durandom · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
@@ -10,6 +10,10 @@ description: |
   check if yarn/corepack/openspec work, or build a custom fullsend agent.
   Also use when asked to upgrade fullsend, sync scaffold files with a new
   version, update the CLI, bump fullsend, or check what version we're on.
+  Also use when asked to onboard a new repo, add a repo to the fleet,
+  set up fullsend on a repo, or configure WIF for a new repo.
+  Also use when asked to enable a model in the Model Garden, activate
+  a new Claude/Anthropic/Grok model, or check model enablement status.
   Also use when asked about local fullsend setup, RHDH GCP project config,
   or the custom sandbox image.
 ---
@@ -91,8 +95,10 @@ To add a variable, create an env file and wire it via `host_files` in the harnes
 | `debug <#issue> [--repo]` | Run sandbox diagnostics (shortcut for `trigger debug`) |
 | `comment <#issue> <message> [--repo]` | Post a comment on an issue or PR |
 | `label <#issue> <add\|remove> <label> [--repo]` | Add or remove a label on an issue or PR |
+| `onboard <org>/<repo>` | Add a new repo to the fullsend fleet (WIF, variables, secrets, scaffold) |
 | `upgrade [version]` | Upgrade CLI, bump `repos.yaml`, and converge target repos via PRs |
 | `custom-agents` | Guide for building custom standalone agents (scaffold, dispatch, security) |
+| `enable-model` | Enable a partner model in GCP Model Garden (requires browser + Owner creds) |
 | `local-setup` | Guide for running fullsend agents locally on a Mac |
 
 If no arguments are given, display this table and ask which the user wants.
@@ -111,6 +117,8 @@ Parse the first word after `/fullsend` as the subcommand.
 | `debug` | `references/debug.md` |
 | `comment` | `references/comment.md` |
 | `label` | `references/label.md` |
+| `enable-model` | `references/enable-model.md` |
+| `onboard` | `references/onboard.md` |
 | `upgrade` | `references/upgrade.md` |
 | `custom-agents` | `references/custom-agents.md` |
 | `local-setup` | `references/local-setup.md` |

