# F0 Delegated Graph Spike Setup

The Graph workbook APIs used by Sibyla require a delegated work or school
identity. Application permissions are not supported for workbook sessions or
table-row operations.

## Entra application

Create a dedicated single-tenant application registration named
`GOTT Sibyla Delegated Excel`:

1. Under **Authentication**, enable **Allow public client flows**.
2. Under **API permissions**, add Microsoft Graph **Delegated**
   `Files.ReadWrite.All`. The target is a SharePoint document-library workbook,
   not a file owned by the delegated account; this scope remains limited by the
   signed-in account's effective SharePoint access.
3. Do not create a client secret or certificate for this public client.
4. Do not add **application** permissions such as `Files.ReadWrite.All` or
   `Sites.ReadWrite.All`.
5. Grant consent according to the tenant's delegated-consent policy.

The delegated identity must also have effective SharePoint access to the workbook's
site or document library. Some SharePoint access-control policies cannot be
overridden by an item-only sharing invitation; in that case, grant the identity the
smallest appropriate site/library role or place the acceptance copy in an accessible
library.

For the current F0 target, `sibyla@gottsolutions.net` has effective access through
the `Itoorer Master` site and its `Documents` library at:

`https://itoorerie.sharepoint.com/sites/ItoorerMaster`

Store the new application and tenant IDs for the current Windows user:

```powershell
[Environment]::SetEnvironmentVariable(
    "SibylaGraphSpike__TenantId",
    "YOUR-TENANT-ID",
    "User")

[Environment]::SetEnvironmentVariable(
    "SibylaGraphSpike__ClientId",
    "YOUR-PUBLIC-CLIENT-ID",
    "User")
```

Do not reuse `ExcelCommit__MicrosoftGraph__ClientSecret`. The v3.2 delegated
path has no client secret.

## Bootstrap and run

Initialize delegated consent, the CurrentUser-DPAPI token cache, the dedicated
workbook-copy schema baseline, and the F0 `MST_ID` marker:

```powershell
dotnet run --project tests\Sibyla.GraphSpike\Sibyla.GraphSpike.csproj -- --initialize
```

After completing device-code sign-in, run the live idempotency proof from a new
process. This verifies that MSAL can acquire the delegated token silently from
the DPAPI-protected cache:

```powershell
dotnet run --project tests\Sibyla.GraphSpike\Sibyla.GraphSpike.csproj
```

The runner refuses to operate when its item ID matches the configured original
workbook and also requires the target filename to start with
`Sibyla_F0_GraphSpike_`.