| name | gds-bootstrap-device |
| description | Use this skill only when the owner explicitly asks to install or verify GDS, its pinned bundle, and selected harness projections on a new macOS, Linux, server, or CI device. Build an exact reversible plan and keep secrets in approved stores. Do not use it to clone every estate repository or change global tools silently. |
| disable-model-invocation | true |
Contract
Create a reproducible device control-plane installation from a trusted
immutable bundle.
Use when
- A new device or server must be prepared for selected GDS workflows.
Do not use when
- Only repositories need materialization.
- Device-local installation approval is absent.
Inputs
- Device identity/profile, OS/architecture, bundle identity, and selected harnesses.
- Approved secret references and installation roots.
Preconditions
- Inspect existing tools, paths, configs, and conflicts without changing them.
- Verify bundle digest, provenance, release sequence, and platform support with
gds release verify.
- Produce the installation plan with
gds release install --plan and obtain
approval before any mutation.
Workflow
There is no single bootstrap verb; a device is brought up through the staged
release, estate, and harness command families and approved at each apply.
- Install the pinned immutable bundle:
gds release install --apply <plan> --approval-ref <ref>,
then gds release install --verify <operation-id>.
- Register the device-local control plane:
gds workspace register-estate --plan,
then --apply <plan> --approval-ref <ref>, then --verify <operation-id>.
- Generate device-local harness projections for the selected harnesses only:
gds harness render then gds harness install — without modifying canonical sources.
- Run GDS and harness doctor tests.
- Preserve an exact uninstall/rollback record.
Stop conditions
Stop on untrusted artifact, unsupported platform, config collision, secret leak,
hook trust failure, stale plan, or unexpected system write.
Verification
Verify CLI identity, bundle lock, harness discovery, explicit-only skills,
permissions, and rollback in an isolated test where possible.
Output
Return installed paths and versions, trust evidence, selected profiles,
runtime tests, user trust actions, and rollback instructions.
References
Use only the pinned bundle, device profile, and selected harness profiles.
