Kubestronaut / Current
KCNA
Current Use the associate-level cloud-native exam as the cheap, evidence-backed on-ramp into Kubernetes and CNCF fundamentals.
Evidence required to unlock certificate
A verifiable KCNA certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Kubestronaut / Locked
KCSA
Locked Build the associate-level security baseline needed before operating production Kubernetes workloads.
Evidence required to unlock certificate
A verifiable KCSA certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Depends on: KCNA
Kubestronaut / Locked
CKA
Locked Execution is delegated to the existing first-principles road engine at cka-vim-first-principles/; that engine owns the CKA lab sequence and evidence validation rather than duplicating it here.
Evidence required to unlock certificate
A verifiable CKA certificate ID or official result record, with the completed private road-engine journal and evidence at cka-vim-first-principles/ referenced as supporting proof; the credential remains supplemental to repository-level engineering evidence.
Depends on: KCSA
Kubestronaut / Locked
CKAD
Locked Add application-design and workload-development depth after the KCNA cloud-native foundation is proven, creating an early confidence win independent of CKA.
Evidence required to unlock certificate
A verifiable CKAD certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Depends on: KCNA
Kubestronaut / Locked
CKS
Locked Complete the advanced Kubernetes security credential on top of the CKA administration foundation; CNCF requires an ACTIVE CKA to sit CKS.
Evidence required to unlock certificate
A verifiable CKS certificate ID or official result record saved in the private evidence directory, with the associated security-lab notes or repository link; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Depends on: CKA
Systems foundations / Current
Modern C++ CPU tensor library
Current Build a deliberately small Tensor2D<float> library with contiguous row-major storage, shape and stride handling, elementwise addition, transpose, matrix multiplication, softmax, and RMSNorm.
Evidence required to unlock repository
A versioned repository containing a CMake-built Tensor2D<float> implementation with unit tests, Debug and Release builds, sanitizer output, NumPy or PyTorch correctness comparisons, and benchmark output across multiple matrix sizes.
Systems foundations / Locked
Optimized matmul report
Locked Explain the performance effects of loop ordering, cache blocking, compiler optimization, SIMD, and multithreading on the tensor library's matrix multiplication.
Evidence required to unlock benchmark-report
A versioned repository plus benchmark report comparing naive, loop-reordered, tiled, SIMD, and multithreaded matmul; the report names hardware and compiler, records runtime and GFLOP/s at multiple sizes, shows thread scaling and correctness, and explains the bottleneck behind each change.
Depends on: Modern C++ CPU tensor library
Systems foundations / Locked
Linux perf profiling study
Locked Use Linux perf and compiler output to locate the hot loop and connect cache, vectorization, and instruction-level evidence to the optimized CPU result.
Evidence required to unlock profiling-study
A repository-linked study with raw perf stat and perf record/report output plus an annotated assembly or flamegraph artifact for the matmul workload, including command lines, hardware and software context, baseline-versus-optimized measurements, and a causal explanation.
Depends on: Optimized matmul report
MLOps and GPU serving / Current
GPU Operator cluster
Current Operate a Kubernetes cluster with the GPU Operator, device plugin, monitoring components, and a reproducible GPU workload.
Evidence required to unlock repository-and-deployment-log
A versioned infrastructure repository with manifests or Helm values, successful GPU Operator installation evidence, kubectl output for driver, device-plugin, and DCGM pods, and a reproducible workload log proving a scheduled GPU allocation.
MLOps and GPU serving / Locked
Autoscaled model serving deployment
Locked Deploy a model-serving workload on the GPU cluster and make scaling respond to measured demand rather than a fixed replica count.
Evidence required to unlock deployment-and-load-test
A versioned deployment repository and reproducible load-test report showing the model endpoint scaling on GPU-utilization or queue/request metrics, with workload details, replica transitions, throughput, TTFT, TPOT, and p99 latency recorded.
Depends on: GPU Operator cluster
MLOps and GPU serving / Locked
Observability and cost-per-token dashboard
Locked Make serving behavior legible by connecting request metrics, token counts, GPU utilization, and accelerator cost in one operational view.
Evidence required to unlock dashboard-definition-and-export
A versioned dashboard definition and exported view that joins request, GPU-utilization, token-count, and accelerator-cost data to show throughput, TTFT, TPOT, p99, utilization, and cost per output token, with query and reproduction instructions.
