Install & infrastructure

Bootstrap the ring.

For: operators standing up or recovering a ring

With the desktop host installed and Azure provisioned, the last step is to bring the agents to life. Bootstrap is a single ceremony driven by a workflow configuration: it validates everything first, spawns each role and waits for it to report healthy, runs the safety gates, and hands off to the always-on Ticker. It is idempotent and it fails safe — a bad config halts the ceremony before any agent is spawned.

Validate before spawn Health-ack each role Three greens to finish
🪜 The order of operations 🔍 Validate first 🐣 Spawn the roles 🚦 Three greens ⏱️ Start the Ticker

The simple path

With the desktop host installed and Azure ready, bringing the ring to life is one ceremony. Open an Operator session in your AI host (load the operator / orchestrator role) and give it the prompt below.

Role to load: Operator (orchestrator)

Paste this to the Operator session:

Bootstrap the ring for the <workflow-name> workflow. Follow the fixed order and fail safe at every stage:

1. Validate the configuration end to end — each layer on its own, the layers' consistency with each other, and that the database, Key Vault, and tool servers actually resolve. On a FAIL, halt and spawn nothing; record the failure.
2. Probe the database before any role uses it; abort on failure.
3. Spawn each role marked to start in the workflow — loading its role brief and model — and wait for a healthy context-health ack from each before moving on. If a role comes up unhealthy, its brief is missing, or the ack times out, halt and roll back the roles already spawned. Never fall through to a default.
4. Run the three safety gates — secret scan, kernel-purity scan, config validator. They always all run; any failure blocks completion.
5. When all three are green, start the always-on Ticker and report the peer session IDs.

Give me a short status at the end: which roles came up, the gate results, and whether the Ticker is running.

Replace <workflow-name> with your workflow (the set of roles to spawn). The full step-by-step mechanism is below.

The order of operations

Bootstrap runs in a fixed sequence, and each stage can stop the whole thing. Validation comes before anything is spawned; the database is probed before any role tries to use it; each role must report healthy before the next is started; and the safety gates must all pass before the ceremony is considered complete. 

flowchart TB
  START([📞 Operator: bootstrap the ring]):::start

  V{"1 · Validate config
layers + reachability"}:::step
  V -->|✅ pass| P
  V -->|❌ fail| HALT1([⛔ HALT
spawn nothing]):::halt

  P{"2 · Probe database
can we reach it?"}:::step
  P -->|✅| S
  P -->|❌| HALT2([⛔ ABORT]):::halt

  S{"3 · Spawn each role
wait for health-ack"}:::step
  S -->|✅ all up| G
  S -->|❌ any red
or ack timeout| RB([🔄 Roll back
spawned roles]):::halt

  G{"4 · Three greens
secret · purity · validator"}:::step
  G -->|✅✅✅| T
  G -->|❌ any| BLOCK([⛔ Block completion]):::halt

  T(["5 · Start the Ticker
🚀 Ring is live"]):::done

  START ==> V

  classDef start fill:#fce4ec,stroke:#b11f4b,stroke-width:2.5px,color:#7a1132
  classDef step fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a8a
  classDef halt fill:#fee2e2,stroke:#dc2626,stroke-width:2px,color:#7f1d1d
  classDef done fill:#dcfce7,stroke:#16a34a,stroke-width:3px,color:#14532d

1 · Validate first

Before a single agent is spawned, the configuration is validated end to end. The validator checks each layer of configuration on its own, checks they are consistent with each other, and probes that the things they reference — the database, the secret store, the tool servers — are actually reachable. A failure here halts the ceremony; no roles are spawned, and the failure itself is recorded so it is traceable.

What it checks

  • Each configuration layer is well-formed on its own
  • The layers are consistent with each other
  • Referenced secrets, database, and tool servers resolve
  • A fingerprint over the layers detects drift

Outcomes

  • Pass — continue
  • Warn — surface the warnings, continue
  • Fail — halt; spawn nothing; record the failure

2 · Spawn the roles

With the config valid and the database reachable, bootstrap spawns each role marked to start in the workflow — loading its role brief and the model it runs on. Each freshly-spawned role must report a healthy context health ack before the ceremony moves on. A role that comes up unhealthy, or whose brief is missing, halts the run and rolls back the roles already spawned — bootstrap never falls through to a default.

Per-role sequence

  • Load the role brief and model from the workflow config
  • Spawn the session
  • Wait for a healthy context-health ack
  • Record the session; move to the next role

Fail-safe behaviour

  • Unhealthy ack → halt and roll back
  • Missing brief → halt and roll back
  • Timeout or malformed ack → halt and roll back
  • No silent fallback to defaults — ever

3 · Three greens

Bootstrap does not complete on spawned agents alone. Three independent checks must all pass — and they always all run, so one failure never short-circuits the others. Any failure blocks completion; the operator remediates and re-runs.

Secret scan

Greps the corpus and the audit columns for anything that looks like a leaked secret. A suspected leak fails the gate.

Kernel-purity scan

Confirms the engagement-agnostic "kernel" contains no customer-specific values — those belong only in the pack overlay.

Config validator

The same end-to-end validation from step 1, re-run as a gate so a config that drifted during setup is caught.

The same gates onboard an engagement. These three greens also guard engagement onboarding — the system uses one safety bar for both standing up a ring and standing up an engagement.

4 · Start the Ticker

Finally, the always-on Ticker is started — the session that will fire the recurring routines from here on. Whether those routines actually run on a schedule, or only on-demand, is an operator posture decision; starting the Ticker makes the cadence possible, not automatic.

Recovery is the same ceremony. Bringing a ring back after a laptop loss runs these exact steps — restore the corpus, re-authenticate, then bootstrap and start the Ticker. There is no separate recovery path to maintain. See Operations for the full runbook.

See the ring in action → · Meet the roles you just spawned →