Restructure Instruqt assignments and add wrap-up resource chapter

This commit consolidates a top-level review pass over the eight chapter
assignment files plus a new ninth chapter, syncs the assignment text
with a TODO-numbering rework happening in `workshop-nexus-intro-code`,
and fixes a Semgrep finding in the image build workflow.

Assignment structure. Every chapter loses its `# Chapter N: ...` H1.
Instruqt was rendering the YAML `title:` as the page header and the
markdown H1 stacked underneath, producing the title twice on every
page. The H1 is gone now; the YAML title is the single source.

Section header rename. `## Why this chapter exists` (which read as
weak in the lab UI) is now `## What You're Solving` across all eight
chapters.

Solution tab moves to the rightmost position. In chapters 2-7 the
Solution tab was at index 1, immediately next to the Code Editor, and
attendees were misclicking and editing the finished file. Solution
now sits after every other tab (Worker terminals, Starter, Temporal
UI). Every `(tab-N)` button reference in those chapters was
renumbered to absorb the index shift. The "Stuck on a TODO" callouts
gained a "(rightmost)" pointer and were converted from `[!TIP]` to
`[!NOTE]` so Instruqt renders them as admonitions.

Wrap-up rename and knowledge-check removal. `## Wrapping up` is now
`## Key Takeaways` everywhere, and the trailing `> [!NOTE] Knowledge
check:` blockquotes have been dropped from every chapter. The
chapter-by-chapter quizzing role moves to the live AhaSlides deck;
the in-lab text now ends on a forward-looking summary instead of
unanswered questions.

"Stop the Worker" steps removed. Each chapter's per-challenge
`cleanup-workshop` already runs `pkill -f "payments.worker"` and
`pkill -f "compliance.worker"` between challenges, so the trailing
`## Step N: Stop the Worker(s)` step in chapters 1, 3, 4, 5, 6, 7,
and 8 was redundant busywork. Those steps are gone; the surviving
steps are still in correct numerical order.

TODO sub-letter sync with the code repo. The companion change in
`workshop-nexus-intro-code` rewrote exercise files to follow the
"strip exactly what the user is asked to write; one TODO per
insertion point; sub-letters when a logical step touches multiple
locations" standard documented in `tmp/lessons-learned.md`. The
assignment text mirrors that numbering:

- Ch 2: Step 1 now walks TODOs 1a (decorator), 1b
  (`check_compliance` Operation), 1c (`submit_review` Operation).
- Ch 3: Step 1 walks 2a (class decorator), 2b
  (`check_compliance` body), 2c (`submit_review` stub).
- Ch 4: Step 1 walks 4a (remove unused import), 4b (replace activity
  call with Nexus call). Step 2 walks 5a (worker import), 5b
  (Activities list).
- Ch 5: Step 2 walks 7a (convert handler) and 7b (delete dead
  import).
- Ch 6: Step 1 walks 10a (init state), 10b (run-method branching),
  10c (Update handler + validator). Step 2 walks 11a (`WorkflowHandle`
  import), 11b (`submit_review` body). Step 3 walks 12a/12b in
  `payments/workflows.py` and 12c/12d in `payments/worker.py` for the
  cross-file `ReviewCallerWorkflow` change.
- Ch 7: Step 1 walks 13a (top-level `nexusrpc` import) and 13b
  (failure-injection branches).

Code-Editor file path test. Chapter 2's Code Editor tab `path:` now
points at `…/exercise/shared/service.py` directly instead of the
chapter directory, to test whether Instruqt's `code` tab will open a
specific file by default. The Instruqt docs only describe `path:` as
a directory location, so this is a speculative experiment; if it
works, the same change will roll out to the chapters that have a
single primary edit target.