Depends on: Autoscaled model serving deployment
MLOps and GPU serving / Locked
Model CI/CD
Locked Automate model artifact validation, image or package publication, staged serving rollout, and a tested rollback path.
Evidence required to unlock ci-workflow-and-rollout-log
A versioned CI workflow with model checksum or immutable version checks, correctness and smoke tests, reproducible image or package build, staging deployment evidence, and a demonstrated rollback or promotion record without embedded secrets.
Depends on: Autoscaled model serving deployment
Inference infrastructure / Current
CUDA kernel ladder
Current Implement and measure vector add, reduction, tiled matmul, softmax, and RMSNorm kernels from first principles before relying on higher-level kernel DSLs.
Evidence required to unlock repository-and-profiler-traces
A versioned CUDA repository containing vector-add, reduction, matmul, softmax, and RMSNorm kernels with correctness tests across multiple shapes, warmup and repeated measurements, and profiler traces that classify each result as compute-, memory-, synchronization-, or launch-bound.
Inference infrastructure / Locked
Quantization and KV-cache study
Locked Measure the bridge-role vocabulary across FP8 and INT4 weight and activation quantization, AWQ and GPTQ, paged attention, KV-cache management, and chunked prefill.
Evidence required to unlock repository-quantization-and-serving-study
A repository-linked study using a named model and hardware that measures accuracy delta against a reference, memory footprint, and throughput change across FP8 and INT4 weight/activation quantization, with AWQ/GPTQ, paged attention, KV-cache management, and chunked prefill configurations; include reproducible commands.
Depends on: CUDA kernel ladder
Inference infrastructure / Locked
Non-trivial Triton kernel
Locked Build a non-trivial fused Triton kernel, such as RMSNorm plus quantization, and show where it wins and loses across realistic inputs.
Evidence required to unlock repository-benchmark-and-trace
A versioned Triton repository with reference-based correctness tests, a shape and dtype sweep covering batch and sequence variation, benchmark tables with named hardware and software versions, an exported profiler trace, and documented loss cases.
Depends on: CUDA kernel ladder
Inference infrastructure / Locked
vLLM or SGLang internals patch
Locked Change a real inference-runtime mechanism—such as scheduling, KV-cache allocation, batching, quantized execution, or CUDA-graph behavior—instead of only wrapping an endpoint.
Evidence required to unlock reviewable-runtime-patch
A reviewable commit or pull-request URL in a vLLM or SGLang fork that changes a real runtime path, with passing correctness or regression tests, a reproducible benchmark command, and a short explanation of the affected mechanism.
Depends on: Non-trivial Triton kernel
Inference infrastructure / Locked
Serving optimization report
Locked Prove an end-to-end serving improvement from a runtime or kernel change under a stated workload and realistic concurrency.
Evidence required to unlock before-after-serving-report
A repository-linked before-and-after load-test report naming hardware, model, workload, concurrency, warmup and repetition method, and exact commands; it must report TTFT, TPOT, output-token throughput, request throughput, p99 latency, memory use, and the causal bottleneck analysis.
Depends on: Quantization and KV-cache study
Inference infrastructure / Locked
Multi-GPU scaling-efficiency study
Locked Measure how distributed inference loses efficiency through collectives, topology, synchronization, or stragglers rather than reporting only aggregate throughput.
Evidence required to unlock scaling-study-and-traces
A repository-linked study with single- and multi-GPU measurements, an explicit scaling-efficiency calculation, per-rank NCCL or Nsight Systems traces, throughput and communication-overhead tables, hardware topology context, and reproducible commands.
Depends on: Serving optimization report
Inference infrastructure / Locked
Submitted upstream contribution
Locked Contribute a production-quality inference, kernel, compiler, or portability improvement and engage maintainer review; merge is a documented bonus, not an unlock condition.
Evidence required to unlock submitted-pull-request-with-review
A SUBMITTED upstream pull request URL with genuine review engagement: a documented maintainer response, review comments addressed, CI passing, and a reproducible performance or correctness result documented; a later merge may be recorded as a bonus but is not required for unlock.
Depends on: vLLM or SGLang internals patch