Web first touch
From waitlist approval to a verifiable proof in the browser — OAuth, onboarding, bind, Hub, and Explore.
This is the shippable spine for humans who start on seifprotocol.com rather than in a terminal. CLI remains available for bind, push, and cycle close-ritual; the Hub does not pretend those are browser-complete yet.
The rail
Waitlist / invite → OAuth → engine session → onboarding
→ workspace + bind → Hub Propose → push/sync → Explore / verify| Step | Where | What you get |
|---|---|---|
| 1. Access | /waitlist then /auth/login | Approved email only (invite-gated today) |
| 2. Session | Auth.js + engine exchange | Stable Hub API calls (no endless engine_session_missing) |
| 3. Onboarding | /onboarding | Workspace → bind → optional pod → API key |
| 4. First proof | CLI bind/push + /explore | Evidence on the transparency log |
| 5. Daily work | Workspace Hub | Propose, Work, Assist, Access |
Accountability nouns (first viewport)
After login, the dashboard and first-run card surface four nouns — not a CLI catalog:
| Noun | Meaning |
|---|---|
| Workspace / Pod | Where the team’s store lives |
| Session | One human + AI work turn |
| Memory | Durable house doctrine |
| Record / Cycle | Delivery unit with a seal path |
CTA: Verify / explore → /explore.
Onboarding steps (honest)
-
Create or join a workspace in the Hub.
-
Bind your local clone (required for CLI push/log to match the Hub CAS):
seif init seif login seif workspace bind <workspace_id_or_user/slug> seif doctor seif push && seif log list -
Create a pod (optional) — groups related workspaces.
-
Mint an API key in Settings when tools need a bearer.
Time to first proof checklist (also on /onboarding): bind → push → open
/explore (or /dashboard/verify). If a step still needs the
terminal, the UI says so — it does not fake a browser-only close-ritual.
Sign-in and engine session
- Human login is OAuth (GitHub / Google when configured), gated by owner email or approved waitlist.
- After sign-in, seif-web exchanges for an engine session token (server-side
JWT claim) and proxies Hub calls through
/api/engine/*. - If the session token is missing, the proxy heals it and retries — you should not need to re-login solely for Hub API 401s.
Operators: see Access and roles for grant levels and how Hub auth relates to CLI API keys.
What stays in CLI / IDE
| Capability | Surface today |
|---|---|
workspace bind, push / pull | CLI |
| Cycle meditate / close-ritual / seal | CLI / IDE |
| Relay brief / handback | CLI / IDE |
| Live mesh session contribute | MCP / CLI |
Hub does create seed / session / pending / memory / memo / cycle contracts in the remote CAS after you approve Propose drafts.
Next
- Daily Hub loop: Hub without CLI
- Roles and invites: Access and roles
- Thin-client day loop (bind,
store normalize, push): CLI workflow - Operators on CLI: For operators