diff --git a/.claude/skills/fullsend/SKILL.md b/.claude/skills/fullsend/SKILL.md
index 5a47675..3bff6f2 100644
--- a/.claude/skills/fullsend/SKILL.md
+++ b/.claude/skills/fullsend/SKILL.md
@@ -10,6 +10,10 @@ description: |
   check if yarn/corepack/openspec work, or build a custom fullsend agent.
   Also use when asked to upgrade fullsend, sync scaffold files with a new
   version, update the CLI, bump fullsend, or check what version we're on.
+  Also use when asked to onboard a new repo, add a repo to the fleet,
+  set up fullsend on a repo, or configure WIF for a new repo.
+  Also use when asked to enable a model in the Model Garden, activate
+  a new Claude/Anthropic/Grok model, or check model enablement status.
   Also use when asked about local fullsend setup, RHDH GCP project config,
   or the custom sandbox image.
 ---
@@ -91,8 +95,10 @@ To add a variable, create an env file and wire it via `host_files` in the harnes
 | `debug <#issue> [--repo]` | Run sandbox diagnostics (shortcut for `trigger debug`) |
 | `comment <#issue> <message> [--repo]` | Post a comment on an issue or PR |
 | `label <#issue> <add\|remove> <label> [--repo]` | Add or remove a label on an issue or PR |
+| `onboard <org>/<repo>` | Add a new repo to the fullsend fleet (WIF, variables, secrets, scaffold) |
 | `upgrade [version]` | Upgrade CLI, bump `repos.yaml`, and converge target repos via PRs |
 | `custom-agents` | Guide for building custom standalone agents (scaffold, dispatch, security) |
+| `enable-model` | Enable a partner model in GCP Model Garden (requires browser + Owner creds) |
 | `local-setup` | Guide for running fullsend agents locally on a Mac |
 
