feat(harness): /orchestrator:provision — guided dedicated-server onboarding - #205
Merged
Conversation
…onboarding (issue #204) Turns docs/HARDENING.md's 'dedicated Linux server' worked example into an interactive, checkpointed, resumable command: one interview, eight phases (prereqs, agent user, fresh credentials, agent clone, managed settings, harden+arm, optional egress/detection, final verification), progress tracked in .claude/state/provision-progress.json. HARDENING.md stays the source of truth; the command executes it — same contract as /orchestrator:harden. Adds a pointer line at the top of the worked example. Closes #204 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FozLCW3EkDbnZaiaiPjSxL
robercano
approved these changes
Aug 1, 2026
…SH layer, register the command (issue #204) Follow-ups on PR #205 found in review: - The interview collected the optional remote-SSH layer but no phase executed it: add Phase 8 (docs/REMOTE_SSH_RUNBOOK.md walkthrough with verification + Phase 2/7 interplay notes); final verification is now Phase 9 and re-checks the runbook's §6 posture block. - Register ./commands/provision.md in plugin.json's commands array so consumer installs expose /orchestrator:provision like the other three. - CHANGELOG: add the [Unreleased] entry. - Fix interview pointing at Phase 3 for the clone (it happens in Phase 4) and state the onboarding precondition (gates.json + arm-loop.sh must exist — /orchestrator:setup first). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017k7HtdHgtG6WcHGrW1knJg
…ential steps HARDENING.md worked example step 2 becomes the canonical mint walkthrough: fine-grained PAT click-path with the exact repository-permission table (Contents/Issues/Pull requests read-write, Metadata read, Workflows read-write only if the loop may push .github/workflows/ changes — the workflow-scope push restriction), expiry guidance, and the separate classic repo-scope GH_BOT_TOKEN recipe with the why-classic rationale. /orchestrator:provision Phase 3 prints that walkthrough verbatim; /orchestrator:setup step 7's action-needed path now lists the full bot-account walkthrough (machine account, write-collaborator invite, classic token, .env) instead of a parenthetical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017k7HtdHgtG6WcHGrW1knJg
…m the bot token Genericity sweep before the machine migration: - pr-ci-fix.sh / pr-comment-fix.sh / pr-rebase.sh / pr-feedback.sh no longer fall back to a hardcoded personal bot login; when BOT_LOGIN is unset they resolve the login from the bot token itself (bot-gh.sh api user), so consumer repos never silently filter for the plugin author's bot. Failure mode improves too: a missing/invalid GH_BOT_TOKEN now fails loudly instead of proceeding with a wrong default and matching zero PRs. - .env.example: replace concrete logins with placeholders and document the new derived default. - Kept as-is (deliberate, not machine-specific): authorship in LICENSE/README/plugin manifests, robercano/reCode self-references (feedback target, install snippets, test fixtures), and the site's branding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017k7HtdHgtG6WcHGrW1knJg
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #204.
What
A new guided command
/orchestrator:provisionthat walks a human through provisioning a fresh dedicated Linux box for the autonomous loop, executingdocs/HARDENING.md→ Worked example: dedicated Linux server end-to-end. Same contract as/orchestrator:harden: HARDENING.md stays the source of truth, the command materializes it.docs/REMOTE_SSH_RUNBOOK.md)..claude/state/provision-progress.json.Docs
One pointer blockquote at the top of the worked-example section in
docs/HARDENING.md.Follow-up commits (review round)
3cae3cf— the interview's optional remote-SSH layer is now actually executed (new Phase 8 walkingdocs/REMOTE_SSH_RUNBOOK.md, with verification; final verify is Phase 9);provision.mdregistered inplugin.json'scommandsarray; CHANGELOG[Unreleased]entry; interview phase-number fix + onboarding precondition.1eff37e— explicit GitHub PAT mint walkthroughs: HARDENING.md worked-example step 2 carries the fine-grained-PAT click-path + exact permission table and the classicrepo-scope bot-token recipe; provision Phase 3 prints it;/orchestrator:setupstep 7 spells out the bot-account walkthrough.91df113— genericity sweep for the machine migration:BOT_LOGINdefault inpr-ci-fix/pr-comment-fix/pr-rebase/pr-feedbackis now derived from the bot token instead of a hardcoded personal login;.env.exampleuses placeholders.Gates
self/checks.sh build/lint/testandself/smoke-fanout.shpass locally on every commit.🤖 Generated with Claude Code
https://claude.ai/code/session_01FozLCW3EkDbnZaiaiPjSxL