From 07fbe3025c4e209609d0435912671c307b8a5e44 Mon Sep 17 00:00:00 2001
From: Ahmed Mohamed <19214462+envokeME@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:42:29 -0700
Subject: [PATCH] feat: add one-click Binder replay for Lab 01

---
 README.md               | 3 +++
 binder/requirements.txt | 9 +++++++++
 binder/runtime.txt      | 1 +
 3 files changed, 13 insertions(+)
 create mode 100644 binder/requirements.txt
 create mode 100644 binder/runtime.txt

diff --git a/README.md b/README.md
index 69fc599..a5340b6 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # risk.engineer labs
 
 [![validate labs](https://github.com/envokeME/risk-engineer-labs/actions/workflows/validate.yml/badge.svg?branch=main)](https://github.com/envokeME/risk-engineer-labs/actions/workflows/validate.yml)
+[![launch Lab 01 in Binder](https://mybinder.org/badge_logo.svg)](https://mybinder.org/v2/gh/envokeME/risk-engineer-labs/main?urlpath=lab/tree/labs/lab-01-continuous-risk-identification/lab-01-continuous-risk-identification.ipynb)
 
 Executable labs for practitioners building the cyber risk lifecycle as a data system. These labs show how operational evidence can become reviewable risk knowledge—not another spreadsheet that waits for an annual assessment.
 
@@ -10,6 +11,8 @@ Executable labs for practitioners building the cyber risk lifecycle as a data sy
 |---|---|---|
 | [01 · Continuous risk identification](labs/lab-01-continuous-risk-identification/) | Can changing system evidence identify a risk condition and express it in business terms? | Learning prototype |
 
+Run Lab 01 in one click with [Binder](https://mybinder.org/v2/gh/envokeME/risk-engineer-labs/main?urlpath=lab/tree/labs/lab-01-continuous-risk-identification/lab-01-continuous-risk-identification.ipynb), or use the lab's Docker path when you need a pinned local environment. Binder replay uses synthetic data and does not require an API key. Live LLM mode remains local by design.
+
 ## Roadmap
 
 - **Lab 02 · Emerging risk discovery** — expand beyond the known offboarding scenario using temporal evidence graphs and weak-signal research.
diff --git a/binder/requirements.txt b/binder/requirements.txt
new file mode 100644
index 0000000..807c8e3
--- /dev/null
+++ b/binder/requirements.txt
@@ -0,0 +1,9 @@
+jupyterlab==4.6.3
+nbclient==0.11.0
+nbformat==5.11.1
+jsonschema[format]==4.26.0
+matplotlib==3.11.1
+langgraph==1.0.9
+duckdb==1.5.5
+pyarrow==25.0.1
+ocsf-json-schema==1.2.0
diff --git a/binder/runtime.txt b/binder/runtime.txt
new file mode 100644
index 0000000..d2aca3a
--- /dev/null
+++ b/binder/runtime.txt
@@ -0,0 +1 @@
+python-3.12