---
name: warden-bootstrap
description: Bootstrap the Warden control-plane on FreeBSD. Use when validating Bastille release state, creating or recreating the thick controlplane jail, applying ai.clawdie.si hostname, installing base packages, and proving the first jailed runtime path.
---

# Warden Bootstrap

Use this skill for the end-to-end control-plane bootstrap path on the FreeBSD
host.

## Scope

This skill covers:

- Bastille release bootstrap checks
- control-plane planning
- `controlplane` creation and recreation
- hostname application
- first package bootstrap inside the jail
- first jailed runtime validation

This skill does not replace:

- `warden-zfs` for dataset layout
- `bastille-network` for persistent host bridge setup
- `warden-pf` for NAT and firewall rules

## Canonical control-plane target

- jail: `controlplane`
- hostname: `ai.clawdie.si`
- release: `15.0-RELEASE`
- bridge: `warden0`
- host gateway: `192.168.100.1`
- jail IP: `192.168.100.100/24`
- provisioning: `thick`
- networking: `vnet`

## Workflow

1. Read `references/preflight.md`
2. Read `references/provisioning.md`
3. If you need package bootstrap details, read `references/packages.md`
4. If something fails, read `references/troubleshooting.md`
5. Prefer the scripts in `scripts/` to render plan/create/validate command sets

## Safe defaults

- use the canonical `controlplane` target
- recreate a wrongly provisioned thin control-plane jail instead of building on top of it
- apply hostname explicitly and restart the jail
- validate `jls`, `jexec`, and outbound network before moving to app runtime
