rootnode-academy/docs/ROOT_CURRICULUM_INVENTORY.md

ROOT_ Curriculum Inventory

Phase 6A §1 — a factual inventory of what already exists in this repository, gathered by inspecting scenarios/data/, scenarios/bundles/, scenarios/rootnode-path.json, assessment_definitions (013_assessments.sql), programs (019_programs.sql), achievements, and the curriculum/progress APIs — before any Phase 6A design work happened. Nothing here was modified to produce this document.

1. The current program model

One program exists: root-kubernetes-foundations (programs table, family root, delivery_mode = self_paced, curriculum_path = rootnode-path, completion_assessment_id = rootnode-capstone). init/compile families are supported by the schema's CHECK constraint but have zero seeded programs — no init_/compile_ curriculum exists anywhere in this repository.

2. scenarios/rootnode-path.json — the existing stage structure

The one curriculum path that exists, "RootNode Learning Path," version 1, with 7 stages:

Stage	Scenario count	Completion rule
foundation	20	all_required
workloads	8	all_required
networking	2	all_required
configuration	5	all_required
troubleshooting	5	all_required
real-ops (bundle rootnode-real-ops)	4	all_required
capstone (type capstone)	0 (references rootnode-capstone)	unlocks when all 6 content stages above are complete

44 of the repository's 98 total scenarios are wired into this path. The remaining 54 exist as real, working scenario content but are not referenced by rootnode-path.json at all — see §4.

3. scenarios/bundles/ — exam-prep bundle groupings

Five bundles exist (1-k8s-basics, 2-k8s-appdev, 3-k8s-admin, 4-k8s-security, rootnode-real-ops), each a flat list of scenario ids used for CKS-style exam-prep grouping in the existing Practice area — overlapping by design (a scenario can appear in more than one bundle). These are unrelated to rootnode-path.json's stages and untouched by Phase 6A.

4. Full scenario inventory

For every scenario in scenarios/data/ (98 total): id, title, category, difficulty, task vs. MCQ, which bundle(s) it's in, which rootnode-path.json stage (if any) it's wired into, whether it appears in the rootnode-capstone or rootnode-quick-assessment assessment_definitions pool_spec, and whether it's RootNode-authored or generic upstream content.

Only 3 scenarios are RootNode-specific (rootnode-runaway-monitor, rootnode-probe-port-mismatch, rootnode-enforce-limits) — every other scenario, including all 44 wired into rootnode-path.json, is generic upstream Kubernetes/CKS content. This matters for Phase 6A's course design: the "gold-standard module" spec explicitly asked for a RootNode- authored incident as the lab, which narrows the real choice to those 3 (plus broken-deployment, generic but already framed as an incident in the real-ops stage).