 If no arguments are given, display this table and ask which the user wants.
@@ -111,6 +117,8 @@ Parse the first word after `/fullsend` as the subcommand.
 | `debug` | `references/debug.md` |
 | `comment` | `references/comment.md` |
 | `label` | `references/label.md` |
+| `enable-model` | `references/enable-model.md` |
+| `onboard` | `references/onboard.md` |
 | `upgrade` | `references/upgrade.md` |
 | `custom-agents` | `references/custom-agents.md` |
 | `local-setup` | `references/local-setup.md` |
diff --git a/.claude/skills/fullsend/references/enable-model.md b/.claude/skills/fullsend/references/enable-model.md
new file mode 100644
index 0000000..d9c43e6
--- /dev/null
+++ b/.claude/skills/fullsend/references/enable-model.md
@@ -0,0 +1,91 @@
+# enable-model
+
+Enable a partner model in the GCP Model Garden for `rhdh-sidekick-167988`.
+
+## Usage
+
+```
+/fullsend enable-model <model-id>
+```
+
+- `model-id`: e.g. `claude-opus-5`, `claude-sonnet-5`, `grok-4.6`
+
+## Prerequisites
+
+| Gate | Check | If fail |
+|------|-------|---------|
+| GCP Owner | `gcloud projects get-iam-policy rhdh-sidekick-167988` | Need Owner via `rhdh-sidekick@redhat.com` group |
+| Browser | `agent-browser --version` | `npm install -g agent-browser && agent-browser install` |
+
+## Procedure
+
+### 1. Verify current status
+
+Check if the model is already enabled by visiting its Model Garden card.
+An enabled model shows **Open in Agent Studio**; a not-enabled model shows
+a grayed-out **Enable** button.
+
+```bash
+agent-browser --headed --session gcp-model-garden \
+  open "https://console.cloud.google.com/agent-platform/model-garden?project=rhdh-sidekick-167988"
+```
+
+The user must log in to GCP interactively. Wait for confirmation.
+
+### 2. Navigate and enable
+
+1. Apply the provider filter (e.g. "Anthropic") in the left sidebar
+2. Click the model card
+3. Click **Enable** → opens the publisher questionnaire
+
+### 3. Fill the questionnaire
+
+| Field | Value |
+|-------|-------|
+| Business name | `Red Hat` |
+| Business website | `https://www.redhat.com` |
+| Contact email | `rhdh-sidekick@redhat.com` |
+| Headquartered | `United States of America` |
+| Industry | `Telecommunications` |
+| Intended users | `Internal employees` |
+| Use cases | `Agentic software development lifecycle (SDLC) automation for enterprise Backstage plugins` |
+| Additional requirements (AUP) | `No` |
+
+### 4. Agree to terms
+
+Click **Next** → review pricing → check the **Terms and agreements**
+checkbox → click **Agree**.
+
+Enablement is instant — no approval queue. Confirmation dialog:
+"Successfully purchased \<model\>"
+
+### 5. Update documentation
+
+After enabling, update `docs/gcp-infrastructure.md`:
+- Move the model from "Available but not enabled" to "Enabled partner models"
+- Add the date and verification method
+
+### 6. Smoke test
+
+```bash
+gh issue create --repo redhat-developer/rhdh-agentic \
+  --title "test: smoke test <model-id> after Model Garden enablement" \
+  --body "Smoke test — verify inference works with <model-id>.
+Close this issue if triage succeeds."
+```
+
+## Known gotchas
+
+1. **No "Haiku 4.6" exists.** The model is `claude-haiku-4-5` (Haiku 4.5).
+   Model Garden names don't always match the version numbering you'd expect.
+2. **Dropdowns are Material UI comboboxes.** The `select` command often
+   doesn't work — click the parent `generic` element to open the listbox,
+   then click the option.
+3. **Browser session expiry.** GCP sessions expire; the user may need to
+   re-authenticate. The `agent-browser` daemon can also relaunch and lose
+   auth state.
+4. **Google models don't need enablement.** All 129 Google models (Gemini
+   family etc.) are available by default.
+5. **Enablement is per-publisher, not per-model.** Once you fill the
+   Anthropic form for one model, subsequent Anthropic models still require
+   the form but the values are the same.
diff --git a/.claude/skills/fullsend/references/onboard.md b/.claude/skills/fullsend/references/onboard.md
new file mode 100644
index 0000000..34831e5
--- /dev/null
+++ b/.claude/skills/fullsend/references/onboard.md
@@ -0,0 +1,146 @@
+# onboard
+
+Add a new repository to the fullsend fleet. Handles WIF provider creation,
+GitHub variables/secrets, fleet manifest update, and scaffold installation.
+
+## Usage
+
+```
+/fullsend onboard <org>/<repo>
+```
+
+## Prerequisites
+
+| Gate | Check | If fail |
+|------|-------|---------|
+| `repos.yaml` | this repo's fleet manifest | Stop — the file is required |
+| `gh` CLI | `gh auth status` | Ask user to authenticate |
