning annotation, the scoreboard still publishes, and only the two boards stop refreshing. That is deliberate: an expired token must never be able to take the scoreboard down with it.

So the failure is quiet. The signal to watch is a board whose rows have stopped moving while the Arena is still receiving submissions.

Two steps, about two minutes, and nothing to redeploy.

1. Generate a replacement at https://github.com/settings/tokens/new?scopes=project&description=aws-bedrock-agentcore-strands+board+sync — classic token, project scope only, 90 days. Copy it once.

2. Store it, pasting at the prompt so it never enters shell history:

   gh secret set PROJECT_TOKEN -R akash-coded/aws-bedrock-agentcore-strands

Then force a run rather than waiting six hours:

gh workflow run pulse.yml -R akash-coded/aws-bedrock-agentcore-strands

Never pass the value with --body, and never paste it into a file, an issue or a chat. If it is ever exposed, revoke it first and rotate second — revoking is instant and the boards degrade gracefully.

gh secret delete PROJECT_TOKEN -R akash-coded/aws-bedrock-agentcore-strands

Then delete the token itself under Settings → Developer settings → Tokens (classic). The workflow returns to scoreboard-only mode on its own, with a warning on each run.

No versions — this is teaching material, not a library. Instead:

1. Land the change with CI green
2. Add a CHANGELOG.md entry, calling out anything that breaks deep links
3. For anything learner-visible, add a section to the release notes discussion

Deep links matter more than usual here. People bookmark specific exercises and modules. Moving a file is a breaking change; say so.

Live at https://akash-coded.github.io/aws-bedrock-agentcore-strands/ · source in site/

The written companion is on this wiki, starting at The Agentic PDLC. When the tool changes substantively, the wiki pages are what need re-checking — they carry the same numbers.

• Is PROJECT_TOKEN still alive? Check the last Pulse & Scoreboard run for tracker board: N rows. If it says Boards not synced, rotate it — the run will not fail to tell you

• Freshness workflow result — any link rot?
• Open issues labelled aws-update
• Unanswered Q&A older than a week
• Dependabot alerts
• New discussions missing labels