Prepare and designate the installation hub machine; create its runtime separately with virgo hub start.
MACHINES & RECOVERY
Measure the host. Resume the work.
A machine is replaceable capacity. Virgo records what it proves, pauses at human-only gates, and restores one fenced persona generation instead of trusting a process merely because it exists.
ONBOARD
Inspect before asking.
- MeasureCheck identity, SSH, absolute tool paths, runtime, services, store access, registration, and eligibility.
- PersistWrite a private onboarding manifest so an interrupted run resumes rather than restarts.
- GuidePause for credentials, network approval, OS permissions, trust, and first persona activation.
- VerifyRepeat the same execution-path probe before advancing; a click is not evidence.
virgo onboard
virgo onboard --profile ./machine.json --inspectFIRST OR JOIN
One structural fork, one exact release.
Record and verify the supplied hub address without guessing missing legacy state.
CLI, daemons, and web assets share one release SHA. Remote automation uses measured absolute paths; version skew is treated as a defect.
RECOVERY
Alive is not the same as authoritative.
Status and supervisors detect stale evidence, unhealthy runtime, or lost lease.
A concrete instance may consume only while its monotonic fence is current.
Pending deliveries are reclaimed through the durable queue, with the same side-effect key.
Restore the same persona lineage under a new valid fence and verified execution context.
Down, up, and cutover require an operation-bound CLEAR token. Recovery carries its own durable operation ID and never silently becomes a new venture.
macOS
Surface invisible consent before work depends on it.
Onboarding probes a protected folder through the same noninteractive SSH and absolute runtime path a persona will use. If TCC blocks it, the manifest pauses at Full Disk Access, guides the operator, and advances only when the identical probe succeeds.
Continue to diagnostics →