New chapter 09-what-next. Added a Multiple Choice (`type: quiz`)
challenge as the wrap-up after the polyglot demo. The body is a
resource page with links to docs.temporal.io/nexus, learn.temporal.io,
the per-language samples repos, the workshop's own code repo,
follow-up patterns we did not have time to teach (in-workflow
cancellation, `asyncio.shield`, Worker Versioning), and the
community channels. The single answer is "Do you plan on using
Nexus?" (Yes / No, both marked correct so the chapter passes either
way and the response captures intent without gating progress). The
old chapter-8 `> [!TIP] Where to go next` block was removed since
those links now live in the wrap-up chapter.

Loader-message tweak. `track.yml` line 33 dropped "the tardigrade"
from the rehydrating Ziggy message, matching the wording on the
other 30+ Ziggy lines.

Build workflow Semgrep fix. `.github/workflows/build-image.yml` was
flagged by Semgrep `yaml.github-actions.security.run-shell-injection`
for interpolating `${{ github.ref_name }}` and `${{ env.IMAGE }}`
directly into the `Compute image tags` shell script. The step now
binds `REF_NAME` via a step-level `env:` block and reads `IMAGE`
through its job-level env definition, so neither value is
string-substituted into the shell. Semantics are unchanged.

AhaSlides documentation tweak. `aha.md` updated to reflect that the
Pattern Roulette spinner (slide 5) is now skipped during
presentation. The slide remains in the deck (id 150153117) with
`skip_when_presenting=True`; downstream slide numbering is unchanged.

justfile. Added `slides-install`, `slides-dev`, and `slides-build`
recipes for the Slidev deck. The `slides/` directory itself is not
in this commit.

Author: MasonEgger

.github/workflows/build-image.yml

@@ -41,11 +41,13 @@ jobs:
 
       - name: Compute image tags
         id: tags
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          if [ "${{ github.ref_name }}" = "main" ]; then
-            echo "extra=${{ env.IMAGE }}:latest" >> "$GITHUB_OUTPUT"
+          if [ "$REF_NAME" = "main" ]; then
+            echo "extra=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
           else
-            echo "extra=${{ env.IMAGE }}:${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "extra=${IMAGE}:${REF_NAME}" >> "$GITHUB_OUTPUT"
           fi
 
       - uses: docker/build-push-action@v6

aha.md

@@ -44,15 +44,15 @@ For each chapter, the presenter:
 
 ## Slide-by-slide integration guide
 
-### Welcome block (Slides 1 to 5), maps to course-plan Welcome (9:00 to 9:05)
+### Welcome block (Slides 1 to 4), maps to course-plan Welcome (9:00 to 9:05)
 
 | # | Type | Title / Prompt | When to trigger |
 | :- | :--- | :------------- | :-------------- |
 | 1 | Title | "Introduction to Temporal Nexus" | Open with this while attendees join. Show the QR code so people can scan to join. |
 | 2 | Word cloud | "One word for cross-team Temporal integration today." | First interactive moment. Sets the room. Read 3 to 5 responses out loud and riff. |
 | 3 | Scale (1 to 5) | "How comfortable are you with Temporal Workflows, Activities, and Updates?" | Lets the presenter calibrate pace. If average is below 3, slow down on the first chapter. |
 | 4 | Poll | "Have you ever wrapped a teammate's Workflow in an HTTP API?" | Run after the "why are we here" framing. The "yes, and it broke" responses are gold for the cross-team pain hook. |
-| 5 | Spinner wheel | "Pattern Roulette: 8 scenarios, defend your choice." | Optional crowd activity. Spin 2 or 3 times, ask volunteers to defend their pick. Pure energy moment, not graded. |
+| ~~5~~ | ~~Spinner wheel~~ | ~~"Pattern Roulette"~~ | **Skipped during presentation.** Slide remains in the editor (id 150153117) but `skip_when_presenting=True`. Slide numbering downstream is unchanged. |
 
 ### Chapter 1 graded checkpoint (Slides 6 to 12), maps to course-plan Activity 1.4 (Comp 1 Performance Assessment)
 

instruqt/01-run-monolith/assignment.md

@@ -48,8 +48,6 @@ timelimit: 600
 enhanced_loading: false
 ---
 
-# Chapter 1: Run the Monolith
-
 Before you decouple anything, run the application as it ships today and
 feel where the seams are. This chapter is observation only. There is no
 code to edit.
@@ -60,7 +58,7 @@ code to edit.
 > From Chapter 2 on, the **Code Editor** opens the exercise and a
 > separate **Solution** tab shows the finished file.
 
