Build the isolated AI lab, log the first request, and prove the isolation can fail

Steps

1. Create the VM on a NAT or bridged adapter for setup, install the OS, and take a snapshot named 00-bare-os. Create the layout with mkdir -p ~/secai-lab/docs/restricted ~/secai-lab/app/templates ~/secai-lab/gateway ~/secai-lab/logs ~/secai-lab/lab. If your hypervisor supports a disk that snapshots leave alone (VirtualBox calls it write-through, VMware independent-persistent), put lab/ and logs/ on one, so reverting after a lab does not discard your results.
2. While still connected, install everything the course needs, each using its documented method: a model runner (Ollama, or llama.cpp's server), one small open-weight chat model of a few billion parameters at most, one local embedding model, and a Python virtual environment at ~/secai-lab/.venv holding Chroma (or FAISS). If you use sentence-transformers for embeddings, load the model once now, because it downloads on first use.
3. Still connected, record what the isolation check will probe: run getent ahostsv4 example.com | awk 'NR==1 {print $1}' > ~/secai-lab/lab/probe-addresses.txt, then append your home router's address and one other device on your real network, one per line (for example 192.168.1.1). The file then holds a public address by number without anyone having typed one.
4. Write the documents in ~/secai-lab/docs/: at least hr-holiday-policy.md, product-faq.md, oncall-rota.md and restricted/salaries.md, plus two to six more (an expenses policy, an IT acceptable-use policy). Start every file with front matter lines classification: (public, internal or restricted), owner: and department:. Put the canary CANARY-7Q4X-SECAI in restricted/salaries.md and nowhere else, next to invented salary bands.
5. Write ~/secai-lab/app/ingest.py: read each document's front matter, split the body into passages of a few sentences, give each chunk the id <path under docs>#<n> (so restricted/salaries.md#0), embed it with the local embedding model, and store vector, chunk text and metadata (classification, owner, department, source) in ~/secai-lab/app/store/.
6. Write ~/secai-lab/app/rag.py with two functions. retrieve(question, user) embeds the question and returns the four closest chunks as a list of (chunk_id, text) pairs; it takes user now so that the access lab can filter on it later. build_prompt(question, chunks) returns the user-role text, with each chunk inside <retrieved id=...> delimiters followed by the question. Keep that assembly in plain sight: it is where injected content lands. Put the assistant's system prompt in ~/secai-lab/app/templates/rag-v1.txt.
7. Write ~/secai-lab/gateway/gateway.py. It accepts POST /ask with the body {"user": ..., "question": ...} and does the retrieval itself, so the prompt it logs is the prompt the model received. This version uses only the standard library (plus whatever rag.py imports) and Ollama's generate endpoint. If you use llama.cpp's server, change RUNNER and map its reply and token-count fields from its documentation. Set MODEL to the model you pulled.

import json, sys, threading, time, urllib.request, uuid
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path

LAB = Path.home() / "secai-lab"
sys.path.insert(0, str(LAB / "app"))
from rag import retrieve, build_prompt

RUNNER = "http://127.0.0.1:11434/api/generate"
MODEL = "your-small-model"
LOG = LAB / "logs" / "gateway.jsonl"
TEMPLATES = LAB / "app" / "templates"
REFUSAL = "This request was refused by the gateway."
LOCK = threading.Lock()

def check(headers, body, rec):
    # Pre-model hook, before retrieval. Later labs add input controls here.
    # Return (status, "block:...") to refuse, or None to continue.
    return None

def check_prompt(body, rec, chunks):
    # Runs once rec["prompt"] is assembled, just before the model is called.
    return None

def check_response(body, rec):
    # Post-model hook: rec["response"] holds the model's raw output.
    # Return (status, "block:...") to withhold it; the log keeps the raw text.
    return None

