P0: broker mint one-use Mac private-network enrollment after customer approval

[100yenadmin]

Problem

Workbench can now distinguish an installed secure-network client that is not enrolled, but the broker has no explicit customer-click API for a one-use Headscale/Tailscale-compatible Mac enrollment. The existing create_enrollment action registers the evaOS Desktop Bridge connector; it is not private-network enrollment and must not be reused or conflated.

Required broker contract

• After an authenticated user click and exact customer/device selection, mint one short-lived, one-use private-network enrollment authorization.
• Bind it to the exact customer, device identity, supported client variant, intended control plane, expiry, and audit record.
• Return material only to the Workbench main process; renderer state receives typed progress only.
• Invoke the installed vendor client through an explicit approved app-bundled path.
• Never persist or log the control-plane URL, enrollment key, callback material, private address, raw command output, or customer data.
• Expire on use/cancellation/timeout; revoke stale pending material; wrong-network state must fail closed and require an explicit reconnect flow.
• Preserve current broker grants, Headscale ACLs, stop/revoke, kill-switch, and customer isolation.

Acceptance proof

• broker authorization, exact-scope, expiry, replay, cancellation, wrong-customer/device, and redaction tests;
• Workbench main-process tests prove the renderer never receives enrollment material;
• pristine supported-Mac enrollment with unavoidable macOS prompts and no Terminal commands;
• no ready claim until the separate authority evidence and P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655 live-tool gate pass.

Dependencies

• Parent P0: P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662
• Typed consumer: P0: add typed Mac onboarding prerequisites #664
• Local bridge evidence: P0: expose redacted Workbench readiness evidence electricsheephq/evaos-desktop-bridge#313
• Exact-candidate readiness exit gate: P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655

Proof boundary

Bridge connector enrollment is not secure-network enrollment. Source/UI tests are not a live Headscale enrollment or customer-ready claim.

[coderabbitai]

🔗 Related PRs

#391 - Restore beta3 Mac pairing baseline [merged]
#403 - fix: recover Mac control installed app states [merged]
#416 - Fix Mac control connector-service ready reconciliation [merged]
#417 - Fix Mac pairing reconnect session gate [merged]
#465 - Fix Mac connector readiness probe [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[evaos-code-review-bot]

evaOS issue enrichment

Issue: #666 - P0: broker mint one-use Mac private-network enrollment after customer approval
State: open; milestone: Workbench Runtime Reliability Release Train

Related issues/PRs: #655, #662, #664.
Existing labels: evaos, public-beta, ready-for-agent, area:broker, area:native-companion, risk:security, kind:integration, release-train:runtime-reliability, priority:P0.
Suggested labels: security, tests, support.
Suggested owners: none.

Related context

• P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.
• P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.
• P0: add typed Mac onboarding prerequisites #664 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.

Agent-start packet

Problem shape: P0: broker mint one-use Mac private-network enrollment after customer approval - ## Problem Workbench can now distinguish an installed secure-network client that is not enrolled, but the broker has no explicit customer-click API for a one-use Headscale/Tailscale-compatible Mac enrollment. The
Product fit: Product/UX-sensitive issue; review against repo vision and user flow quality, not only technical P0/P1 risk.
Implementation wedge: Ship the smallest user-visible path or prototype that can be smoke-tested against the intended experience.

Build / borrow / buy scan:

• Build: identify the smallest implementation wedge that proves the issue without broad rollout.
• Borrow: inspect same-repo prior art, repo memory, GitNexus context, and allowlisted cross-repo examples first.
• Buy/use: run capped external OSS/library/API/current-market research with citations, observed dates, and why each source matters.

Candidate sources:

• VISION.md / repo policy / repo-memory.md / GitNexus packet.
• Same-repo issues and PRs referenced by issue metadata.
• Allowlisted cross-repo GitHub examples with direct issue/PR/repo URLs.
• External OSS repositories or library/API docs with freshness dates.
• Current market/product examples, capped and cited, only when they change implementation direction.

Acceptance criteria:

• Preserve and execute the issue's stated acceptance criteria.
• Include source citations for any external OSS/library/current-market claims.
• Keep issue-enrichment comments sticky and idempotent.
• Keep labels, owners, reviewers, and roadmap fields suggestion-only.

Proof plan:

• Focused unit/fixture test for the changed planner behavior.
• Dry-run issue-enrichment evidence packet before live comment posting.
• Redaction check for issue body, citations, and generated markdown.
• UX/product smoke or screenshot proof when implementation changes user flow.
• Contract or degraded-mode proof before runtime promotion.

Known traps:

• Do not treat related links as proof by themselves; each source needs a reason why it matters.
• Do not scan old issue backlogs or exceed repo-level enrichment throttles.
• External research must stay capped, cited, fresh-dated, and redacted.
• Technical severity alone can miss product/UX regressions; include product-manager review framing.

Non-goals:

• Do not auto-apply labels, owners, reviewers, roadmap fields, or milestones.
• Do not bulk-enrich old backlog issues from this planner output.
• Do not claim external market or OSS research was performed unless cited sources are present.

Context-source taxonomy:

• [enabled] vision_repo_policy_memory_gitnexus: Use repo vision, policy, memory, and GitNexus first before external research.
• [enabled] same_repo_issues_prs: Issue metadata contains same-repo references.
• [enabled] allowlisted_cross_repo_github: Triggered by issue class; keep to configured allowlist and source caps.
• [enabled] external_oss_examples: Use for build/borrow/buy precedent with citations and observed dates.
• [enabled] library_api_docs: Use when implementation may depend on a module, SDK, API, or framework choice.
• [enabled] current_market_examples: Use for product/UX/market positioning issues with freshness dates.
• [enabled] internal_mcp_docs: Use internal docs/MCP context when available; missing context is degraded, not blocking.

Validation suggestions

• Confirm owner, acceptance criteria, and validation evidence before implementation.

Triage gaps

• Owner or reviewer signal not detected in issue body.

No labels, owners, reviewers, or roadmap fields were changed by this bot.