+| `gcloud` CLI | `gcloud auth list` | Ask user to run `gcloud auth login` |
+| `fullsend` CLI | `fullsend --version` | Download from GitHub releases |
+
+## Procedure
+
+### 1. Verify the repo exists
+
+```bash
+gh repo view <org>/<repo> --json nameWithOwner -q .nameWithOwner
+```
+
+### 2. Check WIF provider
+
+Most RHDH repos already have a WIF provider from a prior `fullsend admin install`.
+
+```bash
+gcloud iam workload-identity-pools providers list \
+  --location=global --workload-identity-pool=fullsend-inference \
+  --project=rhdh-sidekick-167988 \
+  --filter="attributeCondition:<repo>" \
+  --format="table(name.basename(), state)"
+```
+
+If no provider exists, create one:
+
+```bash
+PROVIDER_NAME="gh-<org>-<repo>"  # max 32 chars, truncate if needed
+PROJECT_NUM="189673402608"
+POOL="fullsend-inference"
+PROVIDER_PATH="projects/$PROJECT_NUM/locations/global/workloadIdentityPools/$POOL/providers/$PROVIDER_NAME"
+
+gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_NAME" \
+  --location=global \
+  --workload-identity-pool="$POOL" \
+  --project=rhdh-sidekick-167988 \
+  --issuer-uri=https://token.actions.githubusercontent.com \
+  --allowed-audiences="fullsend-mint,https://iam.googleapis.com/$PROVIDER_PATH" \
+  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
+  --attribute-condition="assertion.repository == '<org>/<repo>'"
+```
+
+No per-repo IAM binding is needed — the org-level `aiplatform.user` principal
+set covers all repos in `redhat-developer` and `rhdh-parasol` automatically.
+If the repo is in a different org, add an org-level binding:
+
+```bash
+gcloud projects add-iam-policy-binding rhdh-sidekick-167988 \
+  --role="roles/aiplatform.user" \
+  --member="principalSet://iam.googleapis.com/projects/189673402608/locations/global/workloadIdentityPools/fullsend-inference/attribute.repository_owner/<org>" \
+  --condition=None
+```
+
+### 3. Set GitHub variables
+
+```bash
+gh variable set FULLSEND_MINT_URL --body "https://mint.fullsend.sh" --repo <org>/<repo>
+gh variable set FULLSEND_GCP_REGION --body "global" --repo <org>/<repo>
+gh variable set FULLSEND_PER_REPO_INSTALL --body "true" --repo <org>/<repo>
+```
+
+Check if already set: `gh variable list --repo <org>/<repo>`
+
+### 4. Set GitHub secrets
+
+```bash
+PROJECT_NUM="189673402608"
+POOL="fullsend-inference"
+PROVIDER_NAME="<from step 2>"
+
+echo "projects/$PROJECT_NUM/locations/global/workloadIdentityPools/$POOL/providers/$PROVIDER_NAME" | \
+  gh secret set FULLSEND_GCP_WIF_PROVIDER --repo <org>/<repo>
+
+echo "rhdh-sidekick-167988" | \
+  gh secret set FULLSEND_GCP_PROJECT_ID --repo <org>/<repo>
+```
+
+Check if already set: `gh secret list --repo <org>/<repo>`
+
+### 5. Add to fleet manifest
+
+Add the repo to `repos.yaml` under `github.repos`, in alphabetical order:
+
+```yaml
+repos:
+  - name: redhat-developer/rhdh-agentic
+  - name: redhat-developer/rhdh-cli        # <-- new
+  - name: redhat-developer/rhdh-plugins
+```
+
+Commit and push to a branch. Open a PR in this repo.
+
+### 6. Install scaffold
+
+After the `repos.yaml` PR is merged, converge the new repo:
+
+```bash
+fullsend repos install -f repos.yaml <org>/<repo>
+```
+
+This creates a scaffold PR on the target repo. Review and merge it.
+
+### 7. Smoke test
+
+```bash
+gh issue create --repo <org>/<repo> \
+  --title "test: smoke test after fullsend onboarding" \
+  --body "Smoke test — verify triage runs correctly after onboarding.
+Close this issue if triage succeeds."
+```
+
+Watch the run. If triage succeeds, close the issue.
+
+## What onboarding does NOT do
+
+- Does not create the repo itself
+- Does not configure custom agents (use `/fullsend custom-agents` for that)
+- Does not rebuild the sandbox image (only needed if the repo uses a
+  different yarn version — check `packageManager` in `package.json`)
+
+## Checklist summary
+
+- [ ] WIF provider exists in `fullsend-inference`
+- [ ] `FULLSEND_MINT_URL` = `https://mint.fullsend.sh`
+- [ ] `FULLSEND_GCP_REGION` = `global`
+- [ ] `FULLSEND_GCP_WIF_PROVIDER` secret set
+- [ ] `FULLSEND_GCP_PROJECT_ID` secret set
+- [ ] Repo added to `repos.yaml`
+- [ ] Scaffold PR merged on target repo
+- [ ] Smoke test passed
diff --git a/.claude/skills/fullsend/references/upgrade.md b/.claude/skills/fullsend/references/upgrade.md
index 556a36d..771308b 100644
--- a/.claude/skills/fullsend/references/upgrade.md
+++ b/.claude/skills/fullsend/references/upgrade.md
@@ -54,8 +54,8 @@ fullsend --version
 In `repos.yaml`, set `github.fullsend_ref` to the target tag (e.g. `v0.37.0`).
 Open a PR in **this** repo (`rhdh-fullsend`). Do not push to `main`.
 
