Technical programme review · 27 July 2026

EG334SProgramme decisions & readiness record

A consolidated write-up of the 30-question TPM review, combining the team’s stated position with programme assessment and concrete next actions.

Programme snapshot

What the discussion established

30

Review questions

All questions have a recorded response, assessment and action.

11

Directions agreed

Clear ownership exists for cost, evidence and core controls.

8

Attention items

Most relate to continuity, rehearsal, evidence and teardown.

11

Open decisions

These need dates, owners or explicit team agreement.

Programme principle

A technically working system is not sufficient. It must also be explainable, observable, financially controlled, recoverable and safely decommissioned.

Immediate focus

Priority action register

These actions provide the highest protection for marks and demonstration continuity. They should take priority over new dashboard features.

P0

Agree what “done” means

Publish team acceptance criteria and identify one accountable final approver.

P0

Prove backup operation

Name a backup and complete a rehearsal without Bernard’s intervention.

P0

Reconcile dashboard facts

Correct stale IDs, hashes, costs, alarm statements, SSH wording and footer status.

P1

Rehearse the demonstration

Time the live path, degraded modes, Q&A and operator handoffs.

P1

Resolve publication access

Record the five-member decision on public report and deck access.

P1

Prepare verified closure

Inventory out-of-band resources and define teardown evidence before demo day.

Full record

All questions, answers and TPM actions

Open a review area to see the individual decisions. Status indicates whether the direction is agreed, still open, or requires immediate attention.

01 · OutcomesSuccess, acceptance and repeatabilityThe minimum outcome is clear: pass the assessment. The team still needs to agree the formal definition of done and prove that the environment is repeatable.3 items
01

What does successful delivery mean?

Decision open

Team position

Pass the exam.

TPM assessment

This is a valid primary outcome, but it should be converted into a measurable target with a safety margin above the minimum passing mark.

Required action

Confirm the passing threshold and decide whether the team is targeting minimum compliance or a 10–15 mark safety margin.

02

Which acceptance criteria are complete, and who accepts them?

Needs attention

Team position

To be determined during discussion with all team members.

TPM assessment

Acceptance criteria are pending team agreement. Until written and owned, the team cannot objectively declare the project ready.

Required action

Casper to lead a team discussion and publish a definition of done covering the system, report, presentations, demonstration and teardown.

03

What proves the system can be rebuilt from scratch?

Decision open

Team position

A controlled clean-rebuild rehearsal has been recommended.

TPM assessment

Current evidence proves the system has worked, but independent repeatability is not yet demonstrated.

Required action

A backup operator should rebuild using only the approved runbook, record start and finish times, capture deployment outputs, repeat all six tests and document every gap.

02 · PeopleOwnership and team readinessAccounts exist for all team members and section knowledge is reported as strong. Operational capability remains concentrated in Bernard.4 items
04

Who can operate the system if Bernard is unavailable?

Needs attention

Team position

Any team member could do so because accounts have been created for everyone.

TPM assessment

Account availability is necessary, but it does not prove permissions, knowledge or confidence. One named backup is required.

Required action

Nominate a primary backup operator and verify their AWS, Azure, GitHub and dashboard access from their own device.

05

Has Jeff performed the rebuild and demonstration?

Needs attention

Team position

No.

TPM assessment

The key-person mitigation is documented but untested. This remains a high delivery risk.

Required action

Complete a supervised walkthrough, followed by a rehearsal where Bernard remains silent and Jeff uses only the runbook.

06

What is the individual-presentation deadline?

Direction agreed

Team position

26 August 2026 at 6:30 PM SGT.

TPM assessment

The deadline leaves enough time, but it should not be treated as the working deadline because individual presentations carry 30% of each member’s grade.

Required action

Target outlines by 12 August, first drafts by 19 August, reviews by 22 August, final decks by 24 August and rehearsal on 25 August.

07

Can members defend their assigned report sections?

Decision open

Team position

Yes.

TPM assessment

This is positive, but readiness should be demonstrated through questions rather than self-declared.

Required action

Run a mock viva. Each member should explain one design decision, one failure and one trade-off without reading a script.

03 · DemonstrationAssessment-day readinessThe assessment is scheduled for 26 August. VPN #2 will be provisioned beforehand, but rehearsal timing, evidence selection and degraded-mode operation still need to be finalized.5 items
08

When is the assessed demonstration?

Decision open

Team position

26 August 2026 at 6:30 PM SGT.

TPM assessment

This date should drive the final rebuild, evidence refresh, configuration freeze and readiness review.

Required action

Confirm whether 6:30 PM is the live demonstration time or submission cutoff, and publish the final-day operating schedule.

