# Contractor Slice Runbook

Status: VERIFIED BY LOCAL SELF-TEST

## Purpose

Create a scoped private repo for a helper without exposing full production.

## Default Behavior

The default private-slice profile copies zero production files. It creates only the
slice template. Add narrow allow entries only after scope approval.

When no custom allow profile is passed, `-AllowedPath` is converted into the
temporary export allow profile. `TBD` copies no production files.

Generated slices carry their own denylist gate, GitHub Actions workflow,
`SCOPE.md`, and `WORK_ORDER.md`.

## Create Slice

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\New-H8ContractorSlice.ps1 `
  -DestinationRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-PrivateSlice `
  -Owner marko1olo `
  -Contractor contractor-name `
  -Domain projectsettings `
  -WorkOrder "Validate Unity version metadata against public package metadata." `
  -AllowedPath "ProjectSettings/ProjectVersion.txt" `
  -TrustedOutputRoot C:\hades\Hecton8_PublicationWorkspace `
  -Force
```

## Add Scoped Files

1. Create a custom allow profile, for example `profiles/private-audio.allow`.
2. Add exact files or narrow directories.
3. Keep `profiles/private-slice.deny`.
4. Re-run the slice export.
5. Run gate and repo-isolation checks.
6. Initialize a fresh Git repo.

## Stop Conditions

Stop if the slice includes:

- production `.git`;
- vendor/plugin folders;
- raw production media;
- baked binary data;
- logs, reports, task status, archives;
- unrelated domains.