Prepare a host

This procedure starts from an authorized checkout on a host that has been declared in the namespace assets. Use the Ubuntu 26.04 or Kali bootstrap in the repository for a fresh native host; the steps below explain the common boundary.

1. Confirm the host record. Run hostname and verify that the exact value appears in the authoritative assets.<namespace> document. A missing host is a successful no-op during deployment.
2. Prepare the protected bootstrap inputs. Set configr_op_service_account_name and configr_op_service_account_key in the environment or a repo-root .env with mode 0600. The key is a direct ops_ service-account token. Never put it in a command argument or documentation example.
3. Check account scope. The account must authenticate as the named active service account and expose exactly one namespace vault with read access. Configuration repair and push also need write access.
4. Use the matching bootstrap for a fresh host. On Ubuntu 26.04 run ./bootstrap-ubuntu-26.04.sh; on Kali run ./bootstrap-kali.sh. Existing checkouts can go directly to the deployment procedure.
5. Validate before mutation. Run ./enclavr config validate and ./enclavr host plan from the checkout.

See how a namespace works for the source-of-truth model. Keep protected inputs on the host; this public site does not accept or store them.