# Tutorial: Shadow containment pilot

> **Status:** Lab-only. Demonstrates **observe** pilot start and ledger export only.
> **Never demos hard mode.** Defaults off / observe.

## Goal

Start the Enforcement Plane pilot clock, generate observe-mode evaluate traffic,
and export the forensic ledger for hash verification.

## Prerequisites

- [agentic-enforcement-plane.md](../how-to/agentic-enforcement-plane.md) secrets set
- Ops GUI or curl with Ops `AUTH_TOKEN`
- Optional sensor evaluate notify with distinct `EVAL_TOKEN`

## Steps

1. Start `enforcementplane` on loopback.
2. Set Ops `CYBERHALLUCINET_ENFORCEMENT_PLANE_URL` + `…_AUTH_TOKEN`.
3. `POST /api/agent/enforcement/pilot` to start observe.
4. Drive lab decoy touches in observe (see [catch-a-hijacked-agent.md](catch-a-hijacked-agent.md)).
5. `GET /api/agent/enforcement/ledger/export` and verify chain hashes offline.
6. Confirm Soft/Hard remain observe-forced until maturity-train days + attest
   ([agentic-shadow-pilot.md](../how-to/agentic-shadow-pilot.md)).

## Expected result

Pilot status shows observe progress. Soft/Hard are not unlocked in this tutorial.

## Safety

- Do not set `AUTH_TOKEN` == `EVAL_TOKEN`.
- Do not place dual-key MAC on the sensor.
- No Phase C hard execute in this path.