feat(demo): opencode enrolls against a vanilla install and reports to the dashboard

[script-kid-io]

Returned from attic#99. This was #53 before the history reset (attic#31). ## What to build

Prove the opencode enrollment flow end to end against a vanilla install: a developer enrolls once, and what the agent does shows up in the dashboard.

The flow is designed and implemented — gibson login device flow, gibson agent enroll printing a one-time token, GIBSON_BOOTSTRAP_TOKEN=… opencode on first start to complete the Capability Grant handshake and persist a host key, then unattended forever. What has never happened is running it against a self-hosted install, because that profile has never been installed.

This is the demo's spine and the first half of the story: a coding agent joins a tenant's fleet on a person's authority, once, and everything it does afterwards is attributable.

Acceptance criteria

• gibson login completes against a vanilla install using the seeded first admin
• gibson agent enroll mints a one-time token, and opencode's first start completes the handshake
• A second start needs no token and no human — the persisted host key is doing its job
• opencode registers as a component and heartbeats; the dashboard lists it
• The LLM shim routes a completion through the harness, and it is traced
• The agent emits a finding that appears in the dashboard, attributed to the agent and the enrolling human
• The agent reads the tenant knowledge graph
• Steps that failed are written down, so the demo script is derived from what happened rather than from the design

Blocked by

• zeroroot-ai/deploy#1631
• chore(ci): arm the image-licence guard #52

[script-kid-io]

Claim 2026-09-21: agent 3 (session zero-day-ai-41) works this as part of the open launch-blocker set. One writer per repository: gibson items go in order #154, #32, #23, #21, then the epics.

[script-kid-io]

Housekeeping finding 2026-09-21, grounded against main.

Both "Blocked by" references are dead pre-reset numbers (deploy#1631, zerocool-plugins#52). The path the acceptance criteria describe exists on main: gibson login device flow and gibson agent enroll in adk, the bootstrap-token handshake in the SDK, opencode loading @zeroroot-ai/gibson-mcp (gibson#13 lane A7), and the vanilla install proven daily by hosted exit-test-baseline-install.yml. What has never happened is the run: no script, no recorded step list, no dashboard screenshot.

Unlike gibson#21 this half needs no external account. It could be an automated step on the baseline-install exit-test cluster: enroll a headless opencode with a minted token, second start with no token, assert the component heartbeats and a finding lands. Recommend: replace "Blocked by" with "None", keep ready-for-agent, and point the assignee at that shape rather than a manual run.

[script-kid-io]

Claim 2026-09-21 (session zero-day-ai worker, brief zerocool-10). I build the automated run as the housekeeping finding recommends. The job lives in zeroroot-ai/hosted as a new exit-test workflow on main and schedule only (ADR-0012). It reuses the vanilla bring-up of exit-test-baseline-install.yml and then proves, with a hard assertion on each step: gibson login as the seeded first admin, gibson agent enroll, the first start of the zerocool-agent image with GIBSON_BOOTSTRAP_TOKEN, a second start on the persisted host key, the component listed by the daemon with a fresh heartbeat, a completion through the SDK shim recorded as a trace, a finding attributed to the agent and the enrolling human, and one read of the tenant knowledge graph.

Walls I know before the first run: the vanilla profile ships no model slot, so the completion step needs a real provider key in the hosted repository. gibson#133 is closed by gibson#138 and v0.137.0 is what charts main pins, so the machine-user wall is gone. The device flow has a headless path through the cluster's own login-client credential and the Zitadel session API, so no person is needed for login.

[script-kid-io]

Progress 2026-09-21. The job exists and runs on main: hosted#148 (the workflow exit-test-demo-enrollment.yml, the drill test/demo/exit-test-enrollment.sh, the in-image probe, and docs/demo/enrollment.md), hosted#149 (a defect in the drill's own HOME handling). Run 35634482919 is the first run that reached the platform.

What it proved: the device flow needs no browser on the vanilla install. The cluster's own login-client credential opens a Zitadel password session for the seeded first admin and approves the CLI's device request through the Zitadel API. The CLI received a JWT and the api edge accepted it.

Where it stopped: ext-authz denied ListMyMemberships with caller_class=SERVICE allowed=USER. Since gibson#138 a token from any client not named in EXT_AUTHZ_HUMAN_CLIENT_IDS is a machine credential, and charts#118 names only the dashboard client. The native-login client that gibson login uses is not named, so every USER-only RPC denies the CLI and gibson agent enroll cannot run. The fix is a chart change and is filed as charts#148 with the exact env block. Steps 2 to 7 wait on it.

Second wall, known before the run: step 6 needs the repository secret EXIT_TEST_ANTHROPIC_API_KEY in zeroroot-ai/hosted. The vanilla profile ships no model slot. The step fails and says so until a person adds the key.

[script-kid-io]

State 2026-09-21 18:20Z. The automated drill exists on hosted main (exit-test-demo-enrollment.yml, hosted#148, #149, #152). Run 35634482919 got the vanilla install up, completed the gibson login device flow through the login-client credential, and was denied at ListMyMemberships: ext-authz classes the native-login client's token as a machine credential. That is charts#148 (one env entry in the ext-authz Deployment, now labeled launch-blocker, with Package A). The next run on main picks up charts main once it merges.

