Course-Wide Self-Check and Mastery

How to use this page

Complete the closed-book explanations and live tasks before reading the answer points below. Recognizing terms does not equal working independently. Real evidence of mastery is a runnable program, failing tests, run records, and an accurate account of remaining risk.

Closed-book explanations

1. Explain the distinct roles of the interpreter, virtual environment, pip, dependency declaration, and lock file.
2. Why cannot type hints replace runtime input validation? What problem does dataclass solve?
3. How do pure functions, I/O adapters, and dependency injection improve testability together?
4. Why should JSON parsing check byte size, encoding, syntax, root type, fields, and business constraints in that order?
5. Which failures may be retried? How do a per-call timeout and total deadline differ?
6. Why cannot results, stderr, logs, metrics, and traces be one text stream?
7. Where should mocks go? Why do you usually patch the location where a name is looked up?
8. What are concurrency, parallelism, a concurrency cap, and a rate limit?
9. Are pyproject.toml, a requirements file, and a lock file interchangeable?
10. After a model proposes a tool call, what validation and authorization must a Python application still perform?

Answer points

Write your own answers before expanding this section.

Checkpoints

1. The interpreter executes code; a virtual environment isolates its interpreter and packages; pip operates on distributions in the current environment; a declaration expresses direct needs and allowed ranges; a lock records one resolution.
2. Annotations do not enforce runtime types by default; dataclass generates boilerplate for data objects but does not validate untrusted input automatically.
3. Core calculation has no side effects, external I/O is concentrated in small boundaries, and dependencies are injected through parameters or protocols so tests can pass fakes.
4. Each layer addresses a different failure. Rejecting earlier controls resources, locates errors, and prevents dirty data from entering core logic.
5. Only operations explicitly classified as transient, repeatable, uncanceled, and still within the total budget; the total deadline includes retries and cleanup.
6. They serve consumers and stability requirements that differ; mixing them breaks machine parsing, leaks content, and lowers observability.
7. Mock external boundaries rather than core implementation; Python name binding determines which object the tested module actually calls.
8. Concurrency is temporal overlap; parallelism is simultaneous computation. A cap controls work in flight; a rate limit controls requests in a time window.
9. No. Project metadata, installation parameters or snapshots, and tool locking solve different problems.
10. After schema validation, still perform business validation, identity and resource authorization, least-privilege enforcement, approval, side-effect and idempotency controls, timeout handling, execution, and audit.

Live task A: reliable JSON CLI

In 90 minutes, implement this from an empty directory:

• Input is a UTF-8 JSON array; every item has id, text, and priority.
• id is unique; text is 1–500 Python characters; priority is an integer from 1–5 (do not accept Boolean values as integers).
• Input is at most 256 KiB.
• Output sorts by descending priority, then ascending id, without modifying the input.
• Stdout emits JSON; expected input errors go to stderr and return exit code 2.
• At least 10 tests cover boundaries, invalid types, duplicate IDs, the size limit, and determinism.

Then write RUNBOOK.md recording the Python version, run/test commands, side effects, unverified items, and how to delete output. Do not create .venv in this vault or add real credentials.

Acceptance evidence

• All tests run in a new temporary directory.
• Demonstrate one success and two distinct failure categories.
• Get-ChildItem -Recurse -Directory -Filter __pycache__ finds no cache generated by the task, or cache was removed only in the bounded temporary directory.
• State the definition used for sorting, character count, and maximum bytes.
• Prove repeat runs of the same input produce byte-for-byte identical stdout.

Live task B: turn a function into a tool boundary

Redesign an existing save_note(path, text) securely without connecting a model:

1. Permit writes only inside a workspace injected by a trusted application.
2. Let a model provide only a relative path and body.
3. Define filename extensions, path traversal, reparse/symlink risk, and a size limit.
4. Reject overwriting an existing file by default; overwriting needs separate authorization.
5. Offer a preview before writing; execute only after approval.
6. Define idempotency, timeout, atomic-write, cancellation, and audit semantics.
7. Test with a temporary directory; do not modify the real vault.

The point is contract and evidence, not claiming that Python user-space checks provide an absolute security sandbox.

Diagnostic questions

1. A package installed successfully but import fails

In order, give at least four read-only checks. They must include sys.executable, python -m pip --version, the difference between an import name and a distribution name, and a same-named file in the current working directory that shadows the package.

2. An async batch occasionally hangs

List possible evidence: blocking synchronous calls, no lower-level timeout, swallowed cancellation, unbounded task creation, awaiting while holding a lock, or a thread function still running. State which one you would measure first rather than simply increasing concurrency.

3. An API key appears in a log

Immediately stop further propagation; establish which logs, backups, and downstream systems received it; revoke and rotate the credential; handle logs and Git history according to authorization; and fix the cause with structured field allowlists. A new .gitignore or string masking cannot prove the risk is gone.

Analyze these counterexamples

Judge and correct each statement:

• “There are type hints, so JSON must be safe.”
• “Just retry every 5xx three times.”
• “asyncio automatically parallelizes CPU computation.”
• “100% coverage proves tool behavior is correct.”
• “A stricter tool description means permission checks are unnecessary.”
• “pip freeze is complete project metadata and a cross-platform lock file.”

Final mastery standard

I can complete independently

• In Windows 11 and PowerShell 7, I can create, locate, and rebuild a venv + pip environment and explain when to use uv.
• I can express boundaries with functions, modules, type hints, and data classes while validating untrusted data at runtime.
• I can reliably read and write small data with pathlib, explicit UTF-8, and json.
• I can design specific exceptions, total deadlines, bounded retries, and resource cleanup.
• I can keep configuration, secrets, user output, and diagnostic logs separate.
• I can use unittest to cover success, boundaries, and failures, using fakes or mocks appropriately.
• I can implement bounded async concurrency when required and propagate cancellation correctly.
• I can design a testable CLI and Agent tool-function contract.

I can state the boundary

• I will not claim that local Python 3.11 testing proves Python 3.14 verification.
• I will not claim that a standard-library demonstration verifies a real SDK, network, permissions system, or production recovery.
• I can list supply-chain, deployment, monitoring, model-evaluation, and governance issues the examples do not cover.
• When an API is version-sensitive, I check current official documentation and the project’s supported range.

If you cannot independently demonstrate three or more items, return to the relevant lesson and redo its exercise instead of stacking more framework APIs.

Next steps

• Return to the Python Fundamentals index and use the upstream course selectively to fill gaps.
• Continue with API and the JSON course to extend local-function boundaries into interprocess contracts.
• Then take Tool Calling; do not skip its authorization and execution layers.

References

This page consolidates exercises and mastery criteria from the route. Version-sensitive facts and individual API sources appear in the respective lessons. Retrieved on 2026-07-14.