diff --git a/build.sh b/build.sh index 4ca73db..ada363d 100755 --- a/build.sh +++ b/build.sh @@ -1201,24 +1201,25 @@ EOF install_live_ai_source_snapshots() { echo " Installing live AI source checkouts..." - resolve_clawdie_ai_repo resolve_colibri_paths mkdir -p "${MOUNT_POINT}/home/clawdie/ai" cat > "${MOUNT_POINT}/home/clawdie/ai/README.txt" <<'EOF' Clawdie live AI source checkouts -These directories are included so the operator can start a local provider-backed -Pi session from the live XFCE desktop, inspect the shipped source beside the -running system, and fetch follow-up commits from Forgejo when network access is -available. +These directories are included so the operator can inspect the shipped source +beside the running system and fetch follow-up commits from Forgejo when network +access is available. No API keys, .env files, SSH private keys, build caches, package caches, tmp/ directories, or uncommitted worktree changes are included. Each checkout keeps a .git directory plus a .clawdie-source.json file recording the source remote, branch, commit, modified state, ISO version, and build channel at image build time. + +clawdie-ai (TypeScript) is no longer included — it is being phased out in favor +of the colibri (Rust) control plane. The `clawdie` name is retained as the brand +and bare-metal installer identity. EOF seed_live_ai_source_repo "${SCRIPT_DIR}" "clawdie-iso" - seed_live_ai_source_repo "${_resolved_clawdie_ai_repo}" "clawdie-ai" seed_live_ai_source_repo "${_resolved_colibri_repo}" "colibri" # zot source so the live rebuild lane can rebuild the agent (Go) too, not # just Colibri (Rust). Skipped automatically if the zot checkout is absent. diff --git a/docs/ONBOARDING-SIMPLIFICATION.md b/docs/ONBOARDING-SIMPLIFICATION.md new file mode 100644 index 0000000..798a311 --- /dev/null +++ b/docs/ONBOARDING-SIMPLIFICATION.md @@ -0,0 +1,89 @@ +# Onboarding Simplification — Decision Doc + +2026-06-22 | colibri#143 (zot-rpc-driver) | clawdie-iso + +## Context + +The ISO ships with a manual onboarding flow: operator opens START-HERE.txt in +Mousepad, types 3 Vaultwarden bootstrap credentials into a terminal +(`clawdie-join-hive`), waits for API key fetch, restarts the daemon. + +A zot extension was proposed as an interactive replacement. That was rejected +— the onboarding must be agent-independent (chicken-and-egg: zot needs +DEEPSEEK_API_KEY, which onboarding fetches), and the existing shell flow +already implements masked input, validation, and the full fetch→restart chain. + +The real lever is **removing the step**, not reskinning it. + +## Current state (proven, live) + +### Manual path (no seed partition) + +1. Operator boots ISO +2. START-HERE.txt opens in Mousepad (bootstrap autostart) +3. Operator double-clicks "Join Hive" on desktop +4. Prompted for BW_CLIENTID, BW_CLIENTSECRET (masked), BW_PASSWORD (masked) +5. `clawdie-vault-fetch` pulls API keys from Vaultwarden +6. `colibri_daemon` restarted +7. Pi agent auto-spawned and live + +### Seed partition path (one double-click) + +Identical except step 4 is skipped — the seed importer (`clawdie-live-seed`, +rc.d BEFORE LOGIN) already wrote the BW creds to provider.env. The operator +just double-clicks "Join Hive" and the fetch runs automatically. + +**Files:** + +| Component | Path | Role | +| ------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------------------- | +| Seed importer | `live/operator-session/clawdie-live-seed` | rc.d service, runs before login, mounts CLAWDIESEED, routes BW\_\* creds to provider.env | +| Vault fetcher | `live/operator-session/clawdie-vault-fetch` | Standalone: login→unlock→fetch keys by name→write env | +| Join Hive | `live/operator-session/clawdie-join-hive.sh` | Desktop launcher: checks for creds → prompts or auto-fetches | +| Seed README | `live/operator-session/clawdie-live-seed.README.txt` | Operator-facing seed partition instructions | + +## Remaining work: delete the click + +The seed partition path reduces onboarding to ONE double-click. Making it +zero-touch requires: + +1. **xdg autostart entry** — on first login, if BW\_\* creds are present in + provider.env AND `colibri_daemon` is not yet fully provisioned, auto-run + `clawdie-vault-fetch --write-env ` and restart the daemon. + +2. **First-boot guard** — run once per boot only (not on every login). A + sentinel file (`/var/db/clawdie/vault-fetched`) prevents re-triggering. + +3. **START-HERE.txt update** — remove the "add your 3 BW secrets" section + when the seed partition is present. Show a confirmation instead: + "Secrets loaded from seed partition. Colibri is starting." + +Estimated: ~30 lines of shell. + +## Related: one-secret path (future) + +The 3-credential bootstrap (BW_CLIENTID + BW_CLIENTSECRET + BW_PASSWORD) +could collapse to a single pasted token via `colibri-vault` tenant +provisioning. The vault would pre-generate a one-time enrollment token; +the operator pastes it once; the host exchanges it for permanent API +credentials. This eliminates the Vaultwarden account setup step entirely. + +Status: not yet designed. Depends on colibri-vault tenant provisioning +(colibri#91). + +## Zot extensions — verdict + +| Idea | Verdict | Rationale | +| -------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | +| Onboarding panel (zot ext) | ❌ Reject | Chicken-and-egg: zot needs secrets that onboarding fetches. Already solved by `clawdie-join-hive.sh`. | +| Guard (dangerous bash) | ⏸ Defer | Guards zot, not Pi (OOTB agent). String matcher is a nudge, not a boundary. Ship through first-party extension lane after zot is the runtime. | +| MCP bridge (zot↔Colibri) | ✅ Keeper | Sanctioned lane. Gated on zot-rpc-driver (colibri#143). First extension worth building — gives zot access to task board, vault, spawn, skills. | + +## Sequencing + +1. **Now** (no dependencies): seed-partition zero-touch — delete the one remaining + click. Biggest simplification, zero dependency on the zot saga. +2. **Gated on colibri#143**: MCP bridge extension — zot↔Colibri, gives zot + reason to be the runtime. +3. **After zot is OOTB runtime**: guard extension shipped through first-party + extension lane, paired with jail confinement for the real boundary.