opbox

Genesis

The one-time founding ceremony that turns a fresh box into a usable, governed tenant.

A release kernel drops its dev identity (ADR-0040), so a fresh box has the law loaded but zero principals. Genesis is the one deliberate host act that founds the first ones. It is fail-closed and one-shot per workspace.

What it does

The genesis.sh wrapper (bash genesis.sh) runs the ceremony end to end:

  1. opbox initiate — creates the workspace and the founding OWNER actor, and mints a standing root bearer. The bearer is printed once to stdout — capture it. This is your admin credential.
  2. Mint the Chief of Staff. Acting as the owner, it creates the CoS agent (org.agent.create role=COS) with autonomy 3, the org pack, and the full verb scope — so the CoS can build the rest of the org. The CoS resolves to OWNER tier over the MCP door (and only there).
  3. Mint the bounded chat-agent. Acting as the CoS over MCP, it creates a WORKER chat-agent with autonomy 1 and a MEMBER tier — the least-privilege identity the public chat runs under. Its key is written to .env as OPBOX_AGENT_KEY, and agent-chat is recreated with it.

After genesis, every other person is a principal minted in-app within the granted authority — never by re-running this.

Why the CoS, then the WORKER

org.agent.create is itself a sensitive, owner-tier verb that needs autonomy 2+, and a roster WORKER can only be created by the CoS. So the ceremony mints a fully-empowered CoS first, then has the CoS mint the bounded WORKER the chat actually uses. The OWNER Chief-of-Staff key never backs the public chat - that is the no-amplification rule.

Signing in

Genesis founds a bearer, not a password. To enable email + password login, the owner sets their own credentials once via the auth.credentials.set verb (subject to the password policy: at least 10 characters and two character classes). After that, POST /auth/login returns a SESSION token, which is what the chat signs in with.