Module provision 

Getting the first agents onto a server that has no admin UI yet.

Until accounts and token issuing arrive with the people milestone, the operator declares agents in the environment:

KASL_AGENTS=alice@example.com:s3cr3t-token,bob@example.com:another-token

On startup each entry becomes a user and an agent holding that token’s hash. Deliberately not a public enrollment endpoint: a server whose only way in is a secret the operator already knows cannot be joined by anyone who does not.

This is a bootstrap, and it says so - when the admin UI issues tokens, the variable stops being the way in and the ingest contract does not change.

Structs

AgentSeed

One email:token pair from the environment.

Functions

apply_seeds

Creates or updates the declared users and agents.

ensure_admin

Creates the first administrator, or resets an existing one’s password.

parse_admin

Parses KASL_ADMIN, which is email:password.

parse_seeds

Parses KASL_AGENTS. An empty or absent value yields nothing, which is the normal state of a server whose agents are already in the database.