---
title: 'Prepare the test environment'
type: 'chore'
ticket: '2'
created: '2026-10-15'
status: 'built'
baseline_revision: '840bea1cbaac1f32136399677d7ae8ef06ce532c'
route: 'oneshot'
route_source: 'auto'
risk: 'medium'
review: 'quick'
review_source: 'pinned'
lenses_ran: ['quick']
review_loop_iteration: 0
context:
  - '{project-root}/_bmad-output/architecture/architecture-ping-mee-self-service-platform-2026-10-15/ARCHITECTURE-SPINE.md'
---

<frozen-after-approval reason="human-owned intent — do not modify unless human renegotiates">

## Intent

**Problem:** Entries 4 and 5 need a test OU with a scoped service account, a dedicated OIDC application in the production authentik, the internal CA bundle, the Zoraxy route and a test mailbox. A person must create these in the production systems; none of it exists yet.

**Approach:** Provide a runbook, a domain-controller script that creates the test OU, service account, groups and test users with only the spine's delegated rights, and a verification script that proves the rights over LDAPS. The person runs them and writes down the values; this entry is done only when they confirm the verification passed.

</frozen-after-approval>

## Implementation Notes

Oneshot route: the output is documents and two PowerShell scripts under `docs/test-environment/`, no application code. The agent cannot reach the homelab from the development machine (it is on a different domain), and creating objects in the production directory is the person's action, so the scripts are not run by the agent. Syntax is checked with the PowerShell parser only.

## Plan Change Log

## Review Triage Log

Pass 1 (quick lens). Counts: high 1, medium 8, low 1, false 1.

| # | Finding | Verdict | Route | Evidence |
|---|---------|---------|-------|----------|
| 1 | The check script can print "All checks passed." when a request throws | high | patch | A .NET exception ends only the statement when `$ErrorActionPreference` is `Continue`; `Report` was never called. Fixed with `Stop`, try/catch around steps 2, 3 and 6. |
| 2 | Generated passwords are lost if a later step fails | medium | patch | Passwords were printed only after delegation; the setup now runs inside try/finally so they always print. |
| 3 | Checks test only one of six allowed attributes | medium | patch | The check now writes and restores all six; the header states what is not covered (create, delete, reset). |
| 4 | Read rights are not limited as AD-2 says | medium | defer | AD gives authenticated users broad read by default; the fix is to soften the spine wording, which is a spec edit. README states the fact. |
| 5 | `-WhatIf` on a rerun reports creating existing objects | medium | patch | Existence checks are read-only and now run in both modes. |
| 6 | Any error counts as "does not exist" | low | patch | `Test-Dn` now catches only the identity-not-found error; direct correction. |
| 7 | CA export may miss the intermediate chain | medium | patch | README now exports the whole chain and checks it with `openssl s_client`. |
| 8 | Redirect URI presented as final | medium | patch | README says the sign-in ticket will use this path and where to edit it. |
| 9 | Step D.1 may mean editing the production LDAP source | medium | patch | README now checks read-only first and stops if the source does not cover the test OU. |
| 10 | Port 8000 exposure not mentioned | medium | patch | README note: bind to 127.0.0.1 or firewall to Zoraxy. |
| 11 | Ticket numbering 1.2 / 1.5 inconsistent | false | rejected | `tickets.py` prints these refs (epic id, entry id). |

## Verification

**Commands:**
- PowerShell parser check on both scripts -- expected: no syntax errors

**Manual checks (if no CLI):**
- The person runs the setup script on the domain controller and the verification script from a machine that can reach it; every check prints PASS.