Fix two Level 2 scoring holes and the PR template's deploy command

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,14 +1,14 @@
 ## What I built
-- Bicep entry template: `main.bicep` (params, `@secure()`, module call, outputs)
-- Storage module: `modules/storage.bicep` (storage account + nested blob container)
+- Bicep entry template: `main.bicep` (params incl. `environment`, `@secure()`, module call, outputs)
+- Storage module: `modules/storage.bicep` (storage account + nested `raw` and `curated` containers, Environment tag)
 - Deploy evidence: `docs/deploy_succeeded.txt`, `docs/what_if.txt`, `docs/portal_confirm.md`
 - Teammate write-up: `WRITEUP.md`
 - AI usage: `AI_ASSIST.md`
 - (Optional) extras under `docs/optional/`
 
 ## How to review
-- Bicep: read `main.bicep` and `modules/storage.bicep` (param / output / `@secure()` / module / nested container).
-- Evidence: `docs/deploy_succeeded.txt` shows `Succeeded`; `docs/what_if.txt` is real CLI output; `docs/portal_confirm.md` names the account + container.
+- Bicep: read `main.bicep` and `modules/storage.bicep` (param / output / `@secure()` / module / both nested containers).
+- Evidence: `docs/deploy_succeeded.txt` shows `Succeeded`; `docs/what_if.txt` is real CLI output; `docs/portal_confirm.md` names the account, both containers, and the teardown line.
 - Write-ups: `WRITEUP.md` and `AI_ASSIST.md`.
 
 ## How to run
@@ -21,21 +21,23 @@ az bicep version || az bicep install
 bash .hyf/test.sh
 ```
 
-Deploy (example — use your own globally unique storage name and never commit the secure value):
+Deploy (example: use your own globally unique storage name and never commit the secure value).
+This is the post-Task-1 shape; drop `environment=dev` if you have not added that parameter yet,
+because Azure rejects a parameter the template does not declare:
 
 ```bash
 az deployment group create \
   --resource-group "$CLASS_RG" \
   --template-file main.bicep \
-  --parameters storageName=<unique-name> dummySecret=not-a-real-secret
+  --parameters storageName=<unique-name> environment=dev dbAdminPassword=not-a-real-secret
 ```
 
 Prerequisite: you can write into `$CLASS_RG` with the HYF student IaC role.
 
 ## What reviewers should see (expected results)
 Fill in what your deploy actually produced:
 - Storage account name: <e.g. sthyfjane01>
-- Blob container name: <e.g. raw>
+- Blob container names: <e.g. raw and curated>
 - `provisioningState` in `docs/deploy_succeeded.txt`: <e.g. Succeeded>
 - `bash .hyf/test.sh` score: <e.g. 100 / 100, pass=true>
 - Teardown: <e.g. deleted account (and nested container) after evidence captured>
@@ -46,7 +48,7 @@ Fill in what your deploy actually produced:
 
 ## Self-check
 - [ ] `bash .hyf/test.sh` passes
-- [ ] Storage account **and** nested blob container exist(ed) in `$CLASS_RG`
+- [ ] Storage account **and** both nested blob containers (`raw`, `curated`) exist(ed) in `$CLASS_RG`
 - [ ] `@secure()` present; no credentials / `.env` / `*.parameters.json` committed
 - [ ] `docs/what_if.txt` is real CLI output (not a paraphrase)
-- [ ] Resources from this assignment were torn down (or blocked delete documented)
+- [ ] Resources from this assignment were torn down, and `docs/portal_confirm.md` records it (or documents the blocked delete)

.hyf/test.sh

@@ -50,12 +50,12 @@ score=$((score + l1))
 pass "Level 1: required files ($l1/20 pts)"
 
 # ── Level 2 (35 pts): Ch4 baseline kept + extensions ────────────────────────
-# Baseline (20): @secure, module, storageAccounts, ≥1 nested container.
-# Extensions (15→20 listed): environment param (5) + tags wiring (5) + curated (10).
-# Point math: 20+5+5+10=40 raw; curated is the 10-pt extension and L2 caps at 35
-# by awarding baseline container as required-fail without double-counting past 35:
-#   awarded = @secure5 + module5 + storage5 + container5 + env5 + tags5 + curated10
-#   then min(l2, 35). Fresh starter scores 20/35 (baseline only).
+# Baseline (20): @secure 5 + module 5 + storageAccounts 5 + >=1 nested container 5.
+# Extensions (15): environment param 5 + tags wiring 5 + curated container 5.
+# 20 + 15 = 35 exactly, so there is no cap. That matters: an earlier version
+# awarded 40 raw into a 35 cap, which meant dropping any single baseline check
+# cost zero points (a tree with no @secure() still scored 35/35 and 100/100).
+# Every check below is now load-bearing. Fresh starter scores 20/35 (baseline).
 l2=0
 main="$REPO_ROOT/main.bicep"
 mod="$REPO_ROOT/modules/storage.bicep"
@@ -115,22 +115,21 @@ if [[ "${#bicep_sources[@]}" -gt 0 ]]; then
   if grep -qhE "['\"]curated['\"]" "${bicep_sources[@]}" 2>/dev/null; then
     has_curated=true
   fi
-  if [[ "$container_count" -ge 2 ]] || [[ "$has_curated" == true ]]; then
-    l2=$((l2 + 10)); pass "second nested container (curated) present"
+  # Both conditions required. The string alone used to be enough, so a comment
+  # like `// TODO: add a container named 'curated'` bought the full extension.
+  if [[ "$container_count" -ge 2 ]] && [[ "$has_curated" == true ]]; then
+    l2=$((l2 + 5)); pass "second nested container (curated) present"
   else
     fail "need a second nested container named curated (keep raw; Task 2)"
   fi
 
   if [[ "$container_count" -lt 2 ]]; then
     warn "only $container_count nested container resource(s) — Task 2 expects raw + curated (count >= 2)"
+  elif [[ "$has_curated" != true ]]; then
+    warn "found $container_count containers but none named curated — Task 2 asks for raw + curated"
   fi
 fi
 
-# Raw check sum can be 40; L2 bucket is 35.
-if [[ "$l2" -gt 35 ]]; then
-  l2=35
-fi
-
 score=$((score + l2))
 pass "Level 2: Bicep baseline + extensions ($l2/35 pts)"
 

docs/portal_confirm.md

@@ -2,3 +2,7 @@
 
 <!-- Two or three sentences: resource names you saw in $CLASS_RG, and that the
      Deployments blade showed Succeeded. Do not paste secrets. -->
+
+<!-- Task 3 step 4: after you capture the evidence above, tear down and record it here,
+     e.g. `Teardown: deleted sthyf<yourname> (and both containers) on 2026-05-14.`
+     If your role blocked the delete, say so and name who you asked. -->