-Keep `github.mint_mode: private` and the self-hosted `mint_url`. Do not let
-setup/install fall through to `https://mint.fullsend.sh`.
+The fleet uses public mint (`https://mint.fullsend.sh`). Verify `mint_url`
+in `repos.yaml` stays set to that after the upgrade.
 
 ### 4. Converge target repos (PRs only)
 
@@ -113,8 +113,8 @@ Watch the run. If triage succeeds, close the issue.
 
 ## Known gotchas
 
-1. **Self-hosted mint.** Manifest `mint_mode` must stay `private` with the GCP
-   mint URL. `github setup` without `--mint-url` writes `mint.fullsend.sh`.
+1. **Public mint.** Manifest `mint_url` must stay `https://mint.fullsend.sh`.
+   `github setup` without `--mint-url` defaults to this, which is correct.
 2. **Config-targeting flags rewrite `config.yaml`.** `--runtime`, `--agents`,
    `--mint-url`, `--inference-*` re-serialize the overlay (comments lost,
    agents kept). Prefer `repos install` over `github setup` for upgrades.
diff --git a/docs/gcp-infrastructure.md b/docs/gcp-infrastructure.md
index 815b6a9..7416450 100644
--- a/docs/gcp-infrastructure.md
+++ b/docs/gcp-infrastructure.md
@@ -9,49 +9,168 @@ for the RHDH fullsend setup.
 |-------|-------|
 | GCP project ID | `rhdh-sidekick-167988` |
 | GCP project number | `189673402608` |
-| Vertex AI region | `us-east5` |
-| WIF pool | `fullsend-pool` (ACTIVE) |
+| Fullsend GCP region | `global` (SDK routing; Vertex AI resolves internally) |
+| WIF pool | `fullsend-inference` (ACTIVE) |
 | IAM admin group | `rhdh-sidekick@redhat.com` |
+| Project role | **Owner** (via `group:rhdh-sidekick@redhat.com`) |
 
 The project lives under `IT Public Cloud > Sandbox > Customers` in the GCP
-org hierarchy. The admin group has `iam.workloadIdentityPoolAdmin`,
-`iam.serviceAccountAdmin`, and `iam.serviceAccountKeyAdmin` — sufficient to
-self-provision WIF providers and service accounts without fullsend team
-involvement.
+org hierarchy. The admin group has Owner, which includes all permissions
+needed to manage WIF, IAM, and Model Garden.
+
+### IAM incident 2026-09-09
+
+An Ansible/AAP automation (`aap-access-sa@utility-project-468319`) ran
+`SetIamPolicy` (full replace, not merge) on `rhdh-sidekick-167988` at
+12:59 UTC, overwriting the project policy with only the Owner binding.
+This removed `roles/aiplatform.user` from all Fullsend WIF principals.
+
+Bindings were restored on 2026-09-10 using `add-iam-policy-binding`
+(which merges, not replaces). To prevent recurrence, IT/AAP must be told
+to use `add-iam-policy-binding` or read-modify-write with etag checks
+instead of `set-iam-policy`.
+
+## Model Garden
+
+The Model Garden (console path: Agent Platform → Models → Model Garden)
+lists models from Google and partner publishers. Google models (129) are
+available by default — no enablement step needed. Partner models require
+per-publisher enablement via a form.
 