@@ -0,0 +1,91 @@
+# enable-model
+
+Enable a partner model in the GCP Model Garden for `rhdh-sidekick-167988`.
+
+## Usage
+
+```
+/fullsend enable-model <model-id>
+```
+
+- `model-id`: e.g. `claude-opus-5`, `claude-sonnet-5`, `grok-4.6`
+
+## Prerequisites
+
+| Gate | Check | If fail |
+|------|-------|---------|
+| GCP Owner | `gcloud projects get-iam-policy rhdh-sidekick-167988` | Need Owner via `rhdh-sidekick@redhat.com` group |
+| Browser | `agent-browser --version` | `npm install -g agent-browser && agent-browser install` |
+
+## Procedure
+
+### 1. Verify current status
+
+Check if the model is already enabled by visiting its Model Garden card.
+An enabled model shows **Open in Agent Studio**; a not-enabled model shows
+a grayed-out **Enable** button.
+
+```bash
+agent-browser --headed --session gcp-model-garden \
+  open "https://console.cloud.google.com/agent-platform/model-garden?project=rhdh-sidekick-167988"
+```
+
+The user must log in to GCP interactively. Wait for confirmation.
+
+### 2. Navigate and enable
+
+1. Apply the provider filter (e.g. "Anthropic") in the left sidebar
+2. Click the model card
+3. Click **Enable** → opens the publisher questionnaire
+
+### 3. Fill the questionnaire
+
+| Field | Value |
+|-------|-------|
+| Business name | `Red Hat` |
+| Business website | `https://www.redhat.com` |
+| Contact email | `rhdh-sidekick@redhat.com` |
+| Headquartered | `United States of America` |
+| Industry | `Telecommunications` |
+| Intended users | `Internal employees` |
+| Use cases | `Agentic software development lifecycle (SDLC) automation for enterprise Backstage plugins` |
+| Additional requirements (AUP) | `No` |
+
+### 4. Agree to terms
+
+Click **Next** → review pricing → check the **Terms and agreements**
+checkbox → click **Agree**.
+
+Enablement is instant — no approval queue. Confirmation dialog:
+"Successfully purchased \<model\>"
+
+### 5. Update documentation
+
+After enabling, update `docs/gcp-infrastructure.md`:
+- Move the model from "Available but not enabled" to "Enabled partner models"
+- Add the date and verification method
+
+### 6. Smoke test
+
+```bash
+gh issue create --repo redhat-developer/rhdh-agentic \
+  --title "test: smoke test <model-id> after Model Garden enablement" \
+  --body "Smoke test — verify inference works with <model-id>.
+Close this issue if triage succeeds."
+```
+
+## Known gotchas
+
+1. **No "Haiku 4.6" exists.** The model is `claude-haiku-4-5` (Haiku 4.5).
+   Model Garden names don't always match the version numbering you'd expect.
+2. **Dropdowns are Material UI comboboxes.** The `select` command often
+   doesn't work — click the parent `generic` element to open the listbox,
+   then click the option.
+3. **Browser session expiry.** GCP sessions expire; the user may need to
+   re-authenticate. The `agent-browser` daemon can also relaunch and lose
+   auth state.
+4. **Google models don't need enablement.** All 129 Google models (Gemini
+   family etc.) are available by default.
+5. **Enablement is per-publisher, not per-model.** Once you fill the
+   Anthropic form for one model, subsequent Anthropic models still require
+   the form but the values are the same.
@@ -0,0 +1,146 @@
+# onboard
+
+Add a new repository to the fullsend fleet. Handles WIF provider creation,
+GitHub variables/secrets, fleet manifest update, and scaffold installation.
+
+## Usage
+
+```
+/fullsend onboard <org>/<repo>
+```
+
+## Prerequisites
+
+| Gate | Check | If fail |
+|------|-------|---------|
+| `repos.yaml` | this repo's fleet manifest | Stop — the file is required |
+| `gh` CLI | `gh auth status` | Ask user to authenticate |
+| `gcloud` CLI | `gcloud auth list` | Ask user to run `gcloud auth login` |
+| `fullsend` CLI | `fullsend --version` | Download from GitHub releases |
+
+## Procedure
+
+### 1. Verify the repo exists
+
+```bash
+gh repo view <org>/<repo> --json nameWithOwner -q .nameWithOwner
+```
+
+### 2. Check WIF provider
+
+Most RHDH repos already have a WIF provider from a prior `fullsend admin install`.
+
+```bash
+gcloud iam workload-identity-pools providers list \
+  --location=global --workload-identity-pool=fullsend-inference \
+  --project=rhdh-sidekick-167988 \
+  --filter="attributeCondition:<repo>" \
+  --format="table(name.basename(), state)"
+```
+
+If no provider exists, create one:
+
+```bash
+PROVIDER_NAME="gh-<org>-<repo>"  # max 32 chars, truncate if needed
+PROJECT_NUM="189673402608"
+POOL="fullsend-inference"
