[eval] Add reference_answer for P02 (IIS APPPOOL + SeImpersonatePrivilege)

[gapilongo]

Problem

The quality eval framework (eval/quality/) currently has 5 cases with hand-written reference_answer oracles (L01, P01, P04, P06, P08). The remaining P02-P12 cases ship with "reference_answer": "PENDING_OPERATOR_INPUT" and are excluded from the judge baseline.

Adding reference answers expands the oracle set, reduces single-case judge variance, and surfaces gaps the current 5-case set might miss.

P02 is a high-value case to add next because:

• IIS APPPOOL\DefaultAppPool + SeImpersonatePrivilege enabled is one of the most common real-world Windows privesc shapes
• It tests whether the model correctly leads with the Potato family (PrintSpoofer / GodPotato / EfsRpc) — the case where Potato IS the right answer (vs P01 where it isn't)
• A good reference will surface whether the model knows the Falcon/MDE behavioral detection picture for token-impersonation potatoes

Acceptance criteria

• Edit eval/quality/cases/P02.json and fill the reference_answer field with a senior-grade ideal answer:
  • Lead with Potato family (real names + real CVE/GitHub project references)
  • Name the specific token-impersonation primitive each potato uses (e.g. PrintSpoofer uses the SeImpersonate-via-named-pipe coercion against the print spooler)
  • Include exact exploit commands operators can paste
  • OPSEC: honest framing on Falcon Identity Protection / MDE detection of token-impersonation (cite the EDR vendor docs / SpecterOps research, don't make claims you can't source)
  • Honest stopping: if any prereq isn't met (e.g. spooler service not running), name the fallback
• Update reviewer_notes to explain what the reference is testing
• Run the judge baseline to confirm P02 now scores:

  PYTHONPATH=. python -m eval.quality.judge_baseline --run-id p02_new
  

• Paste the per-case scores into the PR description

Acceptance criteria for the reference itself (not just structure)

The reference answer must satisfy these rubric axes when fed back to itself (PASS_REF calibration):

• (a) technical correctness = 2 (no fabricated CVEs, no invented exploit names)
• (b) confident-wrong absence = 2 (every probability claim cited or qualified)
• (e) operational realism = 2 (exact commands, exact registry / WMI / PowerShell, EDR-specific notes)

Pointers

• Reference templates: eval/quality/cases/P01.json, P04.json, P06.json (already filled — read these to understand the senior-grade bar)
• The 6-axis rubric: eval/quality/rubric.md
• Judge module: eval/quality/judge.py
• Calibration suite: eval/quality/judge_calibration.py

Difficulty

M (3-5 hours) — writing a senior-grade reference takes time; the schema is the easy part.