[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — four defensive mechanisms crammed into one 1224-word page

**File:** `workshop/side-quest-17-07-repo-poisoning.md`
**Overall Score:** `4.97 / 10.0` (corpus mean: `6.14`)

**Flagged Dimensions:**

| Dimension | Score | Benchmark | Delta |
|---|---|---|---|
| cognitive_load | 5.9 | 10 (≤800 words, ≤15 concepts) | -4.1 (1224 words, 23 new concepts) |
| active_learning | 2.7 | ≥3 activity density | -0.3 (density 0.82 vs 3.0 ideal) |
| checkpoint_quality | 0.0 | 10 (≥4 checklist items) | -10.0 (scorer defect — see Root Cause) |

**Flagged issue `concept_overload` confirmed:** the page introduces 23 new terms/concepts (repository poisoning, `contents: write`/`read`, `toolsets: [everything]`, `safe-outputs: create-pull-request`, `allowed-files`, `protected-files.exclude`, `protected-files.policy`, `network.allowed-domains`, CODEOWNERS, branch protection, etc.) in a single 1224-word side quest.

**Root Cause (≤ 2 sentences):**
The page bundles four distinct defensive mechanisms (read-only permissions, PR-gated writes, path restrictions, network allow-lists) plus a full attack narrative and two nested exercises into one continuous page, pushing new-concept count to 23 against the 15-concept ideal and word count to 1224 against the 800-word ideal. `checkpoint_quality` also reads 0.0 due to the same `## :white_check_mark: Checkpoint` vs. `## ✅ Checkpoint` scorer mismatch noted corpus-wide — the actual checkpoint has 6 well-formed items and should not be the content-fix target.

**Evidence (quoted from the file):**
> gh-aw gives you three layers to prevent repository poisoning.
>
> ### Declare read-only permissions
> ### Route writes through a pull request
> ### Restrict which paths can change
> ### Limit network destinations

**Learning Science Rationale:**
Sweller's Cognitive Load Theory predicts that presenting four independent defensive mechanisms — each with its own YAML syntax, its own rationale, and its own exercise-relevant vocabulary — in one uninterrupted pass exceeds working-memory capacity (typically 4±1 novel chunks), causing later mechanisms (network restrictions) to be under-processed relative to earlier ones (read-only permissions). Splitting related-but-separable concepts into smaller, sequential digestible units with recall checkpoints between them is the standard CLT mitigation (segmenting principle).

**Improvement Prompt (for an agent):**
```
Open workshop/side-quest-17-07-repo-poisoning.md. Split the "How AW Defends Against It" section (currently four sub-mechanisms: read-only permissions, pull-request routing, path restrictions, network restrictions) so learners get a brief formative check after the first two mechanisms before continuing to the last two — for example, add a short "Quick check" `` block after "Route writes through a pull request" that asks the learner to predict which of the two remaining defenses (path restriction vs. network restriction) would stop a specific mini-scenario, before revealing the answer. Trim redundant framing prose in "The Attack" and "Why This Matters" sections to bring total word count down toward 950-1050 words while keeping both exercises intact. Do not remove the existing Checkpoint section. Run `npx --yes markdownlint-cli2 "**/*.md"` after editing and fix any lint errors.
```

**Expected Score After Fix:** `6.3 / 10.0`

> Generated by [🔬 Curriculum Quality Evaluator](https://github.com/githubnext/gh-aw-workshop/actions/runs/35026063971) · copilot · auto · 76.1 AIC · ⌖ 8.13 AIC · ⊞ 9.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-workshop+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-workshop%2Fcurriculum-evaluator%22&type=issues)
> - [x] expires on Sep 16, 2026, 9:39 PM UTC

Open workshop/side-quest-17-07-repo-poisoning.md and read the “How AW Defends Against It,” “The Attack,” and “Why This Matters” sections. Add the requested formative check after the pull-request mechanism, trim redundant prose while keeping both exercises and the existing Checkpoint, then run npx --yes markdownlint-cli2 "**/*.md" and fix any lint errors.

Written by the indexing model from the issue text.