Scenario ID	Title	Category	Difficulty	Type	Bundles	Path Stage	In Assessment	Origin
annotate-resource-basics	Annotating Kubernetes Resources	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
broken-deployment	Debug a Failing Deployment	Troubleshooting	Medium	task	3-k8s-admin, rootnode-real-ops	real-ops	capstone, quick-assessment	generic upstream
cks-apparmor-profile	AppArmor Profiles	Workload Security	Hard	task	4-k8s-security	—	—	generic upstream
cks-audit-policy	Write a Kubernetes Audit Policy	Cluster Setup	Hard	task	4-k8s-security	—	—	generic upstream
cks-automount-token	Disable ServiceAccount Token	Workload Security	Easy	task	4-k8s-security	—	—	generic upstream
cks-drop-capabilities	Drop Linux Capabilities	Workload Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-egress-namespace	Restrict Egress to Namespace	Network Security	Hard	task	4-k8s-security	—	—	generic upstream
cks-image-pull-secret	Private Registry Image Pull Secret	Supply Chain Security	Easy	task	4-k8s-security	—	—	generic upstream
cks-immutable-secret	Immutable Secrets	Cluster Security	Easy	task	4-k8s-security	—	—	generic upstream
cks-mcq-api-server	API Server Authentication	Cluster Setup	Easy	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-audit-policy	Kubernetes Audit Logging Levels	Cluster Setup	Medium	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-image-footprint	Minimizing Image Footprint	Supply Chain Security	Easy	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-kubelet-auth	Securing the Kubelet	Cluster Setup	Medium	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-psp-replacement	Pod Security Evolution	Cluster Security	Easy	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-runtime-security	Runtime Security Tools	System Hardening	Medium	mcq	4-k8s-security	—	—	generic upstream
cks-mcq-sandboxing	Container Runtime Sandboxing	System Hardening	Hard	mcq	4-k8s-security	—	—	generic upstream
cks-network-policy	Default Deny Network Policy	Network Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-network-policy-metadata	Block Cloud Metadata	Network Security	Hard	task	4-k8s-security	—	—	generic upstream
cks-non-root-enforce	Enforce Non-Root Container	Workload Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-pod-security-context	Pod Security Context	Workload Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-psa-namespace	Pod Security Admission	Cluster Security	Easy	task	4-k8s-security	—	—	generic upstream
cks-rbac-clusterrole	Cluster-Level RBAC	Cluster Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-rbac-least-privilege	RBAC Least Privilege	Cluster Security	Medium	task	4-k8s-security	—	—	generic upstream
cks-readonly-filesystem	Read-Only Root Filesystem	Workload Security	Easy	task	4-k8s-security	—	—	generic upstream
cks-runtime-class	RuntimeClass for Sandboxed Workloads	System Hardening	Medium	task	4-k8s-security	—	—	generic upstream
cks-seccomp-profile	Seccomp Profiles	Workload Security	Hard	task	4-k8s-security	—	—	generic upstream
cks-tls-ingress	Secure Ingress with TLS	Network Security	Hard	task	4-k8s-security	—	—	generic upstream
cluster-upgrade-mcq	Cluster Upgrade Order	Cluster Administration	Hard	mcq	3-k8s-admin	—	—	generic upstream
configmap-volume	Mount ConfigMap as Volume	Configuration	Medium	task	1-k8s-basics, 2-k8s-appdev	configuration	—	generic upstream
container-logging-mcq	Container Logging and Monitoring	Troubleshooting	Easy	mcq	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
crashloop-fix	Fix a CrashLoopBackOff Pod	Troubleshooting	Medium	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
cronjob-task	Create a CronJob	Workloads & Scheduling	Easy	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
daemonset-mcq	Understanding DaemonSets	Workloads	Easy	mcq	1-k8s-basics	workloads	quick-assessment	generic upstream
delete-by-label-basics	Bulk Deletion by Label	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