09

When will VPN #2 be provisioned?

Decision open

Team position

Before the day of the demonstration on 26 August 2026.

TPM assessment

The intent is correct, but it needs a precise start time and recovery window.

Required action

Recommended: rebuild at 9:00 AM on 25 August, validate by 2:00 PM, capture fallback evidence and freeze optional changes that evening.

10

Can the demonstration continue if live services fail?

Decision open

Team position

A three-level contingency approach has been recommended.

TPM assessment

A dashboard failure must not become a project failure. Cloud consoles, tests and deployment records remain the authoritative evidence.

Required action

Prepare normal, dashboard-stale and cloud-unavailable modes. Keep a timestamped offline evidence pack on two laptops and never present cached evidence as live.

11

What evidence will be shown live?

Needs attention

Team position

Mainly ping tests between each site; the rest is still to be determined.

TPM assessment

Ping proves network reachability but not application operation, monitoring or repeatability.

Required action

Show tunnel state, both required ping paths, the VPN #2 HTTP request, the expected transitive-routing failure, alarm state and a brief view of IaC and teardown.

12

Has the full demonstration been timed?

Needs attention

Team position

Not yet.

TPM assessment

Timing is an open readiness risk, especially because the dashboard contains a large volume of material.

Required action

Run a technical rehearsal on 19 August, a full dress rehearsal on 24 August and a short confirmation run after VPN #2 is rebuilt.

04 · GovernanceTruth, accountability and release controlThe dashboard is an innovative presentation method. It needs a clear source-of-truth hierarchy and one accountable final approver.4 items
13

What is the authoritative source for project facts?

Direction agreed

Team position

The distinction between live sources and explanatory text was initially unclear.

TPM assessment

When two values conflict, the team needs a documented rule for deciding which one is trusted.

Required action

Use AWS and Azure APIs first, state.json and inventory.json second, deployment outputs and hashes third, and manually written text only for explanation.

14

Who signs off the dashboard before assessment?

Decision open

Team position

Everyone.

TPM assessment

Everyone can contribute to verification, but one person must be accountable for the final go/no-go decision.

Required action

Recommended RACI: Casper accountable, Bernard responsible for technical validation, each member responsible for their content, and Jeff as independent technical verifier.

15

Why use a dashboard as the single presentation surface?

Direction agreed

Team position

For ease of presentation and to try a new way of presenting.

TPM assessment

This is a strong rationale. The dashboard should make the presentation faster and clearer without amplifying outdated information.

Required action

Use a concise presentation view for status, tests, risks and outcomes, with detailed inventory and evidence in expandable sections or an appendix.

16

Is an automated pre-release consistency check required?

Direction agreed

Team position

Probably not; its purpose was questioned.

TPM assessment

Automation is optional. The control exists to catch outdated identifiers, hashes, costs and contradictory status statements before the exam.

Required action

Avoid gold-plating. Fix current issues and use a manual two-person pre-demo checklist if automation would distract from assessment preparation.

05 · Risk & securityPublication, exposure and continuityPublic accessibility and published identifiers are intentional. The team still needs collective agreement on pre-submission publication and a tested continuity arrangement.4 items
17

Has the team accepted the publication risk?

Needs attention

Team position

The project is still at an early stage and the decision has not been finalized.

TPM assessment

The risk is already active because the shared report is publicly downloadable before submission.

Required action

Discuss the issue with all five members, confirm institutional rules and temporarily protect the full report and deck until a collective decision is recorded.

18

Is public access to the hosting address intentional?

Decision open

Team position

Yes, so everyone can access it.

TPM assessment

Convenient access for team members and assessors is different from unrestricted access by anyone online.

Required action

Define whether 'everyone' means named participants or the public internet. Apply the same access policy to the custom and direct hosting addresses.

19

Are published IP addresses and identifiers necessary?

Direction agreed

Team position

Yes.

TPM assessment

Retaining them is reasonable as assessment evidence. They are not credentials, but exposure should be intentional and controlled.

Required action

Never publish keys, passwords, tokens or pre-shared keys. Keep SSH restricted to the administrative /32, expose only required ports and remove addresses during teardown.

20

What happens if Bernard’s laptop or sessions are unavailable?

Needs attention

Team position

A named backup-operator model has been recommended.

TPM assessment

Accounts exist, but continuity is not proven until another member succeeds from their own laptop without Bernard’s credentials.

Required action

Give the backup attributable access, keep runbooks on two devices and run a Bernard-unavailable exercise covering login, tests, refresh and teardown.

