10 KiB
Internal Sandbox Operator Runbook
This runbook is for the operator who has access to an internal-network test sandbox where iSphere / IMPlatformClient can be manually opened and logged in.
The goal is to produce a live read-only capture package for the outer-network coordination environment.
1. Safety boundary
Do only these actions:
manual open iSphere / IMPlatformClient
manual normal login
keep main window visible
run version
run self_check
run scan_windows
run dump_uia
copy JSON/text outputs into a package
Do not do these actions:
automatic login
search contacts
open conversation
send message
send file
receive/download file
use copied credentials
extract password/token/cookie/private key
inject process
hook
read target process memory
bypass endpoint security
run executables copied from offline evidence packages
2. Prepare repository in the internal sandbox
Open PowerShell in the repository root.
Example:
cd E:\isphere-ai-bridge
If the repository path is different, use that actual path. All commands below assume the repository root is the current directory.
Check repository status:
git status --short --branch
Recommended: record this output into the package later as:
metadata/repo-status.txt
3. Verify helper and Go MCP readiness
Run helper verification:
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-win-helper.ps1
Expected high-level result:
ok=true
helper version=0.1.0
uia_available=true or valid boolean
If Go is installed in the internal sandbox, also run:
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-go-mcp.ps1
Expected high-level result:
ok=true
tool_count=4
helper_name=ISphereWinHelper
action_tools_present=false
If Go is unavailable, do not install unrelated tooling during the capture window unless the operator has approval. The C# helper fallback below is enough to capture the same four read-only helper operations.
4. Create capture directory
Choose a capture id. Recommended format:
YYYY-MM-DD-internal-sandbox-<short-name>
Example:
$captureId = "2026-07-08-internal-sandbox-a"
$captureRoot = "runs\internal-sandbox-live-capture\$captureId"
New-Item -ItemType Directory -Force -Path `
"$captureRoot\metadata", `
"$captureRoot\helper", `
"$captureRoot\windows", `
"$captureRoot\uia", `
"$captureRoot\notes" | Out-Null
5. Record metadata
Record OS version:
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, CsUserName |
Format-List | Out-File -FilePath "$captureRoot\metadata\os-version.txt" -Encoding UTF8
Record process list:
Get-Process | Sort-Object ProcessName |
Select-Object ProcessName, Id, MainWindowTitle, Path |
Format-Table -AutoSize | Out-File -FilePath "$captureRoot\metadata\process-list.txt" -Encoding UTF8
Record repo status:
git status --short --branch | Out-File -FilePath "$captureRoot\metadata\repo-status.txt" -Encoding UTF8
Create source notes:
@"
capture_id: $captureId
source_environment: internal-network test sandbox
operator: <fill operator name or role>
capture_time_local: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss zzz")
iSphere manually logged in: yes/no
client opened before capture: yes/no
main window visible: yes/no
operations used: version, self_check, scan_windows, dump_uia
forbidden actions performed: no
this package is N12R live evidence, not current-environment N12 pass
"@ | Set-Content -Path "$captureRoot\metadata\source-notes.txt" -Encoding UTF8
Before packaging, edit the yes/no fields so they are accurate.
6. Manual login
- Open iSphere / IMPlatformClient using the normal internal sandbox method.
- Log in manually using the normal company process.
- Complete SSO/MFA if required.
- Do not use copied credentials or offline evidence files.
- Keep the main iSphere window visible and not minimized.
Do not click into contacts or conversations unless normal login itself requires it. Do not send or receive anything.
7. Build helper path variable
After verify-win-helper.ps1, the helper should exist at:
runs\win-helper\ISphereWinHelper.exe
Set:
$helper = Resolve-Path -LiteralPath "runs\win-helper\ISphereWinHelper.exe"
8. Capture helper version
@{
protocol = "isphere.helper.v1"
request_id = "n12r-version"
op = "version"
timeout_ms = 5000
args = @{}
} | ConvertTo-Json -Depth 8 -Compress |
& $helper --json |
Set-Content -Path "$captureRoot\helper\version.json" -Encoding UTF8
9. Capture self check
@{
protocol = "isphere.helper.v1"
request_id = "n12r-self-check"
op = "self_check"
timeout_ms = 5000
args = @{}
} | ConvertTo-Json -Depth 8 -Compress |
& $helper --json |
Set-Content -Path "$captureRoot\helper\self-check.json" -Encoding UTF8
10. Scan visible windows
@{
protocol = "isphere.helper.v1"
request_id = "n12r-scan-windows"
op = "scan_windows"
timeout_ms = 5000
args = @{ include_all_visible = $true }
} | ConvertTo-Json -Depth 8 -Compress |
& $helper --json |
Set-Content -Path "$captureRoot\windows\scan-windows.json" -Encoding UTF8
Open the scan result and identify the likely iSphere / IMPlatformClient window by process name, title, class name, visibility, bounds, and score:
Get-Content -Path "$captureRoot\windows\scan-windows.json" -Encoding UTF8 | ConvertFrom-Json |
Select-Object -ExpandProperty data |
Select-Object -ExpandProperty windows |
Where-Object { $_.process_name -match "iSphere|IMPlatform|IMPP" -or $_.title -match "iSphere|IMPlatform|IMPP" } |
Format-Table hwnd,pid,process_name,title,class_name,visible,score -AutoSize
11. Save selected window metadata
Replace <HWND> with the selected window handle from the scan output, such as 0x001A0B2C.
