feat(installer): reorder — sign in + provision the client before Helm (#838)

[LukasWodka]

What

RFC-0001 #838 (epic backend#830): reorder the installer so the client is provisioned before Helm — the minted credential + derived namespace feed the chart.

New flow in install-k8s.sh:

create_cluster → provision_client (Step 3) → install_client_helm (Step 4/5)

provision.sh (new) — provision_client

• Browser-auth path: install the CLI (now FATAL — it mints the credential, vs the old non-fatal post-Helm Step 5) → tracebloc login (device flow) → tracebloc client create --credential-file <f> → source the 0600 file → export TRACEBLOC_CLIENT_ID + TRACEBLOC_CLIENT_PASSWORD + TB_NAMESPACE into install_client_helm's existing non-interactive env contract. The credential is never printed; the transient file is removed after sourcing and on any error/signal (a failed mint never leaves a secret-bearing file behind).
• Adopt (re-run): no fresh credential (the existing one stands) — hands only TB_NAMESPACE and lets install_client_helm reconcile from the local values.yaml.
• Dual-mode preserved: TRACEBLOC_VALUES_FILE or pre-supplied TRACEBLOC_CLIENT_ID+PASSWORD skip sign-in entirely (still install the CLI, non-fatal) — exactly the prior behavior. Unattended installs use this path.

Also: install.sh fetches provision.sh; common.sh print_roadmap renumbered to match (3 sign-in/provision · 4 install · 5 connect) and install_cleanup shreds the transient credential on exit; the step headers + the trailing CLI install were updated/removed.

Tests

scripts/tests/provision.bats (8): dual-mode skip (creds + values), mint hands all three env vars, adopt hands only the namespace, fatal on missing CLI / failed login / no credential file, and a failed create leaves no credential file behind. The install-cli, install-client-helm, and common (install_cleanup) suites stay green; shellcheck clean on provision.sh. (The 2 suite failures — validate_config: valid config passes and _extract_yaml '' escape — are pre-existing on develop, unrelated to this change.)

Gate + deferred

• Runs end-to-end once the CLI release ships login + create + --credential-file (cli#104 merged; install-cli.sh fetches releases/latest).
• Adversarially reviewed (reorder/dual-mode safety, credential-handoff security, bats+integration); the should-fix items (cred-file cleanup on error, stale roadmap) are folded in.
• Deferred (noted, follow-ups): a non-interactive enroll-token login for fully unattended browser-auth installs; the R7 orphan-resume edge (adopt on a rebuilt host with no local values.yaml → it currently falls through to the existing credential prompt).

🤖 Generated with Claude Code

[saadqbal]

Review summary

Read the diff + surrounding code, ran the suite and shellcheck locally (isolated worktree), and verified the cross-repo CLI contract. Careful, well-tested PR with honest disclosure of its gates. All 8 provision.bats pass, install-cli/common suites green, provision.sh shellcheck-clean, and the 2 suite failures it calls out are genuinely pre-existing (the diff doesn't touch validate_config / _extract_yaml_value).

Verified good

• Env handoff matches install_client_helm's existing _noninteractive_creds path (ID + PASSWORD → =1; adopt unsets both → values.yaml path).
• CLI contract matches exactly on cli develop: mint→ID+PASSWORD+TB_NAMESPACE (stdout suppressed), adopt→ID+TB_NAMESPACE+ADOPTED=1 (no password), file 0600, parent dir auto-created.
• No ordering bug: setup_log_file() mkdir's HOST_DATA_DIR early in main(), before provision_client writes the cred file there.
• install_tracebloc_cli always returns 0 → the non-fatal claim holds under set -e; the browser path's has tracebloc || error is the real fatal gate.
• Credential cleanup: explicit rm on success + error paths, unset after, EXIT-trap backstop. "failed create leaves no file" test confirms it.
• Step renumber (1,2 → 3 → 4,5) consistent; install_tracebloc_cli step-framing correctly relocated to the caller, no orphaned caller.

Two items flagged inline (release sequencing for main; legacy-machine namespace divergence).

Minor / nits

• verify_credentials on a freshly-minted credential is fatal on invalid(400)/inactive(401) — worth confirming create→auth is read-your-writes consistent on the backend.
• trap install_cleanup EXIT is EXIT-only; "removed on any error/signal" is best-effort (SIGINT/SIGTERM in the brief mint→rm window is bash-version-dependent). EXIT INT TERM would make the claim true. Low severity.
• Defense-in-depth: ( umask 077; tracebloc client create … ) would keep the file 0600 even against a future CLI regression. Optional — cli#104 guarantees 0600 today.
• Test gap: the new _PROVISION_CRED_FILE removal inside install_cleanup (trap backstop) isn't directly tested; provision.bats covers the explicit rm paths only.
• Adopt comment says it "reconciles from the local values.yaml," but that path actually re-prompts interactively ("Use previous settings as defaults?" + Client ID/password with values.yaml defaults). Functional, but the comment oversells it as silent.

Net: good for develop once the namespace question is settled, with the CLI-release gate as a hard precondition for main.

Reviewed with Claude Code.

[LukasWodka]

CLI v0.4.0 is published — release-ordering gate cleared. Validated the released binary against this PR's contract on darwin/arm64:

• tracebloc version → 0.4.0; login, client create, and --credential-file all present.
• The _cli_supports_provisioning probe (40ad207) passes against v0.4.0 → provision_client takes the browser-auth path, not the old-CLI fallback (it correctly fell back on v0.3.1).
• client create --credential-file is auth-gated: without a session it errors not signed in and writes no credential file — no secret leak on the unauthenticated path.

So the "don't promote to main until the CLI release lands" note is satisfied (releases/latest = v0.4.0 ships login + create + --credential-file).

Not validated here (needs a human): the full live install runs create_cluster (k3d) → tracebloc login (device flow — requires a human to approve in a browser; there's no token/non-interactive login yet) → client create (real backend client) → helm install. That end-to-end browser-auth provision is a manual FR on dev. The dual-mode path (TRACEBLOC_CLIENT_ID/PASSWORD) remains the unattended route.