-## Why this chapter exists
+## What You're Solving
 
 Every distributed-systems story has a "before" picture, and this is ours.
 
@@ -230,23 +228,7 @@ replace the Activity call with a **Nexus Operation** call: a typed
 remote-invocation primitive that runs in a different namespace, with a
 different worker, owned by a different team.
 
-## Step 4: Stop the Worker
-
-Back in the [button label="Worker" background="#444CE7"](tab-1)
-terminal, stop the Worker with `Ctrl+C` so it does not pollute the next
-chapter's task queue.
-
-```bash,run
-# Press Ctrl+C in the Worker terminal.
-```
-
-You can also stop it from the Starter terminal with:
-
-```bash,run
-pkill -f "payments.worker" || true
-```
-
-## Wrapping up
+## Key Takeaways
 
 In this chapter you ran the application as it exists before any Nexus
 work. Three transactions executed end-to-end through a single Worker
@@ -259,18 +241,3 @@ Python interface that the Payments and Compliance teams will share, and
 the Nexus Endpoint that will route calls between them. The contract
 itself is small, and Chapter 2 is largely about what it means and where
 it lives. The actual decoupling happens across Chapters 3 and 4.
-
-> [!NOTE]
-> Knowledge check (instructor-led in Live Event mode, self-check in
-> self-paced mode):
->
-> - The four Nexus building blocks are **Service**, **Operation**,
->   **Endpoint**, and **Registry**. Try to predict which of those you
->   will define in code, which on the server, and which by importing
->   shared types.
-> - The synchronous Nexus handler deadline is **10 seconds**. Anything
->   that needs more time runs as an asynchronous, workflow-backed
->   operation (Chapter 5).
-> - The asynchronous Schedule-to-Close ceiling on Temporal Cloud is
->   **60 days**. Plenty of room for a human-in-the-loop review
->   (Chapter 6).

instruqt/02-service-contract/assignment.md

@@ -28,12 +28,7 @@ tabs:
   title: Code Editor
   type: code
   hostname: workshop
-  path: /root/workshop/exercises/02_service_contract/exercise
-- id: mkyu8fxrz4kn
-  title: Solution
-  type: code
-  hostname: workshop
-  path: /root/workshop/exercises/02_service_contract/solution
+  path: /root/workshop/exercises/02_service_contract/exercise/shared/service.py
 - id: ystkhevci7d2
   title: Terminal
   type: terminal
@@ -44,19 +39,22 @@ tabs:
   type: service
   hostname: workshop
   port: 8233
+- id: mkyu8fxrz4kn
+  title: Solution
+  type: code
+  hostname: workshop
+  path: /root/workshop/exercises/02_service_contract/solution
 difficulty: basic
 timelimit: 1200
 enhanced_loading: false
 ---
 
-# Chapter 2: Define the Nexus Service Contract
-
 In this chapter you define the shared Nexus Service contract between the
 Payments and Compliance teams, and stand up the routing infrastructure
 that will carry calls across the team boundary: a Nexus Endpoint that
 points callers at the Compliance team's task queue.
 
-## Why this chapter exists
+## What You're Solving
 
 Nexus exists so that two teams can call each other's Temporal code
 without sharing a codebase or a namespace. The mechanism that makes that
@@ -96,43 +94,52 @@ reads first when they want to call your Service.
 
 ## What you will do
 
-- Apply **TODO 1** to add `@nexusrpc.service` and the typed Operation
-  declarations to `shared/service.py`.
+- Apply **TODOs 1a–1c** to add `@nexusrpc.service` and the typed
+  Operation declarations to `shared/service.py`.
 - Verify the two namespaces exist.
 - Create the `compliance-endpoint` Nexus Endpoint with the Temporal
   CLI, attaching a Markdown description from `compliance-endpoint.md`.
 - Find the Endpoint in the Web UI and read its Markdown description.
 