deploy-nginx	Deploy and Expose Nginx	Workloads	Easy	task	1-k8s-basics, 2-k8s-appdev	workloads	capstone, quick-assessment	generic upstream
deployment-rollback	Rolling Back a Deployment	Workloads & Scheduling	Easy	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
deployment-strategy-mcq	Deployment Update Strategies	Workloads	Medium	mcq	1-k8s-basics	workloads	—	generic upstream
dns-resolution-mcq	Kubernetes DNS Resolution	Services & Networking	Easy	mcq	3-k8s-admin	—	—	generic upstream
dry-run-manifest-basics	Generating YAML Manifests	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
edit-deployment-basics	Updating Deployments	Workloads	Easy	task	1-k8s-basics	workloads	capstone	generic upstream
emptydir-pod	Shared emptyDir Volume Between Containers	Storage	Easy	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
endpoint-fix-task	Fix a Broken Service Selector	Troubleshooting	Medium	task	3-k8s-admin	—	—	generic upstream
env-vars-configmap	Environment Variables from ConfigMap	Configuration	Easy	task	1-k8s-basics, 2-k8s-appdev	configuration	capstone	generic upstream
etcd-backup-mcq	etcd Backup and Restore	Cluster Administration	Hard	mcq	3-k8s-admin	—	—	generic upstream
exec-command-basics	Execute Commands in Pods	Troubleshooting	Easy	task	1-k8s-basics	troubleshooting	capstone, quick-assessment	generic upstream
expose-service-basics	Exposing an Application	Services & Networking	Easy	task	1-k8s-basics	networking	quick-assessment	generic upstream
extract-logs-basics	Extract Container Logs	Troubleshooting	Easy	task	1-k8s-basics	troubleshooting	capstone, quick-assessment	generic upstream
field-selector-basics	Filtering Resources with Field Selectors	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
ingress-task	Create an Ingress Resource	Services & Networking	Medium	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
init-container-task-basics	Pod with Init Container	Core Concepts	Medium	task	1-k8s-basics	foundation	—	generic upstream
init-containers-mcq	Init Containers Behaviour	Core Concepts	Easy	mcq	1-k8s-basics	foundation	—	generic upstream
job-task	Create a One-Shot Job	Workloads & Scheduling	Easy	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
jobs-cronjobs-mcq	Jobs vs CronJobs	Workloads	Easy	mcq	1-k8s-basics	workloads	—	generic upstream
jsonpath-basics	JSONPath Data Extraction	Core Concepts	Medium	task	1-k8s-basics	foundation	—	generic upstream
kubectl-cp-basics	Copy Files to Containers	Troubleshooting	Medium	task	1-k8s-basics	troubleshooting	capstone, quick-assessment	generic upstream
kubectl-diff-basics	Previewing Changes with kubectl diff	Core Concepts	Medium	task	1-k8s-basics	foundation	—	generic upstream
kubectl-essentials-mcq	Essential kubectl Commands	Core Concepts	Easy	mcq	1-k8s-basics, 2-k8s-appdev	foundation	—	generic upstream
kubectl-explain-basics	Exploring the API with kubectl explain	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
kubectl-output-format-mcq	kubectl Output Formats	Core Concepts	Easy	mcq	1-k8s-basics	foundation	—	generic upstream
kubectl-patch-basics	Patching Resources with kubectl patch	Core Concepts	Medium	task	1-k8s-basics	foundation	—	generic upstream
labels-selectors-mcq	Labels and Selectors	Core Concepts	Easy	mcq	1-k8s-basics, 2-k8s-appdev	foundation	—	generic upstream
limitrange-task	LimitRange for Default Container Limits	Workloads & Scheduling	Medium	task	3-k8s-admin	—	—	generic upstream
liveness-probe-task	Configure a Liveness Probe	Workloads	Medium	task	1-k8s-basics, 2-k8s-appdev	workloads	capstone, quick-assessment	generic upstream
multi-container-pod-basics	Create a Multi-Container Pod	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
namespaces-basics	Working with Namespaces	Core Concepts	Easy	task	1-k8s-basics, 2-k8s-appdev	foundation	—	generic upstream
network-policy	Isolate Traffic with NetworkPolicy	Networking	Hard	task	3-k8s-admin	—	—	generic upstream