class Gateway(BaseHTTPRequestHandler):
    def reply(self, status, obj):
        data = json.dumps(obj).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_POST(self):
        if self.path != "/ask":
            return self.reply(404, {"error": "POST /ask only"})
        start = time.time()
        body = json.loads(self.rfile.read(int(self.headers.get("Content-Length") or 0)) or b"{}")
        name = Path(body.get("template", "rag-v1")).name
        rec = {"id": uuid.uuid4().hex, "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
               "user": body.get("user", "anonymous"), "model": MODEL, "template": name,
               "system": "", "prompt": "", "retrieved_ids": [], "response": "",
               "prompt_tokens": None, "response_tokens": None, "latency_ms": 0,
               "decision": "allow"}
        refused = check(self.headers, body, rec)
        question = rec["prompt"] = body.get("question", "")
        tpl = TEMPLATES / (name + ".txt")
        if not refused and name != "none" and not tpl.is_file():
            refused = (400, "error")
        if not refused:
            rec["system"] = "" if name == "none" else tpl.read_text(encoding="utf-8")
            chunks = retrieve(question, rec["user"]) if body.get("retrieve", True) else []
            rec["retrieved_ids"] = [cid for cid, _ in chunks]
            rec["prompt"] = build_prompt(question, chunks) if chunks else question
            refused = check_prompt(body, rec, chunks)
        if not refused:
            req = urllib.request.Request(
                RUNNER, method="POST", headers={"Content-Type": "application/json"},
                data=json.dumps({"model": MODEL, "system": rec["system"],
                                 "prompt": rec["prompt"], "stream": False}).encode())
            try:
                with urllib.request.urlopen(req, timeout=600) as r:
                    out = json.load(r)
            except OSError as e:
                refused = (502, "error")
                rec["response"] = "runner error: " + str(e)
            else:
                rec["response"] = out.get("response", "")
                rec["prompt_tokens"] = out.get("prompt_eval_count")
                rec["response_tokens"] = out.get("eval_count")
                refused = check_response(body, rec)
        status = 200
        if refused:
            status, rec["decision"] = refused
        rec["latency_ms"] = round((time.time() - start) * 1000)
        with LOCK, LOG.open("a", encoding="utf-8") as f:
            print(json.dumps(rec), file=f)
        answer = REFUSAL if rec["decision"].startswith("block:") else rec["response"]
        self.reply(status, {"response": answer, "decision": rec["decision"],
                            "retrieved_ids": rec["retrieved_ids"]})

ThreadingHTTPServer(("127.0.0.1", 8088), Gateway).serve_forever()

Two optional body fields serve the evaluation labs: template names a file in app/templates/ (default rag-v1, or none for an empty system prompt), and "retrieve": false skips retrieval. A caller can choose a reviewed template but can never send its own system text. The three empty functions are where every later control goes: check() before retrieval, with the request headers and the log record (so a control can set rec["user"] from a verified key, or rewrite body["question"], which the gateway reads only afterwards); check_prompt() once the prompt is assembled; and check_response(), the post-model hook, after the model replies. A refusal is logged, and the caller gets REFUSAL in place of any answer. Start the gateway in its own terminal with the virtual environment active, and restart it whenever you change rag.py. The user field is whatever the caller claims, and later labs replace it with real identity. 8. Write ~/secai-lab/app/ask.py --user NAME "question", a thin client that POSTs {"user": NAME, "question": ...} to $GW/ask and prints the response and the retrieved_ids. Read the base URL with os.environ.get("GW", "http://127.0.0.1:8088"), so that lesson 13's move to HTTPS on the same port needs no edit. From now on, every question in this course goes through it or straight to the gateway. 9. Make sure the runner listens on loopback only. Ollama listens on 127.0.0.1:11434 by default and its OLLAMA_HOST setting changes that, so check it is not set to an all-interfaces address; llama.cpp's server takes a host argument, which you set to 127.0.0.1. Then run python app/ingest.py and ask three questions as alice, one of them about pay bands. Open logs/gateway.jsonl and find the canary quoted inside a logged prompt: that is the problem lesson 15 solves, and you have just created it. 10. Isolate the VM: switch its adapter to host-only or internal with no default gateway, and turn off shared folders, shared clipboard, drag and drop and every port forwarding rule in the hypervisor's settings for this VM. Record what you checked in ~/secai-lab/lab/hypervisor-settings.csv with header setting,value and the four rows shared_folders, clipboard, drag_and_drop and port_forwarding, each off. 11. Prove the isolation can fail. Run the isolation check in the Verify block while isolated and record the result. Reconnect the NAT or bridged adapter, run it again and watch it report FAIL. Disconnect, run it a third time and see PASS. Record all three in ~/secai-lab/lab/isolation-proof.csv with header run,adapter,result, for example 1,host-only,PASS, 2,nat,FAIL, 3,host-only,PASS. From the host and from another device, also try to reach the VM's ports 8088 and 11434 and confirm neither answers. 12. Take the baseline snapshot, named so you will recognise it in a month (for example secai-baseline-isolated-2026-10-13), and write its name into ~/secai-lab/lab/baseline-snapshot.txt. Repeat the isolation proof whenever you change the VM's network settings.