-> [!TIP]
-> Stuck on a TODO? The **Solution** tab shows the finished file. Try
-> the exercise first, then peek if you need to.
+> [!NOTE]
+> Stuck on a TODO? The **Solution** tab (rightmost) shows the finished
+> file. Try the exercise first, then peek if you need to.
 
-## Step 1: Apply TODO 1 in `shared/service.py`
+## Step 1: Apply TODOs 1a–1c in `shared/service.py`
 
 Open `shared/service.py` in the
 [button label="Code Editor" background="#444CE7"](tab-0). The file
-contains a class `ComplianceNexusService` with a `pass` body and a
-TODO 1 comment.
+contains an empty `ComplianceNexusService` class with three TODO
+markers.
+
+### TODO 1a: Decorate the class
 
-Three changes:
+Add `@nexusrpc.service` directly above the `class ComplianceNexusService:`
+line:
 
-1. Add `@nexusrpc.service` directly above the `class
-   ComplianceNexusService:` line.
-2. Replace the TODO 1 comment with the typed `check_compliance`
-   Operation:
+```python
+@nexusrpc.service
+class ComplianceNexusService:
+```
 
-   ```python
-   check_compliance: nexusrpc.Operation[ComplianceRequest, ComplianceResult]
-   ```
+### TODO 1b: Declare the `check_compliance` Operation
 
-3. Add the typed `submit_review` Operation directly below it:
+Inside the class body, add the typed Operation:
+
+```python
+check_compliance: nexusrpc.Operation[ComplianceRequest, ComplianceResult]
+```
 
-   ```python
-   submit_review: nexusrpc.Operation[ReviewRequest, ComplianceResult]
-   ```
+### TODO 1c: Declare the `submit_review` Operation
 
-You can remove the `pass` line. The class no longer needs it once the
-operations are declared.
+Directly below it, add:
+
+```python
+submit_review: nexusrpc.Operation[ReviewRequest, ComplianceResult]
+```
+
+You can remove the `pass` line once both operations are declared. The
+class no longer needs it.
 
 After your edits, the relevant block should look like:
 
@@ -168,7 +175,7 @@ environment with separate workflows, separate task queues, and separate
 access control. **Nexus is the only thing that crosses the boundary.**
 
 Both namespaces were created for you when the track started. Verify
-they exist. In the [button label="Terminal" background="#444CE7"](tab-2):
+they exist. In the [button label="Terminal" background="#444CE7"](tab-1):
 
 ```bash,run
 temporal operator namespace list
@@ -214,7 +221,7 @@ The `get` output should include the Markdown description from
 
 ## Step 4: Find the Endpoint in the Web UI
 
-Click the [button label="Temporal UI" background="#444CE7"](tab-3)
+Click the [button label="Temporal UI" background="#444CE7"](tab-2)
 tab. In the left navigation, click **Nexus Endpoints** (or browse to
 `/nexus/endpoints` directly).
 
@@ -227,7 +234,7 @@ exposes before writing a caller workflow against it.**
 The Endpoint exists at the cluster level. It is not scoped to any one
 namespace. That is what lets it bridge teams.
 
-## Wrapping up
+## Key Takeaways
 
 You wrote the contract that the Payments and Compliance teams will
 share, and you registered the routing rule that the dev server will use
@@ -246,13 +253,3 @@ Compliance Worker that polls the `compliance-risk` task queue.
 > take. The contract has no UI surface; it lives only in the Python
 > files both teams import. The Endpoint is the matching server-side
 > artifact, plus a description that documents what the contract does.
-
-> [!NOTE]
-> Knowledge check (instructor-led in Live Event mode, self-check in
-> self-paced mode):
->
-> - Where does the Service contract live, and which packages import it?
-> - Which artifact does the Web UI show: the Service class, the
->   Endpoint, or both?
-> - If you change the contract, do you need to restart the dev server
->   or just the Workers that import it?