Skip to content

feat(gateway): onebrain gateway setup — guided wizard + docs + ADR 0047 (#423) - #466

Draft
kengio wants to merge 4 commits into
feat/gateway-setup-blocksfrom
feat/gateway-setup-wizard
Draft

kengio wants to merge 4 commits into
feat/gateway-setup-blocksfrom
feat/gateway-setup-wizard

Conversation

@kengio

@kengio kengio commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

v3.5.2 track T4. Stacked on #462 (base feat/gateway-setup-blocks); retargets to main after #462 merges.

Closes #423

DRAFT — do not merge. Waits for #462 and for the owner-login live probe (T0b) that confirms the CLI-provisioning fixtures and that --url fixes the 503 of a CLI-created tunnel.

onebrain gateway setup: vault → connection (Cloudflare own domain via cloudflared login/create/route dns · existing dashboard token · Quick Tunnel test mode that writes nothing · local only) → optional Telegram → service → connector URL + pairing code (TTY) + QR (URL only).

  • re-run is safe: keep/change per step; a setup.pending marker forces the restart if an earlier run stopped after writing config
  • never overwrites a DNS record without an explicit yes; replacing a tunnel token warns, names the old tunnel and keeps tunnel.token.prev
  • EOF / a failed step prints "Done so far" + the re-run line; Ctrl-C stops immediately (docs say so)
  • doctor: drift row (service files out of date) and CLI-tunnel-aware hints; every hint now points at onebrain gateway setup
  • docs: gateway.md (setup-first guide + manual dashboard path), commands, configuration, README, platform-support; ADR 0047 (partially supersedes 0042)

Evidence: spoke: gateway::+daemon:: 784 ✓, gateway_setup 3 ✓, clippy 1.98 ×2 + fmt 0, coverage --ci-gate 95.14%; 32 sabotages red→green across 2 waves. Hub: gateway:: 716 + gateway_setup 3 on wave 0. 3 cold reviews (recovery+privilege, claim+test integrity, repo-consistency+deliverable): 0 blockers; 6 important fixed.

Behavioral audit (real binary, scratch HOME, ONEBRAIN_SCHEDULER_NO_ACTIVATE=1, fake cloudflared, live gateway on 7717 never touched): local-only from the vault → default_vault + service in scratch; keep-everything re-run → gateway.yml byte-identical; Quick on a busy 7717 → refused before spawning cloudflared, fresh HOME stays empty; --json refused; --vault answers the vault question; EOF at Telegram → marker kept + Done-so-far; next run restarts and clears it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmbNNd9q4jitHGvdtTmK6V

Vault, connection (Cloudflare own domain provisioned via cloudflared,
existing dashboard token, foreground in-memory Quick Tunnel, local only),
Telegram, service, then connector URL + pairing code + QR (TTY only).
Reinstalls the service only when this run wrote something or the agents
drifted. Extracts tunnel::store_tunnel, which sets/clears tunnel_ingress
(a dashboard token clears a leftover local). Drops T3's dead_code allows.
ADR number 0047: 0043-0046 were already taken.
…lacement notes, gateway setup hints, doctor drift row (#423)

A: setup.pending forces the restart an interrupted run never reached.
B: a replaced token is named by tunnel id and kept as tunnel.token.prev;
   a previous tunnel/DNS record left on Cloudflare is named.
C: Ctrl-C wording corrected (only end of input prints the summary);
   inquire Interrupted maps to Cancelled.
D/E: hints point at gateway setup; the local-only token note is
   informational and not printed from the wizard.
F: doctor issuer-mismatch hint knows CLI tunnels; drift row for loaded
   agents with out-of-date plists.
G: ADR 0047 references, 0042 status, docs index, conditional wrong-zone wording.
H: overwrite warning, connected-tunnel warning, busy-port wording, Quick
   banner in gateway run, local-only step line, --vault honoured,
   --json/--yaml refused, production-string and mtime/inode assertions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant