apiVersion: setup.aiwg.io/v1
kind: SetupManifest
metadata:
  name: obliteratus-dev
  version: 1.0.0
  description: Provider-orchestrated Linux setup with optional NVIDIA CUDA and scoped OpenBao runtime credentials.
  install_type: developer
  execution_mode: provider-orchestrated
spec:
  platforms:
    - os: linux
      arch: [x86_64, arm64]
      shell: bash
  params:
    - name: ENABLE_CUDA
      type: choice
      choices: [auto, "true", "false"]
      default: auto
      description: Install the matching CUDA PyTorch wheel when NVIDIA hardware is available.
    - name: ENABLE_OPENBAO
      type: choice
      choices: [auto, "true", "false"]
      default: auto
      description: Configure the scoped OBLITERATUS AppRole through the sibling itops repository.
    - name: OPENBAO_ITOPS_ROOT
      type: path
      default: "${HOME}/dev/itops"
      description: Trusted itops checkout containing OpenBao policy and token helpers.
  prerequisites:
    - name: python
      detect: "python3 --version | awk '{print $2}'"
      version_min: "3.10"
      install_hint: Install Python 3.10 or newer.
    - name: uv
      detect: "uv --version | awk '{print $2}'"
      install_hint: Install uv from https://docs.astral.sh/uv/.
    - name: git
      detect: "git --version | awk '{print $3}'"
      version_min: "2.30"
      install_hint: Install Git from https://git-scm.com/.
    - name: disk-space
      detect: "df --output=avail -BG . | tail -1 | tr -d ' G'"
      version_min: "12"
      install_hint: At least 12 GB free space is required for dependencies and a test model.
    - name: ram
      detect: "awk '/MemTotal/ {printf \"%.0f\", $2/1024/1024}' /proc/meminfo"
      version_min: "8"
      install_hint: At least 8 GB RAM is required; 16 GB or more is recommended.
  steps:
    - id: install-runtime
      type: script
      script: scripts/setup.sh
      verify: ".venv/bin/python -c 'import gradio, torch, transformers'"
    - id: configure-openbao
      type: agentic
      depends_on: [install-runtime]
      instruction: |
        When ENABLE_OPENBAO is true, or auto and OPENBAO_ITOPS_ROOT is usable,
        follow that repository's AGENTS.md and security SOP. Reuse or provision a
        least-privilege obliteratus-local AppRole restricted to reads of
        kv_internal/data/{huggingface/read-token,openrouter/automation-agent-key}
        and their exact metadata leaves. Seal the AppRole bootstrap to the host
        TPM when available. Install a mode-0700 OBLITERATUS_SECRET_COMMAND broker
        that maps only HF_TOKEN and OPENROUTER_API_KEY. Verify intended reads and
        an adjacent 403 denial. Never print secret values. Do not map the read-only
        HF token to HF_PUSH_TOKEN or OBLITERATUS_HUB_TOKEN.
    - id: verify-runtime
      type: script
      script: scripts/verify.sh
      depends_on: [install-runtime, configure-openbao]
  briefing:
    success: OBLITERATUS developer runtime is ready.
    next_steps:
      - Run installer/scripts/launch-local.sh and open http://127.0.0.1:7860.
      - Use a separate write-scoped HF_PUSH_TOKEN or OBLITERATUS_HUB_TOKEN only when testing Hub publishing.
  recovery:
    - id: reinstall-runtime
      steps:
        - id: reinstall
          type: script
          script: scripts/setup.sh