Lab 15 · Capstone · Career-Bridge Portfolio

Kavitha — who audited the triage classifier in lab-01 — is interviewing again, and the market has changed shape around her. Nobody is hiring "closed 40 tickets a day." Desks are hiring the person who can run, verify and govern support AI, and interviews for that role ask for evidence, not adjectives. This capstone builds the evidence in three moves: a public portfolio of the artifacts the preceding labs already produced, a cloud migration that proves the sysadmin-to-cloud bridge is load-bearing, and a resume that makes the whole track legible to a recruiter in thirty seconds.

Two verification gates are seeded into this lab. The AI-drafted Terraform below contains three defects of exactly the classes lab-06 taught you to catch — find them before anything deploys. And the AI-rewritten resume bullets contain fabrications of the kind that end interviews — find those too, because the fastest way to lose the AI-era credibility you just built is one invented metric under a recruiter's follow-up question.

Time & tier

~90 minutes hands-on · Advanced tier (maps to module M8). $0–2 — GitHub free, an Azure free account or AWS free tier (the resources below stay inside free allowances if torn down after; set a budget alert first), any free AI chat, Terraform CLI (free).

Setup

The migration target: your lab-13 measurement workbook logic, moved from a hand-run spreadsheet to a tiny cloud job — a storage bucket/account holding the monthly bot export, and a scheduled function that computes strict deflection and writes the reconciliation summary. Small enough for a free tier, real enough to demonstrate the bridge.

Save the AI-drafted infrastructure as deflection-infra.tf — this is the draft "a colleague's AI" produced. Review before any apply:

provider "azurerm" { features {} }

resource "azurerm_resource_group" "rg" {
  name     = "rg-deflection-metrics"
  location = "East US"
}

resource "azurerm_storage_account" "sa" {
  name                     = "deflectionmetrics01"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  allow_nested_items_to_be_public = true
}

resource "azurerm_storage_container" "exports" {
  name                  = "bot-exports"
  storage_account_name  = azurerm_storage_account.sa.name
  container_access_type = "blob"
}

resource "azurerm_role_assignment" "func_role" {
  scope                = azurerm_resource_group.rg.id
  role_definition_name = "Owner"
  principal_id         = var.function_principal_id
}

variable "storage_key" {
  default = "DefaultEndpointsProtocol=https;AccountKey=k8Xp2..."
}

output "connection" { value = var.storage_key }

And the AI's rewrite of three resume bullets as resume-draft.txt, produced from your actual lab history:

ORIGINAL: Completed hands-on labs building and evaluating a
local RAG chatbot over a support KB; measured deflection
honestly on simulated data; wrote a governance pack.

AI REWRITE:
- Architected and deployed an enterprise RAG platform serving
  5,000+ users, improving resolution time by 40%
- Led AI governance for the organization, authoring policy
  adopted company-wide and ensuring full DPDP compliance
- Reduced ticket volume 68% through AI-driven deflection
  across portal and Teams channels

Guided steps

1. 1Structure the portfolio repo. Create a public GitHub repo (support-ai-portfolio or similar) with one directory per artifact: the lab-10 pilot report, lab-11 code + design note, lab-12 eval sheets and taxonomy report, lab-13 workbook + CIO memo, lab-14 governance pack. Write a root README that tells the story in ten lines: what each artifact proves, in hiring-manager language ("evaluated a RAG system against a 40-question golden set and attributed every failure to its layer").
2. 2Run the sanitization sweep before pushing. Grep every artifact for things that must not go public: real names from your actual workplace, client identifiers, tenant URLs, any credential or key, and — easy to miss — prompt logs containing real ticket text. The synthetic lab data is publishable; anything you substituted from real work is not. Log the sweep and its findings in capstone-log.md. Expected output: at least the tenant URL from lab-10 and your test-tenant account emails needing redaction.
3. 3Review the Terraform like a lab-06 script. Before any deploy, run the six-gate review on deflection-infra.tf. Three defects are planted, in three different classes. List them in capstone-log.md with: line, what goes wrong, the fix. Do not deploy until all three are fixed — and note the exact parallel to the lab-06 PowerShell gates as you go; that parallel is the bridge skill, and it belongs in an interview answer.
4. 4Fix, plan, deploy, verify. Correct the file (public access off, least-privilege role scoped to the storage account, secret out of the file and outputs — use an environment variable or key vault reference, and mark outputs sensitive). Run terraform plan and read it — the plan is IaC's -WhatIf, and the discipline is identical: review, then sign, then apply. Deploy, upload the lab-13 export file, and verify in the portal that the container is private and the role assignment is scoped. Screenshot the verification for the repo.
5. 5Wire the computation. A minimal function or scheduled script (AI-drafted, you-reviewed) that reads the export and writes strict-deflection-summary.json with the staircase numbers from lab-13. Run it once, commit the code and output. Expected output: the cloud job reproduces your lab-13 numbers exactly — a computation that silently drifts from the hand-built workbook fails verification.
6. 6Tear down and document.terraform destroy, confirm in the portal, and write the runbook page: what was deployed, cost incurred (should be ~$0), how to redeploy. An interviewer who asks "what did it cost?" is testing whether you actually ran it; the runbook is your receipt.
7. 7Audit the resume rewrite. Take resume-draft.txt and mark every claim as: evidenced (an artifact in your repo backs it), inflated (kernel of truth, wrong scale or verb), or fabricated (no basis). All three AI bullets fail — identify precisely how, then rewrite each into a bullet that is both honest and strong, pointing at the portfolio ("built and evaluated," "on simulated data," with the repo link). The honest version is more hireable, because every claim survives a follow-up question.
8. 8Finish the resume and close the loop. Rewrite your full resume's experience section around the track's actual skills — verification gates, sampling audits, honest measurement, governance authorship, the cloud migration — each bullet mapped to a repo artifact. Then the final entry in capstone-log.md: the three interview answers this portfolio now backs ("tell me about a time you caught an AI being wrong" has, at this point, at least eight true answers — pick your best three and write them down while they are fresh).

Verify

• •
  The public repo contains all five lab artifact sets plus a ten-line README in hiring-manager language.
• •
  capstone-log.md records the sanitization sweep with at least the expected redactions found.
• •
  All three Terraform defects are identified with line, consequence and fix — before first deploy.
• •
  The deployed job reproduces the lab-13 numbers exactly; portal verification of private access and scoped role is screenshotted; teardown is confirmed with the runbook written.
• •
  All three resume bullets are correctly classed with the specific fabrication named, and each honest rewrite links to an artifact.
• •
  The final resume maps every AI-related claim to a repo artifact, and three interview answers are written.

Self-grading rubric (pass = 7/10): all three IaC defects caught pre-deploy (0–3) · sanitization sweep documented with findings (0–1) · cloud job reproduces lab-13 numbers with verified private access (0–2) · all three resume fabrications caught and honestly rewritten (0–3) · README + interview answers complete (0–1).