[script-kid-io]

Run 35638725251 (dispatched on hosted main after charts#149 landed): steps 1 and 2 pass. gibson login completes with no browser and pins the tenant, gibson agent enroll mints the token. Step 3 fails: the zerocool-agent image completes the capability-grant handshake (capabilitygrant: agent registered) and is then denied ComponentService.RegisterComponent by ext-authz. The gate needs tenant:<t> tenant_enabled component:_system, and nothing on the install writes that baseline. Filed as gibson#203 with the code trail. Steps 4 to 7 wait on it.

hosted#153 adds an OpenFGA tuple dump to the drill's failure path, so the next run confirms the missing tuple from the store rather than from the code.

[script-kid-io]

Run 35653353928 (charts main with gibson v0.138.0, hosted#154): steps 1 to 5 pass. Login with no browser, enroll, the first start with the token completes the handshake and persists the host key, the second start with no token registers on the key, and DaemonService.ListAgents lists the agent as healthy with a fresh heartbeat. The wall behind gibson#203 is gone with gibson#201.

Step 6 fails: EXIT_TEST_ANTHROPIC_API_KEY is empty in zeroroot-ai/hosted. A person adds the secret.

Step 7 fails twice. The probe sent a finding id that was not a UUID, so the daemon stored a stub under its own id (fixed in hosted#155, the probe now uses a UUID and polls the graph). And the stored finding carries no submitter: the daemon records no agent name or principal on a mission-less finding, so nothing in the graph says which agent raised it. Filed as gibson#208. The drill keeps asserting it and names the gap.

[script-kid-io]

Acceptance criteria against run 35653353928 (https://github.com/zeroroot-ai/hosted/actions/runs/35653353928, charts main, gibson v0.138.0):

• gibson login completes against a vanilla install using the seeded first admin. Step 1 PASS, and with no browser.
• gibson agent enroll mints a one-time token, and opencode's first start completes the handshake. Steps 2 and 3 PASS.
• A second start needs no token and no human. Step 4 PASS, the host key hash is unchanged.
• opencode registers as a component and heartbeats; the dashboard lists it. Step 5 PASS through DaemonService.ListAgents, the RPC the dashboard component list reads.
• The LLM shim routes a completion through the harness, and it is traced. Not run: EXIT_TEST_ANTHROPIC_API_KEY is empty on hosted. The owner item is hosted#123.
• The agent emits a finding that appears in the dashboard, attributed to the agent and the enrolling human. The submit reached the graph, but the probe sent a non-UUID id and the daemon stored a stub (hosted#155 fixes the probe). The stored record names no submitter (gibson#208). The identity half, created_by_subject, is asserted.
• The agent reads the tenant knowledge graph. The read-back ran before the graph write landed; hosted#155 polls. Proven on the next run or not.
• Steps that failed are written down. docs/demo/enrollment.md in hosted carries every run and every wall.

The issue stays open for the gated completion and the two graph criteria.

[script-kid-io]

Run 35658296827 (https://github.com/zeroroot-ai/hosted/actions/runs/35658296827, hosted#155 on charts main, gibson v0.138.0). The workflow now has two jobs. completion reads SKIPPED with the reason in the job summary (no key on hosted, hosted#123). enrollment:

step	result
1 login as the first admin, no browser	PASS
2 enroll, one-time token	PASS
3 first start with the token, host key persisted	PASS
4 second start, no token, same key	PASS
5 daemon lists the agent healthy, fresh heartbeat	PASS
6 completion through the shim	SKIPPED, gated on the owner's key
7 finding submitted and read back from the graph	FAIL

Step 7, root-caused in the daemon: the submit lands (finding queued for GraphRAG storage, id 299176b7-...), the graph projector writes the node every 5 seconds with brain_id and title, and both readers map id and name and search n.name. The read by id or title can never match. Filed as gibson#210. The submitter gap (no agent on the record) stays gibson#208. Steps 1 to 5 are proven on every run now.

[script-kid-io]

Run 35681085080 (charts main with gibson v0.138.1, pinned by zeroroot-ai/charts#151). Steps 1 to 5 PASS. Step 7 moved one assertion: the agent submits a finding, the graph returns it by id and title, and the record names the agent (gibson#211 and gibson#212 hold on a real cluster). The step then fails on the last assertion: the agent identity is not attributed to the enrolling person. ListAgentIdentities returned the identity under its IdP username agent-primary-zerocool-demo-... with no created_by_subject, though the daemon wrote the owner tuple at creation. Fix: zeroroot-ai/gibson#217, in the merge queue. The next pin after its release should turn step 7 green.

[script-kid-io]

The enrollment half is GREEN on main, 2026-09-22. Run 35725447902, charts main with gibson v0.138.2 (zeroroot-ai/charts#152).

step	result
1 login as the seeded first admin, no browser	PASS
2 enroll, one one-time token	PASS
3 first start with the token, host key persisted	PASS
4 second start, no token, registers on the host key	PASS
5 the daemon lists the agent healthy with a fresh heartbeat	PASS
6 a completion through the shim	SKIPPED, waits on the owner's model key
7 the agent submits a finding, reads it back, and resolves to the enrolling person	PASS
8 to 11 the GitLab tool call through the connector	SKIPPED, waits on the owner's GitLab token

Three product defects were found and closed to get step 7 green: gibson#210 (the graph writer stored brain_id and title, the reader searched id and name), gibson#208 (the component submit path recorded no submitting principal), and gibson#217 (ListAgentIdentities returned the internal username and never filled created_by_subject, though the daemon writes the owner tuple at create time).

The drill runs on every push to main and daily. What remains on this issue needs a person, and both items are on zeroroot-ai/hosted#123.