# Tutorial: Install Phase C Beta (Enforcement Plane)

> **Status:** Lab-only. Phase C is **Beta** (ADR 0009 Accepted): Soft/Hard on
> `LocalState` + optional BYO webhook. Native vendor EDR/IdP SDKs are GA-train
> only. This tutorial installs and starts the plane in **observe**; it does
> **not** demo hard mode.

## Goal

Install and start the Enforcement Plane with Beta maturity, confirm `/healthz`
reports Beta, start the observe pilot, and optionally point Ops or the sensor at
evaluate-only notify.

## Prerequisites

- Complete [Install Phase A](install-agentic-phase-a.md) **or** run:

  ```bash
  make agentic-lab-install
  source .local/agentic-lab/env.sh
  ```

- Distinct `AUTH_TOKEN` and `EVAL_TOKEN` (the install script generates them)

## Install reminder

```bash
make agentic-lab-install
source .local/agentic-lab/env.sh
```

Binaries: `bin/enforcementplane`, `bin/sensor`.
Durable ledger + pilot state: `$CYBERHALLUCINET_ENFORCEMENT_LEDGER_DIR`.

## Start the Enforcement Plane

```bash
./bin/enforcementplane
```

Expect a log line with `maturity=beta`, `label=Beta`, and `pilot_days=7`.

### Health check

```bash
curl -sS http://127.0.0.1:3091/healthz
```

You should see `"maturity":"beta"`, `"product_label":"Beta"`, and
`"vendor_api_ga":false`.

## Start the observe pilot

```bash
curl -sS -X POST http://127.0.0.1:3091/v1/pilot/start \
  -H "Authorization: Bearer $CYBERHALLUCINET_ENFORCEMENT_AUTH_TOKEN"
```

Check status:

```bash
curl -sS http://127.0.0.1:3091/v1/pilot/status \
  -H "Authorization: Bearer $CYBERHALLUCINET_ENFORCEMENT_EVAL_TOKEN"
```

Confirm `required_days` is **7** (Beta floor) and `soft_hard_allowed` is false
until days elapsed + attest.

## Wire the sensor (evaluate only)

With env sourced from the lab install:

```bash
export CYBERHALLUCINET_AGENTIC_HONEYTOOLS=observe
./bin/sensor --config=config/sensor.example.yaml
```

The sensor may POST **evaluate** with `EVAL_TOKEN` only. It must never receive
`AUTH_TOKEN` or `DUALKEY_MAC`.

## Optional: Ops proxy

```bash
export CYBERHALLUCINET_ENFORCEMENT_PLANE_URL=http://127.0.0.1:3091
# AUTH_TOKEN already in env.sh: Ops uses it for execute proxy only
```

Ops still reports `ops_executes_containment: false`.

## Optional: BYO webhook (Beta real-effects fan-out)

Without vendor SDKs, Soft/Hard can POST a signed payload to your receiver:

```bash
export CYBERHALLUCINET_ENFORCEMENT_WEBHOOK_URL=http://127.0.0.1:9999/contain
export CYBERHALLUCINET_ENFORCEMENT_WEBHOOK_HMAC="$(openssl rand -hex 32)"
# restart enforcementplane after setting these
```

HTTPS is allowed for non-loopback; plain HTTP only on loopback.

## What you installed

| Piece | Role |
|-------|------|
| `bin/enforcementplane` | Sole credential holder / Soft-Hard executor |
| Ledger + pilot under `LEDGER_DIR` | Survives restart |
| Maturity `beta` | 7-day floor + attest before Soft/Hard |

## Safety

- Soft/Hard stay observe-forced until Beta pilot days + attest.
- Never demo hard mode in tutorials.
- Do not claim native vendor EDR/IdP GA on this train.

## Next

- [Shadow containment pilot](shadow-containment-pilot.md) (observe-only review)
- [agentic-enforcement-plane.md](../how-to/agentic-enforcement-plane.md)
- Beta checklist: [agentic-enforcement-beta.md](../assurance/agentic-enforcement-beta.md)
- Evidence: `make agentic-purple-team`

## Related

- ADR 0009 · [agentic-lab-install.md](../how-to/agentic-lab-install.md)