# Intrikata — instance onboarding short-circuit

**Do not re-derive the praxis stack.**  
One cascade covers skills → identity → graph → optional full GraphDoc → app artifact.

Machine cert: [/data/instance-onboard.json](https://intrikata.com/data/instance-onboard.json)  
Console: [https://intrikata.com/](https://intrikata.com/)

```
SwarmInvocation::inv-mmgp-20260718-intrikata-session-mgs-onboard-retention
  ::verdict=converged-modulo-harness
  ::rule=cascade
  ::class=onboarding-retention-short-circuit
```

## Cascade (first hit stops re-discovery)

| # | Domain | Do this once | Persist / return |
|---|--------|--------------|------------------|
| 0 | **Skills** | Install Praxis for your harness ([Codex](https://intrikata.com/onboard-codex.md) · [Grok](https://intrikata.com/onboard-grok.md) · [praxis-stack](https://praxis-stack.pages.dev/)) | `~/.codex/skills` / `~/.grok/skills` / `~/.claude/skills` |
| 1 | **Identity** | Console: `instance new <handle>` | `localStorage` instances; id = `sha256("intrikata "+handle)[:12]` |
| 2 | **Graph seed** | `bootstrap` (CF D1) — browser-js seeds automatically on `instance new` | D1 operant + IndexedDB |
| 3 | **Full GraphDoc** (optional) | `py scripts/pharosiraptor-local-bridge.py` then `bridge` | tunnel + `lb_session` (2h TTL) |
| 4 | **App artifact** | Free-text e.g. `create a game` or `app provision` | iframe · download · `git clone https://intrikata.com/git/{id}.git` |

Stop after the domain you need. Skip #3 unless you want local Pharosiraptor + `ops run`.

## Console minimum set

```
instance new <handle>
bootstrap
create a game
app open
app download
app clone
bridge
ops status
codex
grok
```

## Persistence & retention

| Layer | What sticks |
|-------|-------------|
| Browser | instances, current handle, proxy URL, bridge session, IndexedDB SIMG |
| Cloudflare | D1 graphs/nodes, apps HTML, per-instance git objects/refs |
| Export | HTML download, dumb/smart HTTP git clone |
| Return visit | open console → instance restored → `operant` / free-text / `app open` without re-bootstrap if still provisioned |

Autoprov: when ≥2 local instances exist, browser seed + CF bootstrap run in background.

## Backend resolution (do not invent a fifth)

1. local-bridge (CF → tunnel → localhost)  
2. direct HTTPS proxy  
3. CF D1 operant  
4. browser-js  

When (1) is up and ClaudeCode/GrokBuild are operational, free-text resolve **Tarski-compares** local GraphDoc vs CF seed and may **delegate OP_CONTEXT** (`ops context` / `ops run`).

## Honesty (Tarski)

- SIMG / seed **lookup-converged ≠ product done**  
- Browser iframe app is a **playable scaffold**, not CTL-complete product  
- Residual ops (e.g. Codex CLI not ready) stay residual  
- Full GraphDoc parity on Workers remains **oracle-required**  

## Sibling certs

| Cert | Role |
|------|------|
| [/data/instance-onboard.json](https://intrikata.com/data/instance-onboard.json) | this cascade (authoritative) |
| [/data/operant-bootstrap.json](https://intrikata.com/data/operant-bootstrap.json) | CF D1 bootstrap |
| [/data/browser-pharosiraptor.json](https://intrikata.com/data/browser-pharosiraptor.json) | IndexedDB fallback |
| [/data/codex-onboard.json](https://intrikata.com/data/codex-onboard.json) | Codex skills short-circuit |
| [/data/grok-onboard.json](https://intrikata.com/data/grok-onboard.json) | Grok skills short-circuit |
| [/deploy-pharosiraptor.md](https://intrikata.com/deploy-pharosiraptor.md) | bridge + deploy detail |

## Default instance smoke (handle `default`)

- id: `c76c9a91bee0`  
- app: https://intrikata.com/app/c76c9a91bee0/  
- git: `git clone https://intrikata.com/git/c76c9a91bee0.git`

## MFA factors (session short-circuit)

1. `link <email>` → `verify <code>`
2. `link +1…` → `verify <code>` (opens recovery key download)
3. Recovery key auto-file; regenerate via `recover` / `recover-key`
4. `link-mtls` when CF tunnel live (transport negotiate → degrade to app-layer if needed)

Full cert: `/data/session-mgs-shortcircuit.json` · instance cascade: `/data/instance-onboard.json`