06 · FinOpsCost ownership and guardrailsBernard owns cost and budget management. The rebuild timing limits spend, but cost labels and the budget count must be reconciled.5 items
21

What is the authoritative fully deployed cost?

Direction agreed

Team position

The fully deployed environment will be activated before demonstration day.

TPM assessment

The dashboard’s figures describe different scopes. Azure is about $7.85/day; AWS list price is about $3.66/day; combined theoretical list price is about $11.51/day.

Required action

Label every figure by cloud, actual versus list price, deployed versus parked state and measurement date. Refresh rates before the demonstration.

22

Who owns cost management?

Direction agreed

Team position

Bernard.

TPM assessment

Ownership is clear. Approximately $0.44/day should be used as the current parked Azure estimate unless a fresh calculation supersedes it.

Required action

Refresh costs before the demonstration, confirm alert delivery, record rebuild and teardown times, and report final actual cost.

23

Who owns the budgets, and how many exist?

Decision open

Team position

Bernard owns them.

TPM assessment

The export documents two AWS budgets and one Azure budget. That is three, while the dashboard displays four.

Required action

Confirm whether a fourth budget exists. Otherwise change the dashboard to three. Cost Anomaly Detection is not a budget.

24

Who receives alerts, and when will teardown occur?

Decision open

Team position

Bernard owns the budgets. Teardown will occur once the demonstration has concluded.

TPM assessment

The trigger is sensible, but completion should be formally confirmed and independently verified.

Required action

Confirm that no further live demonstration is required, execute teardown immediately, verify all regions and check which of the two referenced email domains receives alerts.

25

Is there a maximum additional demonstration spend?

Decision open

Team position

No limit has been set.

TPM assessment

A cap creates a deliberate decision point if provisioning or troubleshooting runs longer than planned.

Required action

Recommended: expect $8–10 additional spend, warn at $15 and pause for review at $20 before continuing.

07 · ClosureTeardown, evidence and learningAssessors provide final acceptance, while the team must execute and independently verify teardown. The archive should demonstrate learning, not retain operational secrets.5 items
26

Who independently verifies decommissioning?

Decision open

Team position

The assessors.

TPM assessment

Assessors provide external acceptance, but they should not be the team’s first verification layer.

Required action

Bernard executes teardown, Jeff independently verifies, Casper signs off team completion and the assessors confirm compliance.

27

Which resources exist outside the main deployment lifecycle?

Needs attention

Team position

AWS resources.

TPM assessment

The platform is identified, but teardown needs an exact inventory of out-of-band resources.

Required action

List CloudWatch, CloudTrail, flow logs, S3, SNS, IAM/OIDC, budgets, addresses and customer gateways, plus Cloudflare and GitHub resources requiring a retention decision.

28

What evidence proves teardown occurred before the deadline?

Direction agreed

Team position

Log files.

TPM assessment

Logs are suitable only if they prove successful authentication and post-deletion inspection, not merely that delete commands were issued.

Required action

Record timestamps, accounts, regions, commands, results, zero-resource inventory, retained exceptions, final cost and a checksum. Failed queries must report ERROR, never PASS.

29

Who retains the final evidence pack?

Direction agreed

Team position

Bernard.

TPM assessment

Bernard can be the custodian, but the archive should not become another single point of failure.

Required action

Keep the authoritative archive with Bernard and a read-only backup with Casper. Exclude credentials and retain it through grading and any appeal period.

30

What should the project leave behind?

Direction agreed

Team position

Learning outcomes.

TPM assessment

The strongest outcome is not merely a working network, but an explainable, observable, controlled, recoverable and safely decommissioned system.

Required action

Capture learning across architecture, IaC, testing, observability, security, FinOps, reliability, governance, continuity and closure.

Recommended control dates

Path to assessment

  1. Presentation outlinesAll five individual structures agreed.
  2. First drafts + technical rehearsalFix access, commands and sequencing.
  3. Team reviewTechnical fact-check and mock viva.
  4. Dress rehearsalTimed end-to-end run with operator handoffs.
  5. VPN #2 rebuild and freezeValidate by 2:00 PM; capture fallback evidence.
  6. Assessment · 6:30 PM SGTFinal health check, demonstrate, confirm closure trigger.
  7. Decommission deadlineVerified teardown evidence complete before 11:59 PM SGT.

Conclusion

Protect the pass by proving operational readiness.

EG334S has credible architecture, unusually strong evidence and disciplined cost awareness. The work now shifts from building to controlling: agree acceptance criteria, remove contradictions, rehearse a backup operator, prove the demonstration path and prepare verified closure.

The strongest final message is not that two tunnels were built. It is that the team can explain the design, demonstrate the service, respond to failure, control cost and remove everything safely.