networkpolicy-egress	Egress NetworkPolicy	Security	Hard	task	3-k8s-admin	—	—	generic upstream
node-cordon-basics	Cordoning and Uncordoning a Node	Cluster Management	Easy	task	1-k8s-basics	troubleshooting	capstone, quick-assessment	generic upstream
node-label-selector	Node Labels and nodeSelector	Cluster Administration	Easy	task	3-k8s-admin	—	—	generic upstream
node-taint-toleration	Taints and Tolerations	Cluster Administration	Medium	task	3-k8s-admin	—	—	generic upstream
nodeport-task	Expose a Deployment via NodePort	Services & Networking	Easy	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
pod-affinity-mcq	Pod Affinity vs Anti-Affinity	Workloads & Scheduling	Medium	mcq	3-k8s-admin	—	—	generic upstream
pod-basics-mcq	Pod Lifecycle States	Core Concepts	Easy	mcq	1-k8s-basics, 2-k8s-appdev	foundation	—	generic upstream
pod-disruption-budget-task	Configure a PodDisruptionBudget	Cluster Administration	Medium	task	3-k8s-admin	—	—	generic upstream
pod-env-vars-inline	Pod with Inline Environment Variables	Configuration	Easy	task	1-k8s-basics	configuration	—	generic upstream
pod-labeling-basics	Labelling Resources	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
pod-node-assignment-mcq	Assigning Pods to Nodes	Scheduling	Medium	mcq	1-k8s-basics	troubleshooting	—	generic upstream
pod-security-context	Pod Security Context	Security	Medium	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
priority-class-task	Pod Priority and PriorityClass	Workloads & Scheduling	Medium	task	3-k8s-admin	—	—	generic upstream
pv-pvc-mount	Persistent Storage with PV and PVC	Storage	Medium	task	3-k8s-admin	—	—	generic upstream
pvc-dynamic-task	Dynamic PVC Provisioning	Storage	Medium	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
rbac-clusterrole	ClusterRole and ClusterRoleBinding	Cluster Administration	Medium	task	3-k8s-admin	—	—	generic upstream
rbac-role	RBAC: Create Role and RoleBinding	Security	Hard	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
readiness-probe-task	Configure a Readiness Probe	Workloads & Scheduling	Medium	task	2-k8s-appdev, 3-k8s-admin	—	—	generic upstream
resource-limits-task	Resource Requests and Limits	Configuration	Easy	task	1-k8s-basics, 2-k8s-appdev	configuration	capstone	generic upstream
resource-quota-ns	ResourceQuota for a Namespace	Cluster Administration	Medium	task	3-k8s-admin	—	—	generic upstream
restart-policy-mcq	Pod Restart Policies	Core Concepts	Easy	mcq	1-k8s-basics	foundation	—	generic upstream
rolling-update-task	Perform a Rolling Update	Workloads	Easy	task	1-k8s-basics, 2-k8s-appdev	workloads	capstone, quick-assessment	generic upstream
rootnode-enforce-limits	Stop the Next Outage: Enforce Resource Defaults	Observability & Ops	Hard	task	rootnode-real-ops	real-ops	capstone, quick-assessment	RootNode-specific
rootnode-probe-port-mismatch	Stuck Not-Ready: The Probe Port Mismatch	Observability & Ops	Medium	task	rootnode-real-ops	real-ops	capstone, quick-assessment	RootNode-specific
rootnode-runaway-monitor	Recover the Monitoring Stack	Observability & Ops	Medium	task	rootnode-real-ops	real-ops	capstone, quick-assessment	RootNode-specific
scale-deployment	Scaling a Deployment	Workloads	Easy	task	1-k8s-basics, 2-k8s-appdev	workloads	capstone, quick-assessment	generic upstream
secrets-basics	Creating and Using Secrets	Configuration	Easy	task	1-k8s-basics, 2-k8s-appdev	configuration	capstone	generic upstream
serviceaccount-pod	ServiceAccount for Pod API Access	Cluster Administration	Medium	task	3-k8s-admin	—	—	generic upstream
services-mcq	Kubernetes Service Types	Networking	Easy	mcq	1-k8s-basics, 2-k8s-appdev	networking	quick-assessment	generic upstream
sort-by-basics	Sorting kubectl Output	Core Concepts	Easy	task	1-k8s-basics	foundation	—	generic upstream
static-pods-mcq	Static Pods in Kubernetes	Core Concepts	Medium	mcq	1-k8s-basics	foundation	—	generic upstream
storageclass-mcq	StorageClass Reclaim Policies	Storage	Easy	mcq	3-k8s-admin	—	—	generic upstream

