| name | plane |
| description | Provision the fleet control plane's accepted bearer token, or serve the plane HTTP endpoint (stackctl plane provision-token | serve) — the fleet control plane a single operator's sidecars uplink to (specs/036-fleet-control-plane). Wraps `stackctl plane`. |
/stack-control:plane
Thin adapter over the stackctl plane verb. It fronts the two operator-run
subactions of the fleet control plane (specs/036-fleet-control-plane): placing
the accepted bearer token into an installation's machine-local custody, and
starting the runnable plane HTTP endpoint the fleet's sidecars uplink to.
Per .claude/rules/enforcement-lives-in-skills.md, this skill body is a thin
wrapper over stackctl plane — it adds no behavior the CLI lacks.
provision-token — place the accepted bearer token
stackctl plane provision-token --token <value>
Writes <value> into this installation's machine-local token custody
(.stack-control's sibling durable dir, 0600, never committed) — the same
credential plane serve --token later accepts and every sidecar presents on
its uplink (contracts/sidecar-plane-protocol.md § C6). Provisioning and
rotation are the same operation: re-running it overwrites the prior value.
- PT-015 (research.md): a single-operator fleet (FR-078) provisions the token
by an explicit operator-run verb — no join-code exchange, no automatic
enrollment.
- The token is a credential. This verb never echoes it to stdout/stderr,
on success or failure — only a confirmation message is printed.
- Revocation is plane-side (removing the token from the plane's accepted
set) — a separate concern this verb does not cover.
- Missing
--token, an unknown flag, or a stray positional is a usage error
(exit 2).
serve — start the plane HTTP endpoint
stackctl plane serve --port <n> --token <accepted-bearer>
Starts the runnable plane: seeds its accepted-token set with the single
--token mapped to this installation's id, roots the durable command store
under the machine-local durable dir, and listens on --port. The process
stays alive holding the server open until stopped (Ctrl-C / SIGTERM).
- Both
--port (an integer in 0..65535) and --token are required; a
missing value, an out-of-range port, an unknown flag, or a stray positional
is a usage error (exit 2).
--port 0 binds an ephemeral port; the bound port is printed to stdout on
startup. The token itself is never echoed.- Known seam: the accepted-token source is a single
--token — a
multi-installation fleet needs a per-installation accepted-token registry
(not yet built); the runtime already accepts a full token map, so widening
serve later is additive, not a rewrite.
Fail-loud cases (exit 2)
- Missing/unrecognized subaction (
provision-token | serve are the only
two).
provision-token without --token.serve without --port or --token, or with --port outside
0..65535.- Any unknown flag or stray positional on either subaction.
