# AGENT INSTRUCTIONS — Overdeck K3s Phase 2

## Objective

Apply, verify and publish the Phase 2 deterministic node-enrollment planner from a fresh isolated worktree. Phase 2 is a **zero-mutation planning phase**: it does not join a machine, create a K3s token, change Kubernetes, change a candidate host, or publish the preview registries.

## Required files

Keep these files in the same directory:

- `overdeck-k3s-phase2-enrollment.zip`
- `apply-overdeck-k3s-phase2.sh`
- `overdeck-k3s-phase2-RUN-SHA256SUMS.txt`

## Default command

Run as the normal repository owner, never through `sudo`:

```bash
sha256sum -c overdeck-k3s-phase2-RUN-SHA256SUMS.txt
chmod +x apply-overdeck-k3s-phase2.sh
./apply-overdeck-k3s-phase2.sh /home/user/Projects/overdeck
```

The default command uses the sanitized `debian4` fixture. It proves packaging, repository application, deterministic planning, receipt validation, Git commit/push and draft-PR creation without contacting or modifying a real machine.

## Optional read-only candidate qualification

After the candidate OS and Tailscale are installed and reachable:

```bash
./apply-overdeck-k3s-phase2.sh /home/user/Projects/overdeck \
  --candidate debian4 \
  --live-candidate
```

This mode reads candidate, control-plane and registry state. It still cannot enroll the node or perform any mutation.

## Mandatory handling rules

1. Do not run the launcher as root.
2. Do not reset, clean, stash, rebase or commit in the shared checkout.
3. Do not copy registry previews over tracked registries.
4. Do not invoke hidden or invented apply flags; the Phase 2 entrypoint rejects them.
5. Do not merge the generated pull request until its result archive is reviewed.
6. Return the exact `overdeck-k3s-phase2-result-<timestamp>.tar.gz` printed by the launcher.
7. Preserve failed isolated worktrees and result archives for review.
8. Never include Tailscale auth keys, K3s tokens, kubeconfig credentials or private keys in the returned receipt.

## Success criteria

The launcher must report:

- every required package and repository gate passed;
- a 17-step deterministic enrollment plan;
- byte-identical repeated fixture outputs;
- unchanged source registry digests;
- preview candidate `execution=none`;
- all live/candidate/cluster/registry mutation flags false;
- `phase3_authorized=false`;
- independent receipt validation passed;
- an exact candidate commit and optional draft pull request;
- a sanitized result archive.

## UI boundary

Phase 2 changes no product UI, introduces no primitive and requires no Astryx component. The interactive HTML file is migration documentation, not application UI.