Network skills validated against real devices. A student configures a live topology, and pyATS parses the device output to decide whether the objectives are actually met.
GitHub as the identity provider. Identity resolves at the edge and reaches the Worker as a header, so the application carries no authentication code.
One object per attempt. Objective progress, timing and lab context are written from several places at once, so the attempt needs serialized writes rather than eventual consistency.
Validation runs in a container: FastAPI driving the device console, pyATS parsing the output. Cloudflare reaches it outbound, with nothing exposed inbound.
Topologies provision per attempt on Cisco's free DevNet sandbox, so the platform works without owning lab hardware.