[tee8z]

Problem and behavior

Paseo developers need a terminal setup path that keeps Buzz apps usable. buzz onboard creates or imports an identity, enrolls credentials, and registers agents through the same signed events and manager requests as GPUI.

Step	Result
Identity	Private local key, community membership, and profile. WSS only.
Credentials	GitHub, model, and 1Password credentials sent through encrypted enrollment.
Agents	Presets, channel membership, and a first thread launch that registers each agent.
Enrollment	Actionable guidance for every manager refusal, including Secret storage failure. GitHub signing-key registration happens after enrollment succeeds.
Gateway	Validates the returned gateway public key. Until the gateway SDK lands, prints membership steps and the exact grant command under Action needed. Never reports an unpublished grant as successful.
Pairing	Password, offer link, QR code, and desktop, web, mobile, workflow, and Buzz-app instructions.

Saved progress makes interrupted runs resumable. Credentials are not saved or echoed. Owner and agent identity keys remain in private local files, as documented.

The default and maximum gateway lifetime is 90 days. --gateway-expires shortens it; --skip-gateway-grant explicitly defers it.

Validation

• cargo fmt --all, cargo clippy -p buzz-cli --all-targets -- -D warnings, and git diff --check passed.
• cargo test -p buzz-cli: 516 passed. Twelve onboarding tests cover first run, resume, app compatibility, failures, secret redaction, all enrollment refusals, pairing, and gateway guidance.
• Guard mutations failed their tests: lifetime cap, owner/agent key refusal, and malformed gateway field refusal. The future grant publisher is a test boundary; the real SDK is still absent from this branch.
• Repository-wide just ci was started, then stopped during workspace clippy to preserve memory and disk for concurrent integration builds. The full gate remains incomplete.
• Earlier runtime smoke verified WSS refusal and the private-file/member-probe path. This revision has not enrolled a developer or launched a staging sandbox.

Dependencies and remaining acceptance

• #150 supplies Secret-backed pairing and gateway_pubkey.
• Gateway authorization is a separate PR. Until included, run the printed command using a gateway-enabled build. The gateway also needs explicit community and channel membership.
• Agents added after daemon startup require a daemon restart to refresh its provider list.

Human acceptance: run buzz onboard against the intended community, complete enrollment and first start, pair Paseo from the offer, then rerun and verify completed steps are preserved. Check the same agents in a Buzz app.

Draft pending final integration checks and human testing. No cluster changes.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Independent agent review of 9345a10fc against the onboarding goal and remote-agent contract. I traced the current enrollment, manager Secret, launch, membership and future SDK paths. These findings are from code review; I did not enroll a live developer.

Three blockers:

1. Retrying first start can create a second thread and Sandbox. steps_agents.rs:318 creates a fresh signed kickoff for every pending attempt. Its event ID becomes the deployment's immutable thread scope. If the manager starts the Sandbox but returns paseo_store_failed, or its successful reply is lost, registered remains false. Rerunning generates another root and deploys another Sandbox instead of retrying the original scope. Persist the signed kickoff/root before publishing or deploying, and reuse it until success. Extend the journey to cover committed launch plus lost reply and paseo_store_failed; both retries must keep the same thread and Sandbox.

2. An unchanged enrolled profile cannot provision a newly enabled or rotated Paseo Secret. steps_enroll.rs:33 skips enrollment whenever credentials have not changed. In feat(sandbox-manager): provision per-developer Paseo daemons #150, describe reads an existing daemon Secret; only enrollment creates it. An existing developer who enrolled before Paseo was enabled, or whose Secret was deleted for documented rotation, gets no pairing on every unchanged rerun. Previously registered agents also skip first start. Add an explicit idempotent re-enrollment/provisioning path when pairing is missing or --reenroll is requested, using an unchanged valid profile patch if needed. Test successful onboarding, missing Secret, and a credential-free rerun that restores pairing.

3. Provisioning decisions can use stale replica results. relay.rs:179 sends provisioning lookups through the default routed query path. A lagging replica can hide an existing app agent, or hide a newly created channel after local state saving failed. The wizard then creates duplicates, contrary to its resumable setup contract. Pin these decision reads with "consistency":"strong"; assert this at the HTTP boundary and cover stale-replica responses in a resume journey.

Optional follow-ups:

• Before enabling the real gateway SDK boundary, revalidate a saved grant against the relay. steps_gateway.rs:45 currently trusts local expiry after external revocation. Production Unreleased cannot currently create this saved state, so this is not a blocker for this revision.
• register_signing_key treats “already on a GitHub account” as success without checking that the key is listed on the intended account. Preserve the pending record unless the intended account actually owns that public key.
• Credential validation and mapping duplicate manager/profile schemas. Consolidating the shared contract later would reduce drift; this is optional and does not require expanding this PR.

Scores: minimalism 8/10 for duplicated profile mappings; elegance 8/10 for missing durable launch identity; correctness 7/10 until the three blockers are fixed. The fixes above address the concrete defects; optional suggestions do not gate readiness.

[tee8z]

Superseded by #158, which preserves this published work with signed cherry-picks and adds the real gateway SDK on top of #154. The retry, Secret reconciliation, and writer-consistency review blockers are fixed there. No history rewrite, merge, deployment, or human-testing attestation was performed.