# Install the AbleTrace skill and connect InfoPol (runbook for AI agents)

You are an AI coding agent (Claude Code, Codex or similar). Follow these steps to install the AbleTrace skill, version `kb-2026.6`, and connect the InfoPol MCP server. Everything is served from `https://infopol.ee`. Stop at the first failure and report it; write nothing on failure.

The human reading along can find the explanation at https://infopol.ee/en/ai/connect.

## What gets installed

- The AbleTrace skill: 29 markdown files (instructions, framework catalog, working methods). No code runs from the skill.
- Nothing else. The skill never writes to InfoPol without the user's per-item approval.

## Prerequisites

- A shell and Node.js 18 or newer (`node --version`).
- An InfoPol account whose organisation administrator has enabled MCP access (see https://infopol.ee/en/ai/mcp).

## Steps

1. Fetch the verifier over HTTPS and save it as `abletrace-verify.mjs` in a temporary directory:

   `https://infopol.ee/ai/skills/abletrace/abletrace-verify.mjs`

2. Run it. It reads `latest.json`, fetches the manifest, checks the manifest's sha256 against `latest.json`, downloads every file, checks every file's sha256 and size, and only then writes the files. Do not check anything yourself; the script is the verifier. (The script itself comes from the same origin and is not separately verified; tell the user if they want to read it first.)

   ```
   node abletrace-verify.mjs --base https://infopol.ee --expect-version kb-2026.6 --install ~/.claude/skills/abletrace
   ```

   For Codex or another harness, change the `--install` directory to that harness's skills directory.

3. Success prints `Installed abletrace kb-2026.6: N files -> <dir>` and `OK kb-2026.6 N files`. Any other outcome means nothing was written: stop and report the `VERIFY FAIL:` line to the user.

4. Add the MCP server to the harness: name `infopol`, transport Streamable HTTP, URL `https://infopol.ee/api/mcp`. Authentication is OAuth with the user's own InfoPol account; the user signs in in the browser. Do not ask for or store API keys.

5. Restart or reload the harness so the skill is picked up, then ask the user to start with: "Use the abletrace skill to look at my InfoPol setup."

## Where the files are

- Pointer: https://infopol.ee/ai/skills/abletrace/latest.json (version and manifest sha256)
- Manifest: https://infopol.ee/ai/skills/abletrace/kb-2026.6/manifest.json (every file with sha256 and size)
- Files: https://infopol.ee/ai/skills/abletrace/kb-2026.6/<path from the manifest>

## What the check does and does not prove

HTTPS plus checksums proves the files you installed are exactly the files the manifest lists, and that they were not corrupted or half-updated in transit. It does not prove the files are the ones InfoPol intended if infopol.ee itself were compromised, because the manifest comes from the same origin. There is no signature. If that matters to the user, they can compare the manifest sha256 in `latest.json` with a copy obtained another way, or read the markdown files before use.