Course Delivery SOP

Output: Operational readiness signed off by LI.

5.1.1 · Infrastructure Pre-Flight (T-72h)

# Verify proxy is healthy
l33tpwn proxy routes | head -5
l33tpwn proxy clean-stale     # dry-run; report any stale to LI

# Verify Modal training pipeline
foundry train fire web --epochs 1 --watch  # smoke test, ~5 min
foundry train cancel <run_id> --yes        # discard the smoke run

# Verify DynamoDB table sizes are nominal
l33tpwn dynamo grep userdata '@' | wc -l    # current student count

5.1.2 · Walkthrough Validation (T-48h)

l33tpwn walkthrough validate           # all 48 must pass
l33tpwn walkthrough sources --check    # HEAD-check source URLs

5.1.3 · Roster Provisioning (T-24h)

LO pre-creates Cognito users for the cohort using Annex C's batch script.

5.1.5 · GO/NO-GO Call (T-1h)

15-minute call with LO + AIs. All four checks must read GO. Any RED status results in cohort delay or cancellation per LI's discretion.

Output: Each STU has verified login + recorded section assignment.

5.2.1 · STU Login Verification

Each student in their own terminal:

l33tpwn login --email <your-cohort-email>
# Password sent via cohort onboarding email
l33tpwn whoami
# Expected: email matches enrollment, ID token expiry > 6h from now

5.2.2 · AI Roll Call

Each AI confirms presence for all 25 students and reports counts to LI by T+25m.

Output: Each STU has a running attack machine + at least one target (advanced tier also has a purple defense machine).

5.3.1 · Self-Service Provisioning

l33tpwn student provision <email> --tier <basic|advanced>
# Provisioning takes 2-4 minutes
l33tpwn student instances <email>
# Wait until all instances read state=running

5.3.2 · Locating the VNC Link via CLI ⭐ load-bearing

This is the design-intent step: "VNC discoverable from CLI."

# Attack machine VNC URL
l33tpwn student vnc-url <email>
# → https://<hash>.l33tpwn.com/vnc_lite.html?path=websockify&password=hackme&autoconnect=true

# Purple machine VNC URL (advanced tier)
l33tpwn student vnc-url <email> --purple

5.3.3 · AI Health Sweep at T+45m

for stu in $(cat ai-section-roster.txt); do
  l33tpwn student instances $stu --json | jq -r '.[] | "\(.role) \(.state)"'
done

Any STU with state ≠ running after 5 min → escalate to SME. AI may issue:

l33tpwn student start <email> --target attack --wait

Output: One PDCA trace JSONL at data/traces/pdca/<mission-id>.jsonl.

This is the autonomous loop's core. Two entry paths — both produce the same trace.

chakra init -t albania
chakra discover
chakra run albania --invocations 30

5.5.3 · Mission Boundary

A mission completes when ANY of:

• Trace contains at least one report_finding tool call (target compromised)
• Invocation budget (default 30) exhausted
• T+225m reached

Output: Each STU has fired one Modal training run with a tracked experiment row.

5.7.1 · Pre-Training Quota Check (LO at T+285m)

modal token current
# Confirm balance > cohort_size × $2 (worst-case adapter cost)

5.7.2 · STU Fires Training

foundry train fire web \
    --training-data-dir data/training/pdca-toolcalls-v17-cohort-mt-curated \
    --base-model Qwen/Qwen2.5-7B-Instruct \
    --epochs 3 --lora-rank 32 \
    --watch
# 30-90 min depending on corpus size; --watch streams logs into CLI DB

Common error modes — AI playbook:

5.7.3 · Training Completion

foundry train download <run_id> \
    --dest packages/tactician/adapters/<student-id>/

5.10.1 · Per-Student Tear-Down

l33tpwn student stop <email>        # preserves VPC; cheap stopped
# OR full tear-down:
l33tpwn student teardown <email> --yes

5.10.2 · LO Cohort-Wide Sweep at T+510m

aws ec2 describe-instances \
    --filters "Name=tag:l33tpwn-cohort,Values=<cohort-id>" \
              "Name=instance-state-name,Values=running" \
    --query 'Reservations[].Instances[].InstanceId'
# Expected: empty array

l33tpwn dynamo dump          # backup state for AAR

5.10.3 · AAR (T+520m, 20 minutes)

LI convenes LO + AIs. AAR records:

• Number of STUs who completed all 8 phases
• Number + root cause of escalations
• Modal compute spend (LO from modal billing)
• AWS spend (LO from Cost Explorer)
• Deviations from this SOP (with LI sign-off)
• Recommendations for next cohort

AAR is filed at docs/aar/AAR-<cohort-id>-<date>.md within 24h.