-**Conditional IAM restriction:** The `projectIamAdmin` role on this project
-is restricted to granting only `roles/aiplatform.user`:
+Once a partner model is enabled, it is available to all principals with
+`roles/aiplatform.user` — i.e. all ~52 WIF-enabled repos across both orgs.
 
-```
-expression: api.getAttribute('iam.googleapis.com/modifiedGrantsByRole',
-  []).hasOnly(['roles/aiplatform.user'])
-```
+### Enabled partner models
+
+| Model | Model ID | Status | Verified |
+|-------|----------|--------|----------|
+| Claude Opus 4.6 | `claude-opus-4-6` | Enabled | 2026-09-10 (triage agent, issue #143) |
+| Claude Sonnet 4.6 | `claude-sonnet-4-6` | Enabled | 2026-09-10 (Model Garden console) |
+| Claude Haiku 4.5 | `claude-haiku-4-5` | Enabled | 2026-09-10 (Model Garden console) |
+
+### Per-agent model assignments (rhdh-agentic)
+
+| Agent | Model alias | Resolves to | Rationale |
+|-------|-------------|-------------|-----------|
+| triage | `haiku` | `claude-haiku-4-5` | Fast, cost-efficient for issue classification |
+| review | `sonnet` | `claude-sonnet-4-6` | Quality/cost balance for code reviews |
+| code, fix, grillme | (default) | `claude-opus-4-6` | Maximum capability for code generation |
+
+Configured via `agents[].model` in `.fullsend/config.yaml`
+([per-agent settings](https://fullsend.sh/docs/runtimes#per-agent-runtime-model-and-effort)).
+The aliases resolve through fullsend's pinned alias table — no
+`models.aliases` override needed.
+
+### Available but not enabled (as of 2026-09-10)
+
+**Anthropic** (12 models in garden):
+
+| Model | Model ID |
+|-------|----------|
+| Claude Fable 5.1 | `claude-fable-5-1` |
+| Claude Opus 5 | `claude-opus-5` |
+| Claude Sonnet 5 | `claude-sonnet-5` |
+| Claude Fable 5 | `claude-fable-5` |
+| Claude Opus 4.8 | `claude-opus-4-8` |
+| Claude Opus 4.7 | `claude-opus-4-7` |
+| Claude Opus 4.5 | `claude-opus-4-5` |
+| Claude Sonnet 4.5 | `claude-sonnet-4-5` |
+| Claude Opus 4.1 | `claude-opus-4-1` |
+
+**xAI** (6 models in garden):
+
+| Model | Model ID |
+|-------|----------|
+| Grok 4.6 | `grok-4.6` |
+| Grok 4.3 | `grok-4.3` |
+| Grok 4.20 (Reasoning) | `grok-4.20` |
+| Grok 4.20 (Non-Reasoning) | `grok-4.20` |
+| Grok 4.1 Fast (Reasoning) | `grok-4.1-fast` |
+| Grok 4.1 Fast (Non-Reasoning) | `grok-4.1-fast` |
+
+Other partners: Meta (21), Mistral AI (9), NVIDIA (4), Stability.ai (4),
+and others. See Model Garden console for the full list.
+
+### Google models (no enablement needed)
+
+129 models available by default, including the Gemini family:
+Gemini 3.8 Flash, 3.7 Flash, 3.6 Flash, 3.5 Flash / Flash Lite,
+3.1 Pro Preview, and others.
+
+### How to enable a partner model
+
+Requires Owner credentials on `rhdh-sidekick-167988`.
+
+1. Go to [Model Garden](https://console.cloud.google.com/agent-platform/model-garden?project=rhdh-sidekick-167988)
+2. Click the model card → click **Enable**
+3. Fill in the publisher questionnaire:
+
+   | Field | Value |
+   |-------|-------|
+   | Business name | `Red Hat` |
+   | Business website | `https://www.redhat.com` |
+   | Contact email | `rhdh-sidekick@redhat.com` |
+   | Headquartered | `United States of America` |
+   | Industry | `Telecommunications` |
+   | Intended users | `Internal employees` |
+   | Use cases | `Agentic software development lifecycle (SDLC) automation for enterprise Backstage plugins` |
+   | Additional requirements (AUP) | `No` |
+
+4. Click **Next** → review pricing (usage-based, billed monthly)
+5. Check the **Terms and agreements** checkbox
+6. Click **Agree** → confirmation dialog appears
 
