# Tutorial: Phase 3: Active Protection

Scenario Director Propose→Approve→Deploy, CNAPP shadow decoys, IDS candidate
review, identity decoys, and density projection: without auto-containment or
cloud mutation.

**Time:** ~25-40 minutes  
**Plane:** Ops management (+ optional sensor ScenarioPlan file seed)

## Prerequisites

- Ops GUI built (`cd ops && go test ./internal/opsgui/ -count=1` smoke)
- Production-style auth scopes when testing gated routes
- Optional OT sensor for file-seeded scenario drift

## 1. Scenario Director (TDD-326)

Propose a plan digest, approve with an approver-scoped token, then deploy before
expiry. Ledger events are hash-chained and durable under
`CYBERHALLUCINET_OPS_CONTROLPLANE_DIR`.

```bash
# Lab: scopes on a production-profile Ops server (actor/tenant from JWT)
curl -sS -H "Authorization: Bearer $OPS_TOKEN_OPERATOR" \
  -H "Content-Type: application/json" \
  -d '{"action":"propose","plan_id":"plan-1","plan_digest":"<64-hex>","proposal_id":"prop-1","expires_at":"2030-01-01T00:00:00Z"}' \
  http://127.0.0.1:8080/api/scenario/plans
```

Sensor file seed (default off): set `CYBERHALLUCINET_SCENARIO_PLAN_FILE` to a
signed plan JSON and `CYBERHALLUCINET_SCENARIO_PLAN_HMAC_KEY` (or autonomous HMAC).

How-to: [scenario-director.md](../how-to/scenario-director.md)

## 2. CNAPP shadow Propose→Approve (TDD-383)

Read-only vendor findings → Fabric Planner shadow decoy proposals. Safety
consts stay `mutates_cloud_asset=false` and `copies_customer_secrets=false`.

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN_OPERATOR" \
  -H "Content-Type: application/json" \
  -d '{"action":"propose","proposal_id":"cnapp-1","vendor":"wiz","finding_id":"f-1"}' \
  http://127.0.0.1:8080/api/cnapp/shadow
```

How-to: [cnapp-shadow.md](../how-to/cnapp-shadow.md)

## 3. IDS candidates from Class B fingerprints (TDD-384)

Render Suricata/Zeek **review-only** candidates (`auto_push_inline_ips=false`).

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"engine":"suricata","source_event_id":"ev-1","fingerprint":{"ja4":"t13d…","no_ips_push":true,"format":"class_b_fingerprint_v1","evidence_digest":"<64-hex>"}}' \
  http://127.0.0.1:8080/api/ids/candidates
```

How-to: [ids-candidates.md](../how-to/ids-candidates.md)

## 4. Identity decoys + density (TDD-385 / TDD-386)

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN_OPERATOR" \
  -H "Content-Type: application/json" \
  -d '{"action":"propose","proposal_id":"idecoy-1","spec":{"provider":"entra","decoy_id":"decoy-user-1","display_name":"svc-backup-decoy","zero_privilege":true,"reversible":true,"inventory_ref":"inv-1"}}' \
  http://127.0.0.1:8080/api/identity/decoys

curl -sS -H "Authorization: Bearer $OPS_TOKEN_OPERATOR" \
  -H "Content-Type: application/json" \
  -d '{"action":"project","decoy_id":"decoy-a","ip":"10.80.0.50"}' \
  http://127.0.0.1:8080/api/density/project
```

How-tos: [identity-decoys.md](../how-to/identity-decoys.md) ·
[density-projection.md](../how-to/density-projection.md)

## Safety

- Never auto-contain from scenario/CNAPP/IDS narrative (SEC-AG-002/003).
- Sensor progressive lure / CI exclusion / counter-agentic pack remain
  default-off env flags: see [counter-agentic-pack.md](../how-to/counter-agentic-pack.md).
- API catalog: [ops-phase35-api.md](../reference/ops-phase35-api.md)