The watcher

Properties: XIII Manage only what you declare
Goal: TODO
Done when: TODO
Restart from: lessons 7 and 12 and Fountain lesson 9 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 30 min

Watch

TODO: video

hands-on self-paced live

The desk on a schedule turns drift, expired grants and unused-access findings into reconcile and burndown PRs. One PR per finding. Declines stick under Rounds’ rules. The same weekday cron drives the rotation check from lesson 9.
At most five desk PRs are open at once. Five is a constant in access/baseline/, the watcher’s prompt says so, and the credential-free PR job counts open PRs carrying the desk marker and fails a sixth, so the cap holds when the prompt is ignored (decision 40).
Rounds as-is can enroll the repo for what its catalogs cover. The IAM projections use the same form.

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.