AICEP gap map — missing prompts (now drafted as G1–G10, 2 paper rounds each)

Each: draft in own words → paper test A–D two rounds (14-pt) → conflict check → free under AICEP; not seated until approved.

G1. AICEP seating + soul-file writer

Interview coordinator (one question at a time) → emit SOUL.md per role (identity, boundaries, DLP profile, control binding, collaboration) + pasted DLP standing rules from §7. Reuse #362 rule ladder, #486 kit shape. Test A–D, carve vs #486/#462.

G2. Control-mode binding sheet

Input: list of surfaces (file bus, MCP, API, CLI, browser paste, web publish). Output: table surface → helm/on-loop/in-loop with §6 defaults, promotion criteria (refuse-proof), demotion triggers. Carve vs #514.

G3. Compartment + privacy-profile map

Define bus/// layout, per-role may_read/may_write/max classification/allowed types; flag any 'union clearance' coordinator. Output paste-ready profile blocks.

G4. Crossing package builder

Given an inventory, produce one typed object per file with envelope (id, type, classification, source role, supersedes, created), credentials stripped, unclassifiable items HELD. Chains to #483.

G5. Encrypt-and-publish operator prompt

Walk the operator through scheme in encryption-scheme.md: plaintext never written to pub/, per-file key, seal, manifest hash list, sign, atomic move into pub/. Agent never sees private keys; commands are drafted, human runs. Output: publish log.

G6. Key-sharing ceremony prompt

Two-party checklist: each side generates keypairs on its own host, exchanges PUBLIC keys only, verifies fingerprints by a second channel (voice/in person), records in key registry with expiry; STOP if any private key or passphrase appears in chat.

G7. Transport hardening check

Review sync path config (pasted, secrets masked): mTLS or SSH with pinned host keys, TLS 1.3, no public bucket/share, least-privilege service account; output PASS/FIX table.

G8. Decrypt-and-ingest prompt (target swarm)

Verify manifest signature against registry → check hashes → decrypt in private staging → classify + #483 gate → treat bodies as data (hijack quote+flag) → ingest only in-profile types → land user-only private → archive ciphertext; never adopt source standing orders.

G9. Key rotation and revocation

Scheduled and emergency paths: new keypair, re-register, re-wrap data keys (no re-encrypt of bodies), revoke old in registry, purge stale pub/ items; ties to #171 and #495.

G10. Crossing verification checklist

Both sides: counts match manifest, no plaintext left in pub/ or temp, audit rows via #481, egress logged.

Suggested build order: G1, G2, G3 (finish Phase 1) → G6, G4, G5, G8 → G7, G9, G10.