AICEP prompt map

Companion to AICEP 0.1 — Public Draft (RFC), published for comment. Every prompt here will be free in support of AICEP. Blue = existing library prompt (paper-tested; findings tracked in the library); violet = new AICEP prompt drafted for this set (paper-tested twice, published for comment). Paper tests are reviewer walk-throughs, not live runs.

Phase 1 — Secure a single-instance bot swarm

1.1
Seat the coordinator and write each agent's soul file + DLP standing rules (AICEP §6–8, §17)NEW draft
1.2
Isolate the host: own machine/user, own accounts, never-on-host list#357
1.3
Lethal-trifecta check per bot (private data · untrusted content · way out)#431
1.4
Tool allowlist ALLOW / ASK-FIRST / DENY per bot#514
1.5
Tool risk rating + hand-back triggers per workflow#396
1.6
Bind each connection surface to helm / on-loop / in-loop (AICEP §6 binding table)NEW draft
1.7
Compartments + privacy profiles: who may read/write which bus foldersNEW draft
1.8
Peer-agent relay check (restricted bot can't launder through another)new draft (library number pending)
1.9
Agent errand guardrail card (limits · stop points · step log · rollback)new draft (library number pending)
1.10
Secrets sweep: find, mask, draft rotation asks#482
1.11
Human-in-the-loop token rotation, zero exposure#171
1.12
Before-you-send gate SHARE / REDACT / HOLD on every outbound path#483
1.13
Publication gate with classification (no personal / proprietary content)#263
1.14
Hostile seat test pack (8–12 PASS/FAIL cases) before declaring seated#500
1.15
Access review + break-glass audit#458, #496
1.16
Bot action log → human audit trail with sign-off#481
1.17
Incident brief before any fix (leak / credential)#262

Phase 2 — Encrypted pub/sub transfer to another swarm

2.1
Crossing package builder: inventory → classify → strip credentials → typed object (project.context / decision.record / artifact / task.state) with envelopeNEW draft
2.2
Encrypt-and-publish: per-file data key, seal to target swarm key, signed manifest, drop into pub/ compartment (append-only)NEW draft
2.3
Key-sharing ceremony: generate, fingerprint-verify out of band, register target public keys, no secret on the busNEW draft
2.4
Transport check: mTLS / SSH-only sync between pub and sub folders; refuse plaintext pathsNEW draft
2.5
Decrypt-and-ingest in target: script verifies signature, revocation time, seq (hold on gap), expiry, size limits and hashes before decrypt; an ingest gate checks a signed verifier attestation and the model sees only gate output and treats content as untrusted dataNEW draft
2.6
Key rotation / revocation / re-wrap and swarm offboardingNEW draft (with #171, #495)
2.7
Post-crossing verification + audit trail on both sides#481 + NEW draft
2.8
Pub/sub notification on every publish and pickup (chat by default; email only on reject, signature failure, replay or key change; never content or keys)NEW draft (G11)
2.9
Delivery guarantees: commit marker, sender outbox, duplicate-safe redelivery, retries at 1, 4 and 12 hours with cumulative receipts, crash-safe receiver with leases, reorder holding with a signed batch chain, dead-letter folder with signed reasons and human-only redrive, hash-chained audit logs, sign-and-encrypt-only ruleReference code and tests (proposed Phase 2 extension)

Encryption in Phase 2 is a proposed Phase 2 extension (age + signed canonical manifest, per-sender sequence numbers, verify-before-decrypt), not part of the 0.1 normative text; the 0.1 public draft covers data at rest and in motion through DLP rules but does not yet specify encryption.

New prompts built for this set

G1
AICEP seating + soul-file writer
Interview coordinator (one question at a time) → emit SOUL.md per role (identity, boundaries, DLP profile, control binding, collaboration) + pasted DLP standing rules from §7. Reuse #362 rule ladder, #486 kit shape. Test A–D, carve vs #486/#462.
G2
Control-mode binding sheet
Input: list of surfaces (file bus, MCP, API, CLI, browser paste, web publish). Output: table surface → helm/on-loop/in-loop with §6 defaults, promotion criteria (refuse-proof), demotion triggers. Carve vs #514.
G3
Compartment + privacy-profile map
Define bus/<compartment>/<subject>/ layout, per-role may_read/may_write/max classification/allowed types; flag any 'union clearance' coordinator. Output paste-ready profile blocks.
G4
Crossing package builder
Given an inventory, produce one typed object per file with envelope (id, type, classification, source role, supersedes, created), credentials stripped, unclassifiable items HELD. Chains to #483.
G5
Encrypt-and-publish operator prompt
Walk the operator through scheme in encryption-scheme.md: plaintext never written to pub/, per-file key, seal, manifest hash list, sign, atomic move into pub/. Agent never sees private keys; commands are drafted, human runs. Output: publish log.
G6
Key-sharing ceremony prompt
Two-party checklist: each side generates keypairs on its own host, exchanges PUBLIC keys only, verifies fingerprints by a second channel (voice/in person), records in key registry with expiry; STOP if any private key or passphrase appears in chat.
G7
Transport hardening check
Review sync path config (pasted, secrets masked): mTLS or SSH with pinned host keys, TLS 1.3, no public bucket/share, least-privilege service account; output PASS/FIX table.
G8
Decrypt-and-ingest prompt (target swarm)
Verify manifest signature against registry → check hashes → decrypt in private staging → classify + #483 gate → treat bodies as data (hijack quote+flag) → ingest only in-profile types → land user-only private → archive ciphertext; never adopt source standing orders.
G9
Key rotation and revocation
Scheduled and emergency paths: new keypair, re-register, re-wrap data keys (no re-encrypt of bodies), revoke old in registry, purge stale pub/ items; ties to #171 and #495.
G10
Crossing verification checklist
Both sides: counts match manifest, no plaintext left in pub/ or temp, audit rows via #481, egress logged.