-This means you cannot grant yourself additional roles or enable APIs. All
-changes beyond `aiplatform.user` must go through IT (ServiceNow ticket).
+An enabled model shows **Open in Agent Studio** instead of **Enable** on
+its card. Enablement is instant — no approval queue.
 
-## WIF providers
+Use a smoke-test issue to confirm end-to-end inference (Model Garden
+enablement alone is necessary but the only reliable test is a real agent
+run through WIF-federated credentials).
 
-Each repo gets its own WIF provider, scoped via `attribute-condition` to
-that specific repository.
+Model access cannot be verified via `gcloud` CLI or raw REST calls with
+user credentials — it only works through WIF-federated credentials used by
+the Fullsend SDK. Use a smoke-test issue to confirm end-to-end inference.
 
-### Current providers
+## Fleet vs. WIF-enabled repos
 
-| Provider | Repo scope | State |
-|----------|-----------|-------|
-| `gh-redhat-developer-rhdh-agentic` | `redhat-developer/rhdh-agentic` | ACTIVE |
-| `gh-redhat-developer-rhdh-plugins` | `redhat-developer/rhdh-plugins` | ACTIVE |
-| `gh-rhdeveloper-plugin-export` | `redhat-developer/rhdh-plugin-export-overlays` | ACTIVE |
+There are two levels of fullsend integration:
+
+| Level | Count | What it means |
+|-------|-------|---------------|
+| **WIF-enabled** | ~52 | Has a WIF provider → *can* use Vertex AI. Created by `fullsend admin install`. |
+| **Fleet-managed** | 4 | Listed in `repos.yaml` → centrally upgraded, version-pinned, scaffold-synced. |
+
+Fleet-managed repos (see `repos.yaml`):
+- `redhat-developer/rhdh-agentic`
+- `redhat-developer/rhdh-cli`
+- `redhat-developer/rhdh-plugins`
+- `redhat-developer/rhdh-plugin-export-overlays`
+
+To onboard a new repo into the fleet, use `/fullsend onboard <org>/<repo>`.
+
+## WIF pool and providers
+
+All repos use a single pool (`fullsend-inference`). Each repo gets its own
+OIDC provider scoped via `attribute-condition`. List all providers:
+
+```bash
+gcloud iam workload-identity-pools providers list \
+  --location=global --workload-identity-pool=fullsend-inference \
+  --project=rhdh-sidekick-167988 --format="table(name.basename(), attributeCondition)"
+```
+
+A previous `fullsend-pool` (3 manually provisioned providers) was
+consolidated into `fullsend-inference` on 2026-09-10 and deleted.
 
