docs: add §2a Prerequisites to AGENTS.md

Record the verified Phase 1-2 prerequisites from AUD-102: Go toolchain
(missing), Docker + compose, port 8792, the Caddy route mechanism,
pi-browser-harness, Compass URL and reachability, the credential/2FA
state, and Apprise. Mark the unverified items.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

AGENTS.md

@@ -35,6 +35,34 @@ Assistant calendar, and send the morning briefs.
 - The **React calendar** — that is a separate project. Do not build a calendar UI here.
 - The school's own systems. Read-only.
 
+## 2a. Prerequisites (verify before Phase 1)
+
+Check these first. The values come from the prerequisite check on `.13` (AUD-102).
+Items marked **not verified** need a decision or a test.
+
+| Need | Status / note |
+|---|---|
+| **Go toolchain** | **MISSING on `.13`** — `go` is not in the PATH, not in `nix-env`, and not in `/etc/nixos/configuration.nix`. Sam must add `go` to `environment.systemPackages` and run `nixos-rebuild switch`. Phase 1 can build in the `golang` Docker image instead. |
+| **Docker + compose** | Present on `.13`. Docker client and server 29.6.2, Compose 5.3.1. Run as user `sam` (in the `docker` group, no sudo). |
+| **Port 8792** | Free on `.13`. No listener and no container maps this port. Ports 8790 and 8791 are in use by other services. |
+| **Caddy route on `.35`** | Caddy runs as the Docker container `caddy` (v2.8.4) on `sam-Ubuntu1` (`.35`). Routes are site blocks in `/Docker/Containers/caddy/Caddyfile`, bind-mounted to `/etc/caddy/Caddyfile`. Use `school.lab.audasmedia.com.au { import basic-auth; reverse_proxy 192.168.20.13:8792 }`. **No `school.*` block exists yet** — Phase 1 must add one. Reload with `docker exec caddy caddy reload --config /etc/caddy/Caddyfile`. DNS for the name resolves (wildcard) to `144.6.86.11`. |
+| **pi-browser-harness** | Present on `.13` at `/home/sam/.agents/extensions/pi-browser-harness`, version 0.11.0. It is a **pi extension**, not a CLI. Load it as a package extension, then use the commands `/browser-setup` and `/browser-profile`. It exposes `browser_*` tools and drives a long-lived headless Chrome over CDP (`--user-data-dir=/home/sam/.chrome-pi`, debug port 9222). Session reuse works. **The extension is not enabled in this repo's `.pi/settings.json`** — Phase 2 must enable it before the login proof. |
+| **Compass URL + reachability** | **`https://nhs-vic.compass.education/login.aspx`** (Northcote High School). DNS goes to Cloudflare. TCP and TLS reach the edge, but the page returns `HTTP/2 403` with `cf-mitigated: challenge` (Cloudflare bot challenge). A real browser session is necessary. This is the Phase 2 risk. |
+| **Compass credentials + 2FA** | **NOT AVAILABLE** — no Compass, school, or child key exists in `~/.config/environment.d/10-secrets.conf` or its backups, and no school-named secret is in the instance config. Sam must supply the account name, the username, and the password as a **Paperclip secret** (or in `10-secrets.conf`). Never write them in this file. **2FA is not verified** — no login was attempted. Confirm whether Compass enforces 2FA or new-device email verification, and define the manual step. |
+| **Apprise** | Running on `.35:8210` (container `apprise`, host 8210 to container 8000). `GET /` and `GET /status` return 200. The Caddy route `apprise.lab.audasmedia.com.au` has basic auth. |
+
+**Gating read-out**
+
+- **Phase 1** is unblocked except for Go. Build in the `golang` Docker image, or ask Sam to install Go on the host.
+- **Phase 2** is blocked until Sam supplies a Compass credential and confirms the 2FA step. Phase 2 must also enable the `pi-browser-harness` extension in this repo.
+- The Cloudflare challenge is the main technical risk. Prove it first.
+
+**Not verified**
+
+- Whether Compass enforces 2FA.
+- The exact per-child account model.
+- Whether the headless Chrome profile clears the Cloudflare challenge (no login was attempted).
+
 ## 3. Users and roles
 
 | User | Can do |