Azure Lab Engineering Standard

Every lab in this track builds a runnable, test-verified miniature of a real Azure mechanism — the deployment graph, the token flow, the RBAC evaluator, the NSG engine, the message broker — so the internals become muscle memory instead of portal folklore. You do not "deploy a VNet"; you build the engine that decides whether a packet is allowed. That is what makes the knowledge defensible in a principal interview and useful at 2 a.m.

Why miniatures (and not live Azure)

A live Azure subscription is non-deterministic, costs money, requires credentials, and hides the mechanism behind a REST API. A lab that reimplements the algorithm — NSG priority evaluation, longest-prefix routing, JWT validation, peek-lock redelivery, Durable replay — is offline, deterministic, free, and teaches the part interviewers actually probe. Each lab README ends with a "How this maps to real Azure" section that ties the miniature back to the production service, its limits, and its az/Terraform equivalent.

Required files (per lab)

File	Contract
`README.md`	the problem, what you build, key concepts table, file map, run commands, success criteria, "How this maps to real Azure", extensions, interview/resume bullets
`lab.py`	learner implementation with focused `# TODO` markers and signatures/docstrings already in place; never a blank file
`solution.py`	complete reference; `python solution.py` runs a worked example and prints output; deterministic
`test_lab.py`	positive, negative, boundary, and determinism tests; runnable against either module via `LAB_MODULE`
`requirements.txt`	usually `pytest` only — labs are pure stdlib otherwise

The runnable core is Python (stdlib + pytest), offline, deterministic. No network, no Azure SDK, no credentials, no Date.now()/random without a seed. Multi-language or real-az/Terraform work appears only as build specs in the README "Extensions" section for the learner's own subscription.

The test contract

import importlib, os
lab = importlib.import_module(os.environ.get("LAB_MODULE", "lab"))

Run both ways; both must pass:

pytest test_lab.py -v                       # against your lab.py
LAB_MODULE=solution pytest test_lab.py -v   # against the reference

Test taxonomy every flagship lab includes: happy path; malformed / out-of-range input (raises ValueError); deny-by-default / least-privilege behavior where identity or policy is involved; boundary cases (the off-by-one that interviewers probe — R+W>N strictness, NSG priority ties, lock-expiry exactly at the boundary, longest-prefix /32 vs /0); idempotency / replay / duplicate where the service guarantees it; and deterministic output (same input → same bytes).

The four teaching docs (per phase)

Every phase explains the same material through four lenses, because principal-level understanding is their intersection:

Document	Voice	What it gives you
`README.md`	the syllabus	why the phase exists, concept map, lab spec table, integrated-scenario ideas, deliverables checklist, key takeaways
`WARMUP.md`	the professor	zero-to-principal primer: every term from first principles → what it is → why it exists → how it works under the hood (mechanism, diagrams, small code/math) → production significance → common misconceptions; then a Lab Walkthrough, Success Criteria, Interview Q&A, and References (primary sources: Microsoft Learn, RFCs, ARM/Entra docs, talks)
`HITCHHIKERS-GUIDE.md`	the senior who's been there	compressed practitioner tour: 30-second mental model, the numbers to tattoo on your arm, `az`/Terraform one-liners, war stories, vocabulary, beginner mistakes
`BROTHER-TALK.md`	your brother, off the record	candid real-talk: what nobody tells you, the 2 a.m. pager truth, what's worth caring about, the career framing

Doc conventions (mdBook-compatible)

WARMUP.md opens with a Table of Contents of working anchor links, kept in sync with the headings.
MathJax for any math ($ … $ inline, $$ … $$ block). Standard Markdown only.
No bare angle brackets in prose — wrap <like-this> in backticks so mdBook does not eat them as HTML.
File references use relative links. Code fences are language-tagged.

Definition of done

A lab is complete only when: the reference suite passes (LAB_MODULE=solution), the learner lab.py passes after the TODOs are filled in, python solution.py prints a sensible worked example, the README's success criteria are testable, and the "How this maps to real Azure" section is accurate about the production service and its limits.

Principal Azure Cloud Engineer & Architect