# Tutorial: Phase 4: Investigate & Federation

Durable CTI Investigator jobs (closed read-only tools), universal external
deception webhook ingest (including Thinkst), leave-tenant AGTI scrub, and
export packs for board / compliance workflows.

**Time:** ~20-35 minutes  
**Plane:** Ops management

## Prerequisites

- Ops with auth; scopes `intelligence:read` and `action:propose` for create+run
- Optional: `CYBERHALLUCINET_FEDERATION_ALLOWLIST=thinkst,other`

## 1. Investigation jobs (TDD-410)

Jobs persist under the Ops data dir (`var/ops/investigate` or
`CYBERHALLUCINET_OPS_INVESTIGATE_DIR`). `auto_contain` is always forced false.

```bash
# List
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  http://127.0.0.1:8080/api/investigate/jobs

# Create + run (SEC-AG-002 closed tools)
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id":"job-demo","query":"T1059","snapshot":{"schema_version":"investigate.snapshot.v1","captured_at_rfc3339":"2026-08-02T00:00:00Z","sessions":[],"records":[]}}' \
  http://127.0.0.1:8080/api/investigate/jobs
```

Shell/contain tools are rejected. Advisory narrative never triggers containment.

## 2. Federation webhook (TDD-411)

Universal schema POST, or Thinkst vendor JSON via adapter:

```bash
export CYBERHALLUCINET_FEDERATION_ALLOWLIST=thinkst

# Universal schema
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d @webhook.json \
  http://127.0.0.1:8080/api/federation/webhook

# Thinkst adapter
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-CHN-Federation-Adapter: thinkst" \
  -d '{"id":"canary-1","Description":"touch","SourceIP":"203.0.113.9"}' \
  'http://127.0.0.1:8080/api/federation/webhook?adapter=thinkst'
```

Containment is allowed only when the event sets `allowlisted_for_containment`
**and** the source appears in the env allowlist. `auto_contain: true` → HTTP 400.

How-to: [federation-webhook.md](../how-to/federation-webhook.md)

## 3. Leave-tenant AGTI scrub (TDD-412)

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"opt_in":true,"jurisdiction":"EU","fields":{"technique_note":"T1059"},"technique_ids":["T1059"]}' \
  http://127.0.0.1:8080/api/intel/leave-tenant
```

## 4. Exports (optional next step)

Continue with [ops-exports-compliance.md](ops-exports-compliance.md) for AI gov,
regclock, FAIR/CCM, Threat Radar, and PoV summaries.