 ### Creating a new WIF provider
 
 ```bash
 PROVIDER_NAME="gh-redhat-developer-<repo>"  # max 32 chars
-PROVIDER_PATH="projects/189673402608/locations/global/workloadIdentityPools/fullsend-pool/providers/${PROVIDER_NAME}"
+PROVIDER_PATH="projects/189673402608/locations/global/workloadIdentityPools/fullsend-inference/providers/${PROVIDER_NAME}"
 
 gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_NAME" \
   --location=global \
-  --workload-identity-pool=fullsend-pool \
+  --workload-identity-pool=fullsend-inference \
   --project=rhdh-sidekick-167988 \
   --issuer-uri=https://token.actions.githubusercontent.com \
   --allowed-audiences="fullsend-mint,https://iam.googleapis.com/${PROVIDER_PATH}" \
@@ -72,16 +191,45 @@ Omitting the second audience causes an `audience mismatch` error at the
 "Setup GCP" step in the workflow. The `fullsend admin install` CLI sets
 both automatically; manual provider creation must include both.
 
-### IAM binding
+### IAM bindings
 
-The existing `aiplatform.user` binding covers all `redhat-developer` repos
-via the `attribute.repository_owner` principal set:
+Org-level `aiplatform.user` bindings cover all repos in both orgs:
 
-```
-principalSet://iam.googleapis.com/projects/189673402608/locations/global/workloadIdentityPools/fullsend-pool/attribute.repository_owner/redhat-developer
+| Org | Principal set |
+|-----|---------------|
+| `redhat-developer` | `principalSet://.../fullsend-inference/attribute.repository_owner/redhat-developer` |
+| `rhdh-parasol` | `principalSet://.../fullsend-inference/attribute.repository_owner/rhdh-parasol` |
+
+No per-repo IAM binding is needed — the org-level principal sets cover all
+repos automatically.
+
+## Mint configuration
+
+The mint URL is stored as a GitHub Actions variable (`FULLSEND_MINT_URL`)
+on each repo, not hardcoded in the workflow. The workflow references it via
+`${{ vars.FULLSEND_MINT_URL }}`.
+
+| Repo | Mint URL |
+|------|----------|
+| `redhat-developer/rhdh-agentic` | `https://mint.fullsend.sh` |
+| `redhat-developer/rhdh-cli` | `https://mint.fullsend.sh` |
+| `redhat-developer/rhdh-plugins` | `https://mint.fullsend.sh` |
+| `redhat-developer/rhdh-plugin-export-overlays` | `https://mint.fullsend.sh` |
+
+All repos (including ~52 WIF-enabled repos in both `redhat-developer` and
+`rhdh-parasol` orgs) use public mint. Switched from private mint
+(`https://fullsend-mint-gljhbkcloq-uc.a.run.app`) on 2026-09-10.
+
+To change the mint URL on a repo:
+
+```bash
+gh variable set FULLSEND_MINT_URL --body "https://mint.fullsend.sh" --repo <org>/<repo>
 ```
 
-No per-repo IAM binding is needed after the initial setup.
+The `repos.yaml` fleet manifest also stores `mint_url`. When running
+`fullsend repos install -f repos.yaml`, it sets this variable on each repo
+automatically. Direct `gh variable set` is equivalent and takes effect
+immediately.
 
 ## Service accounts
 
@@ -191,7 +339,7 @@ all repos under `redhat-developer`):
 ```bash
 gcloud projects add-iam-policy-binding rhdh-sidekick-167988 \
   --role="roles/aiplatform.user" \
-  --member="principalSet://iam.googleapis.com/projects/189673402608/locations/global/workloadIdentityPools/fullsend-pool/attribute.repository_owner/redhat-developer" \
+  --member="principalSet://iam.googleapis.com/projects/189673402608/locations/global/workloadIdentityPools/fullsend-inference/attribute.repository_owner/redhat-developer" \
   --condition=None
 ```
 
@@ -210,7 +358,7 @@ include both:
 ```bash
 gcloud iam workload-identity-pools providers update-oidc <provider-name> \
   --location=global \
-  --workload-identity-pool=fullsend-pool \
+  --workload-identity-pool=fullsend-inference \
   --project=rhdh-sidekick-167988 \
   --allowed-audiences="fullsend-mint,https://iam.googleapis.com/<wif-provider-path>"
 ```