$selectedHwnd = "<HWND>"
$scanObj = Get-Content -Path "$captureRoot\windows\scan-windows.json" -Encoding UTF8 | ConvertFrom-Json
$selected = $scanObj.data.windows | Where-Object { $_.hwnd -eq $selectedHwnd } | Select-Object -First 1
if (-not $selected) { throw "selected hwnd not found in scan result: $selectedHwnd" }
$selected | ConvertTo-Json -Depth 8 | Set-Content -Path "$captureRoot\windows\selected-window.json" -Encoding UTF8
12. Capture UIA dump
Use conservative limits first:
@{
protocol = "isphere.helper.v1"
request_id = "n12r-dump-uia-main"
op = "dump_uia"
timeout_ms = 15000
args = @{
hwnd = $selectedHwnd
max_depth = 8
include_text = $true
max_children = 100
}
} | ConvertTo-Json -Depth 12 -Compress |
& $helper --json |
Set-Content -Path "$captureRoot\uia\dump-uia-main.json" -Encoding UTF8
If the dump is too large or truncated, repeat once with adjusted limits and save as an additional file, for example:
uia/dump-uia-main-depth10-children150.json
Do not click, type, send, upload, download, or modify the iSphere client during capture.
13. Create a redacted UIA copy
Create a copy for sharing:
Copy-Item -LiteralPath "$captureRoot\uia\dump-uia-main.json" -Destination "$captureRoot\uia\dump-uia-main-redacted.json" -Force
Then manually review dump-uia-main-redacted.json and redact sensitive visible text before sharing broadly.
Redact:
person names
phone numbers
emails
message text
contact names
organization-sensitive content
credential/token-like strings
business document titles if sensitive
Keep structural selector fields when possible:
control_type
automation_id
class_name
framework_id
bounds
is_enabled
is_offscreen
children shape
14. Write operator notes
@"
What client was opened: <iSphere / IMPlatformClient>
How login was performed: manual normal company process
Any MFA/SSO used: yes/no, no secrets included
Selected window hwnd: $selectedHwnd
Selected window reason: <process/title/class/score reason>
Redactions applied: <brief list>
Any capture problems: <brief list>
Forbidden actions performed: no
"@ | Set-Content -Path "$captureRoot\notes\operator-notes.txt" -Encoding UTF8
15. Verify package before copying out
Run:
$required = @(
"$captureRoot\metadata\source-notes.txt",
"$captureRoot\helper\version.json",
"$captureRoot\helper\self-check.json",
"$captureRoot\windows\scan-windows.json",
"$captureRoot\windows\selected-window.json",
"$captureRoot\uia\dump-uia-main.json",
"$captureRoot\uia\dump-uia-main-redacted.json",
"$captureRoot\notes\operator-notes.txt"
)
foreach ($path in $required) {
if (-not (Test-Path -LiteralPath $path)) { throw "missing required file: $path" }
}
"N12R package files present: $captureRoot" | Tee-Object -FilePath "$captureRoot\metadata\verification-summary.txt"
Check JSON parseability:
Get-Content "$captureRoot\helper\version.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
Get-Content "$captureRoot\helper\self-check.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
Get-Content "$captureRoot\windows\scan-windows.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
Get-Content "$captureRoot\windows\selected-window.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
Get-Content "$captureRoot\uia\dump-uia-main.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
Get-Content "$captureRoot\uia\dump-uia-main-redacted.json" -Encoding UTF8 | ConvertFrom-Json | Out-Null
16. Package for transfer
Compress the capture directory:
Compress-Archive -LiteralPath $captureRoot -DestinationPath "$captureRoot.zip" -Force
Copy either the directory or zip back to the outer-network repository environment under:
runs/internal-sandbox-live-capture/<capture-id>/
17. What to report back
Tell the coordinating session:
N12R package is ready.
Path: runs/internal-sandbox-live-capture/<capture-id>/
Manual iSphere login: yes
Main window visible during capture: yes
Forbidden actions performed: no
The coordinating session will then validate the returned package. Do not mark original current-environment N12 as passed.