5. Unused content bank, grouped for future ROOT_ modules

The 54 scenarios with no Path Stage above, grouped by category — a real, working content bank ROOT 07/08/09/10 can draw on in Phase 6B, not content that needs to be invented:

• Workload Security (7): cks-apparmor-profile, cks-automount-token, cks-drop-capabilities, cks-non-root-enforce, cks-pod-security-context, cks-readonly-filesystem, cks-seccomp-profile
• Cluster Setup (4): cks-audit-policy, cks-mcq-api-server, cks-mcq-audit-policy, cks-mcq-kubelet-auth
• Network Security (4): cks-egress-namespace, cks-network-policy-metadata, cks-network-policy, cks-tls-ingress
• Supply Chain Security (2): cks-image-pull-secret, cks-mcq-image-footprint
• Cluster Security (5): cks-immutable-secret, cks-mcq-psp-replacement, cks-psa-namespace, cks-rbac-clusterrole, cks-rbac-least-privilege
• System Hardening (3): cks-mcq-runtime-security, cks-mcq-sandboxing, cks-runtime-class
• Cluster Administration (8): cluster-upgrade-mcq, etcd-backup-mcq, node-label-selector, node-taint-toleration, pod-disruption-budget-task, rbac-clusterrole, resource-quota-ns, serviceaccount-pod
• Troubleshooting (3): container-logging-mcq, crashloop-fix, endpoint-fix-task
• Workloads & Scheduling (7): cronjob-task, deployment-rollback, job-task, limitrange-task, pod-affinity-mcq, priority-class-task, readiness-probe-task
• Services & Networking (3): dns-resolution-mcq, ingress-task, nodeport-task
• Storage (4): emptydir-pod, pv-pvc-mount, pvc-dynamic-task, storageclass-mcq
• Networking (1): network-policy
• Security (3): networkpolicy-egress, pod-security-context, rbac-role

6. Other existing systems inspected

• Assessment definitions (assessment_definitions): rootnode-capstone (90 min, hint_policy flagged, required = the 4 real-ops scenarios, random draw across workloads/config/ troubleshooting) and rootnode-quick-assessment (60 min exam, fully random draw). Both real, both working, neither touched by Phase 6A — the new capstone course activity references rootnode-capstone by id only.
• Achievements (achievements): 4 types already implemented — stage_completed, curriculum_completed, assessment_completed, capstone_completed. Phase 6A's auto_assessment completion behavior reads assessment_completed/capstone_completed rows by metadata->>'assessment_definition_id' — no new achievement type needed.
  • Progress/attempt model (progress, scenario_attempts): unchanged. progress is what curriculum-rules.js and the new auto_scenario completion behavior both read.
• Curriculum APIs: curriculum.js loads scenarios/bundles/path from disk into an in-process cache; curriculum-rules.js computes stage lock/completion/percent purely from that path + a progress map. Phase 6A's course-progress.js follows the identical shape one level higher (course/module/activity instead of stage/scenario).
• Self-paced dashboard (ProgramsTab.jsx) and classroom dashboard (ClassroomTab.jsx, admin ClassroomView.jsx): both currently show curriculum STATE (percent, next scenario) with no notion of lessons/modules — Phase 6A's CourseView.jsx/CurriculumView.jsx add that layer alongside, not instead of, these.
• Admin curriculum/program tooling (admin-learning-routes.js, admin-programs-routes.js): read-only scenario/stage views and program/enrollment CRUD; no course/module concept existed before this phase.

7. What this inventory rules out

• No init_/compile_ curriculum content exists anywhere — confirmed by a full scan of scenarios/data/, not an assumption.
• No DevOps/CI/CD/IaC/GitOps scenario content exists (ROOT 11 is necessarily 100% PLANNED).
• No Linux-fundamentals, Git, or Docker-specific scenario content exists (ROOT 01-04 are necessarily 100% PLANNED) — everything in scenarios/data/ is Kubernetes/CKS content.

8. Phase 6B update — scenario coverage after curriculum authoring

Phase 6B wired 44 more of the scenarios above into structured curriculum (verified by direct query against module_activities.scenario_id, not estimated): 88 of 98 scenarios (89.8%) are now in structured curriculum, up from 44 at the end of Phase 6A. The remaining 10 — cluster-upgrade-mcq, etcd-backup-mcq (ROOT 11 territory), 7 CKS-style MCQs classified as future ASSESSMENT BANK material, and readiness-probe-task (a genuine, documented gap for Phase 6C) — are listed with their specific reasons in docs/PHASE6B_ROOT_CURRICULUM_EXPANSION.md §5. The full course-by-course mapping, including which scenarios were classified CORE/GUIDED/INDEPENDENT/ADVANCED/ASSESSMENT-BANK and why, lives in docs/ROOT_CURRICULUM_COVERAGE_MATRIX.md — this file is intentionally not duplicated there.