# AGENT-PROMPT-v5-P1-2-o5-prep — Prepare everything automatable for the O5 boundary, leaving only the target-host session

**Date:** 2026-08-06
**Follows:** `docs/p1-2-o5-restricted-identity-design.md` (the governed O5 design — normative
for this assignment), `docs/f0-spike-results.md`, `docs/hermes-documental-runtime-acceptance.md`,
`docs/deployment/iis-and-worker.md`, `docs/PROJECT-STATE.md`
**Authority:** Miguel. This prompt authorizes **only O5 preparation work**: design-conformant
provisioning scripts, the acceptance-battery runner and fixtures, and the validation-session
runbook. It does **not** authorize the P1-2 extraction handler, any pipeline/queue code, any
skill work, any P1-1b work, or any action against the production host or live database — the
target-host session itself is Miguel's, using what you prepare. Work on a dedicated branch
(`feature/p1-2-o5-prep`); touch only `deploy/`, `scripts/`, `docs/`, and test fixtures. Do not
touch the P1-1b branch or anything the P1-1b amendments govern.

## Gate

`docs/p1-2-o5-restricted-identity-design.md` is present and is the design of record. If
anything in it contradicts `docs/PROJECT-STATE.md` or an accepted decision, stop and report.
This assignment may run in parallel with P1-1b precisely because their file surfaces are
disjoint; if you find yourself needing to edit a file P1-1b owns, stop and report.

## Deliverables, in order

1. **Provisioning script set** — idempotent PowerShell under `deploy/o5/`, each script
   re-runnable with a `-WhatIf` mode and a verification mode that reports pass/fail without
   changing anything:
   - `provision-identities.ps1` — creates `svc-sibyla-pdfx` and `svc-sibyla-claude` per
     D-O5-1: local, non-admin, deny interactive/remote-interactive logon, passwords sourced
     from the approved secret store (never parameters in command history, never echoed).
   - `provision-acls.ps1` — applies the full D-O5-2 matrix, including the explicit deny ACEs
     and the per-job-root traverse-only rule; verification mode enumerates effective access
     per identity per path and prints a matrix to compare against the design table.
   - `provision-egress.ps1` — implements **both** D-O5-3 mechanisms behind a switch
     (`-Mechanism FqdnRule|LoopbackProxy`): the SID-keyed deny-all rules for both identities,
     plus, per mechanism, the FQDN dynamic-keyword allow rule or the loopback-proxy config and
     its port allow. The host session decides which survives; both must be complete.
   - `provision-jobroot.ps1` — creates the transient-job-root layout with the per-job ACL
     template the Worker will stamp per job.
2. **Acceptance-battery runner** — `scripts/run-o5-acceptance.ps1` implementing D-O5-6 items
   1–3, 5, and 7 fully scripted (identity probes, isolation probes with every attempt-and-deny
   recorded, egress probes with a control host list, N-way concurrency skeleton, canary-value
   key-hygiene scan), and item 4's harness: it stages the fixtures and launches each child
   under the restricted identity via the D-O5-5 secondary-logon path, capturing sanitized
   evidence (paths, identities, status codes, timings, hashes — never secrets) into a
   timestamped evidence file shaped like the F0/Hermes records. Item 6 (post-reboot) is a
   runbook step that re-invokes the same runner.
3. **Injection fixtures** — synthetic malicious PDF and image fixtures under
   `tests/fixtures/o5/`: embedded instructions attempting exfiltration, out-of-job writes, and
   tool abuse; plus one benign readable document as the control. Synthetic content only — no
   real company data, no real secrets, canary values throughout.
4. **Validation-session runbook** — `docs/deployment/o5-target-host-runbook.md`: the exact
   ordered session for the AWS WS2025 host — prerequisites, which scripts to run with which
   switches, the egress-mechanism decision point (try FQDN rule first, fall back to proxy,
   record which passed), the reboot step, expected results per battery item keyed to D-O5-6,
   what evidence to save where, and the explicit closure statement Miguel records in
   `PROJECT-STATE.md` when everything is green. Written so the session is executable in under
   an hour without improvisation.
5. **Dry-run everything runnable off-host.** Scripts must parse and pass `-WhatIf`/analysis
   locally (PSScriptAnalyzer clean); the battery runner's logic that does not require the
   target host (fixture staging, evidence formatting, canary scan, ACL-matrix comparison) gets
   real tests. Anything only provable on the host is marked `HOST-SESSION` in the runbook, not
   simulated and not claimed.
6. **Records** — `docs/p1-2-o5-prep-status.md` with a deliverable-by-deliverable control
   record; update `docs/project-todo.md`'s P1-2 `[!]` item to reference the design, the
   scripts, and the pending host session; do **not** close O5 in `PROJECT-STATE.md` — only the
   host session closes it. Clean multi-line commit bodies; push the branch.

## Discipline and prohibitions

No production or live-host action of any kind; the scripts are written and verified locally
and executed only in Miguel's session. No real secret, password, key, hostname beyond what the
deployment docs already record, or IP range in the repository — placeholders resolved at
session time from the secret store. No changes to Worker/API/Web source code (the D-O5-5 spawn
implementation is P1-2 proper, not this prep). No P1-1b files. No edits to accepted
migrations. No history rewrite. If the design document is silent on something the scripts
need, stop and report rather than choosing silently — the design is Miguel's decision surface.

## Report at the end

Branch and commit hashes; the deliverable list with per-item verification evidence; the exact
runbook path and its estimated session duration; every `HOST-SESSION` item enumerated; and the
one-line statement of what remains for O5 to close: the target-host session and its recorded
evidence.