Open [arena.cloudthinker.io](https://arena.cloudthinker.io) and enter the code your team was given under **Join your team**. The code is also on the slide.
The Arena home page: the rules of the day and the code field
The board carries every team, the running total and the clock. It is the same screen the room is watching.
The board, before the first round opens: one row per team
It lists the round, its length and the attempts you have left. It refuses a report until the organisers open the round, so nothing sent early is counted.
The round page: the editor, the versions and the attempts left
## Community share · 30 minutes
Three teams present a report from Day 01 or Day 02, ten minutes each, one from each city. They were chosen before the day, not volunteered on it, and the report is the artifact on screen. Watch how they use evidence rather than which service they found: that is what the judge reads from your team within the hour.
## Round 1 · Find the Gaps
**The task:** an unfamiliar cloud environment, 25 minutes, 30 points, and a board that updates in public as the scores land. Say what is worth fixing and prove it with evidence. Finding out what a good review looks like is part of the task.
| You can | You cannot |
| -------------------------------------------------------------- | ------------------------------------------------------ |
| Read resources, configuration and telemetry through the agent. | Change, restart, deploy, delete or reach into secrets. |
| Time | Step |
| ---- | -------------------------------------------------------------------------------------------------- |
| T+00 | Read the environment before you write anything. |
| T+05 | Agree the list. Five lenses is the frame, not a quota. |
| T+10 | Submit a first version and mark it final. The note is worth more than ten more minutes of writing. |
| T+18 | Aim the second version at what the first one missed. |
| T+23 | Stop writing. The round closes on the clock, not on a save. |
| Block | What it contains |
| ---------------------------- | ------------------------------------------------------------------------------------------------- |
| **01 · What you looked at** | The environment, the scope you reached, and what the role could not see. |
| **02 · What you would fix** | Each finding with its evidence and its label. Biggest impact first, one lens per finding at most. |
| **03 · What needs a person** | Which change needs an approval before anyone touches it, and what you dropped on purpose. |
```text theme={null}
Which of these is a real risk with evidence behind it, and which one only looks alarming? Show the raw output for each.
```
```text theme={null}
For the finding I am about to submit, give me the source, scope and time that prove it, and tell me what would make it wrong.
```
* **Everything looks fine.** Ask what is unusual here compared with a default environment, rather than what is broken.
* **The agent hands you a long list.** Ask which single item it would fix first, and what proves it. A list is not a finding.
* **The agent cannot read something.** That is a blocked scope line in block 01, and a good result.
## Round 2 · Find the Cause
**The task:** a customer is affected, 45 minutes, 70 points, and a board that will not tell you how you are doing. Build the causal chain from the symptom to the resource whose own configuration changed, then recommend the response.
| You can | You cannot |
| ------------------------------------------------------------------------ | ----------------------------------------------- |
| Read the symptom, the telemetry, the configuration history and the logs. | Apply a fix, restart anything, or read secrets. |
| Time | Step |
| ---- | ------------------------------------------------------------------ |
| T+00 | Read the symptom in the customer's words before any dashboard. |
| T+05 | Write the incident question: what is broken, for whom, since when. |
| T+12 | At least two hypotheses, and the reading that would kill each one. |
| T+25 | Submit a first version and mark it final. |
| T+40 | Second version, aimed at the block you can defend least. |
| Block | What it contains |
| ---------------------------------- | ----------------------------------------------------------------------------------------------- |
| **01 · Question and scope** | What is broken, for whom, since when, and what your access could not see. |
| **02 · Hypotheses, one ruled out** | At least two, and the reading that ruled the loser out. |
| **03 · Evidence** | Source, scope and time, kept raw. |
| **04 · The mechanism** | What caused what, and the edge in the chain you could not prove. |
| **05 · Root cause and response** | The resource you can show changed, separated from conditions you cannot date, and the response. |
Nothing a report proposes is applied to the environment, so the response is scored as a recommendation with a name on it: what to change, who approves it, and what you would check afterwards to show it worked. A response that names a symptom and stops there reads as a guess.
```text theme={null}
Give me at least two explanations for this symptom that are both consistent with the evidence so far.
```
```text theme={null}
Which resource here can you show actually changed, with a timestamp? Which ones are you only assuming changed?
```
* **Everything is healthy.** Healthy dashboards are part of the exercise. Ask what the users are seeing.
* **One confident cause arrives immediately.** Ask for the rival explanation, then for the reading that separates the two.
* **You run out of time.** Submit what you have. A report that ends with "insufficient evidence" and shows the log is complete.
## Reveal and close · 20 minutes
The board opens at once, both rounds together, and the ranking lands before anyone explains it. Then the reveal walks the two environments: what was there to find, what the highest reports showed, and where a confident report went wrong.
Round 2 is the one worth watching. Every team had the same symptom, the same read-only access and the same clock, and the answers differ. That spread is the point of the day. Each region then names its **Prove It Champion** and **Runner-up**.
## What comes next
* Teams that complete all three days keep three portfolio artifacts and the series skill certificates.
* Outstanding finalists may be selected for the three-month CloudThinker Ambassador Program.
## Glossary
| Term | Meaning on Day 03 |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Board | Every team's running total and rank. Public in Round 1, sealed in Round 2. |
| Version | One saved report. Versions are free, and each keeps its time. |
| Final | The one version per round that goes to the judge when you mark it. |
| Graded attempt | The judge's three runs on one final. Three per round. |
| Median score | The middle of the judge's three runs. That is your mark for the attempt. |
| Lens | One of the five review angles in Round 1: cost, security, performance, reliability, operations. |
| Causal chain | The path from the symptom back to the resource whose own configuration changed. |
| Trigger, root cause, contributing factor | As on Day 02. What set it off, the one resource whose configuration diverged, and what you cannot date. |
| Blocked | The role could not look. Write it down; it is a valid result. |
## Further reading
* [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html)
* [Google SRE Book · Effective troubleshooting](https://sre.google/sre-book/effective-troubleshooting/)
* [NIST SP 800-61r3 · Incident response recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)
* [CloudThinker · Root cause analysis](/guide/incident/root-cause-analysis)