Onboarding wizard and MA signup/enroll site

2026-09-15 09:35:24 -04:00
parent 1297766e8a
commit 15e5c6cbd7
12 changed files with 794 additions and 17 deletions
@@ -88,6 +88,7 @@ Decisions taken during design review, with rationale.
 | 17 | Lexical coverage gate before any rerank | Precision is project health; a demo false positive showed raw OR matching is too weak; embeddings later, local and replaceable | Implemented (`[match] min_coverage`) |
 | 18 | Default engine: boundary tokenizer + fold + stopwords + stemmer, title/phrase boosts, query-time snippets | The floor must be high out of the box; model-number and morphology matching are cheap wins with no model | Implemented (`src/tokenizer.rs`) |
 | 19 | Engine seam: `SearchEngine` trait with the responder path as the conformance wrapper | Plugins can change quality, never conformance; engines return `Option<total>` so an external engine can't fake the truncation bit | Implemented (`src/engine.rs`) |
+| 20 | Onboarding is a wizard consuming MA-issued credentials; signup lives on the MA's site | Users may be department-level and cannot create domains or DNS records; the wizard never creates identities, only binds locally generated keys | Implemented (`frxd --onboarding`, `/v1/signup`+`/v1/enroll`) |

 ## 8. Implementation status

@@ -102,6 +103,7 @@ Built and tested (99 tests):
 - Registry CLI (init/add/add-key/revoke-key/set-enc-key/set-relays/show/serve), key rotation
 - Aggregates (sent/passed, monthly floor, yearly rollup)
 - Encrypted unicast, TLS guardrails and custom CA support, static-build release profile
+- Onboarding wizard (`frxd --onboarding`) and MA signup/enroll site (`/v1/signup`, `/v1/enroll`, HTML at `/`)

 Not built (see §9): dashboard UI, directory watching, user-supplied URL ingestion, node-side rate limiting, member-hosted identities, delegation, document lineage, MA anchor rollover, embedding rerank, invite-based self-enrollment, relay-to-relay unicast routing.