+PROVIDER_PATH="projects/$PROJECT_NUM/locations/global/workloadIdentityPools/$POOL/providers/$PROVIDER_NAME"
+
+gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_NAME" \
+  --location=global \
+  --workload-identity-pool="$POOL" \
+  --project=rhdh-sidekick-167988 \
+  --issuer-uri=https://token.actions.githubusercontent.com \
+  --allowed-audiences="fullsend-mint,https://iam.googleapis.com/$PROVIDER_PATH" \
+  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
+  --attribute-condition="assertion.repository == '<org>/<repo>'"
+```
+
+No per-repo IAM binding is needed — the org-level `aiplatform.user` principal
+set covers all repos in `redhat-developer` and `rhdh-parasol` automatically.
+If the repo is in a different org, add an org-level binding:
+
+```bash
+gcloud projects add-iam-policy-binding rhdh-sidekick-167988 \
+  --role="roles/aiplatform.user" \
+  --member="principalSet://iam.googleapis.com/projects/189673402608/locations/global/workloadIdentityPools/fullsend-inference/attribute.repository_owner/<org>" \
+  --condition=None
+```
+
+### 3. Set GitHub variables
+
+```bash
+gh variable set FULLSEND_MINT_URL --body "https://mint.fullsend.sh" --repo <org>/<repo>
+gh variable set FULLSEND_GCP_REGION --body "global" --repo <org>/<repo>
+gh variable set FULLSEND_PER_REPO_INSTALL --body "true" --repo <org>/<repo>
+```
+
+Check if already set: `gh variable list --repo <org>/<repo>`
+
+### 4. Set GitHub secrets
+
+```bash
+PROJECT_NUM="189673402608"
+POOL="fullsend-inference"
+PROVIDER_NAME="<from step 2>"
+
+echo "projects/$PROJECT_NUM/locations/global/workloadIdentityPools/$POOL/providers/$PROVIDER_NAME" | \
+  gh secret set FULLSEND_GCP_WIF_PROVIDER --repo <org>/<repo>
+
+echo "rhdh-sidekick-167988" | \
+  gh secret set FULLSEND_GCP_PROJECT_ID --repo <org>/<repo>
+```
+
+Check if already set: `gh secret list --repo <org>/<repo>`
+
+### 5. Add to fleet manifest
+
+Add the repo to `repos.yaml` under `github.repos`, in alphabetical order:
+
+```yaml
+repos:
+  - name: redhat-developer/rhdh-agentic
+  - name: redhat-developer/rhdh-cli        # <-- new
+  - name: redhat-developer/rhdh-plugins
+```
+
+Commit and push to a branch. Open a PR in this repo.
+
+### 6. Install scaffold
+
+After the `repos.yaml` PR is merged, converge the new repo:
+
+```bash
+fullsend repos install -f repos.yaml <org>/<repo>
+```
+
+This creates a scaffold PR on the target repo. Review and merge it.
+
+### 7. Smoke test
+
+```bash
+gh issue create --repo <org>/<repo> \
+  --title "test: smoke test after fullsend onboarding" \
+  --body "Smoke test — verify triage runs correctly after onboarding.
+Close this issue if triage succeeds."
+```
+
+Watch the run. If triage succeeds, close the issue.
+
+## What onboarding does NOT do
+
+- Does not create the repo itself
+- Does not configure custom agents (use `/fullsend custom-agents` for that)
+- Does not rebuild the sandbox image (only needed if the repo uses a
+  different yarn version — check `packageManager` in `package.json`)
+
+## Checklist summary
+
+- [ ] WIF provider exists in `fullsend-inference`
+- [ ] `FULLSEND_MINT_URL` = `https://mint.fullsend.sh`
+- [ ] `FULLSEND_GCP_REGION` = `global`
+- [ ] `FULLSEND_GCP_WIF_PROVIDER` secret set
+- [ ] `FULLSEND_GCP_PROJECT_ID` secret set
+- [ ] Repo added to `repos.yaml`
+- [ ] Scaffold PR merged on target repo
+- [ ] Smoke test passed
@@ -54,8 +54,8 @@ fullsend --version
 In `repos.yaml`, set `github.fullsend_ref` to the target tag (e.g. `v0.37.0`).
 Open a PR in **this** repo (`rhdh-fullsend`). Do not push to `main`.
 
-Keep `github.mint_mode: private` and the self-hosted `mint_url`. Do not let
-setup/install fall through to `https://mint.fullsend.sh`.
+The fleet uses public mint (`https://mint.fullsend.sh`). Verify `mint_url`
+in `repos.yaml` stays set to that after the upgrade.
 
 ### 4. Converge target repos (PRs only)
 
@@ -113,8 +113,8 @@ Watch the run. If triage succeeds, close the issue.
 
 ## Known gotchas
 
-1. **Self-hosted mint.** Manifest `mint_mode` must stay `private` with the GCP
-   mint URL. `github setup` without `--mint-url` writes `mint.fullsend.sh`.
+1. **Public mint.** Manifest `mint_url` must stay `https://mint.fullsend.sh`.
+   `github setup` without `--mint-url` defaults to this, which is correct.
 2. **Config-targeting flags rewrite `config.yaml`.** `--runtime`, `--agents`,
    `--mint-url`, `--inference-*` re-serialize the overlay (comments lost,
    agents kept). Prefer `repos install` over `github setup` for upgrades.