# Living Sensor PoC (Phase 1)

~15-25 minutes. Bring up a **sensor-only** multi-node Living Sensor proof-of-concept
without Ops/Investigate.

!!! info "Plane separation"
    This path binds the **decoy / sensor** plane only. Do not place Ops GUI,
    CTI, or cloud credentials on the public decoy host.
    See [plane-separation](../architecture/plane-separation.md).

## Goal

Demonstrate Contained listeners and a PoV summary export in ≤10 minutes of
operator path time (Helm `poc.pathMinutesBudget` / field_trial POC overlay).

## Prerequisites

- Docker Compose **or** Helm 3
- Built sensor image / binary for your stack
- Loopback or lab network only unless you have a signed research charter

## Compose (field trial)

From `scripts/field_trial/stacks/chn`:

```bash
docker compose -f docker-compose.yml \
  -f overlays/docker-compose.poc.yml \
  up -d
```

Optional vertical packs (each **default off**: apply explicitly):

- Water/WWS: `-f overlays/docker-compose.water-wws-pack.yml --env-file overlays/water-wws-pack.env`
- Logistics: `-f overlays/docker-compose.logistics-pack.yml --env-file overlays/logistics-pack.env`

## Helm (multi-node ready)

```bash
helm template living-poc deploy/helm/chn-sensor --set replicaCount=2
# apply only in a lab cluster with your usual install path
```

Confirm `aiBroker.enabled` stays false and `poc.opsRequired` stays false.

## PoV summary (engine-only)

Use the sensor-side PoV helper (`engine/internal/povexport`) to write a summary
JSON with `ops_required: false` and `path_minutes_budget: 10`.

## OT Zero-Collision Certificate (optional)

Before enabling OT listens in a shared plant LAN, run the passive SPAN/TAP
profiler (or drop a file-seeded Zero-Collision Certificate) and set:

```bash
export CYBERHALLUCINET_OT_PROFILER_REQUIRE_CERT=1
export CYBERHALLUCINET_OT_PROFILER_SEED=/path/to/zcc.json
export CYBERHALLUCINET_OT_PROFILER_SEED_HMAC_KEY='<operator-secret-at-least-16-bytes>'
```

Create the seed with `otprofiler.WriteSignedCertificateFile`; unsigned seeds,
wrong HMACs, and group/world-writable seed files or parent directories are
rejected. Active probing is forbidden. Audited override requires a documented
ack token. The production sensor profile always enables this certificate gate;
research keeps it opt-in for loopback labs.

## Next

- [Day-1 SIEM decoy-touch](day1-siem-decoy-touch.md)
- [chn-canary playground ROE](../governance/playground-roe.md) (isolated GTM stub, not the production sensor)
- [OT WWS beginner](ot-wws-beginner.md)