Day-2 surface
Enroll. Group. Hand the hub to an agent.
Operator TUI for servers and targeting groups. Same membership tools on the hub MCP session your agent uses.
[S]ervers [G]roups [A] OpenCode [Q]uit
── Servers ──────────────────────────────
› spoke-01 10.0.0.11 web,edge,prod ●
spoke-02 10.0.0.12 app,canary,prod ●
spoke-03 10.0.0.13 data,batch,prod ●
── Actions ──────────────────────────────
i invite (issue-token) r revoke e edit
p ping g groups ok 3/3
── Groups ───────────────────────────────
prod web app data edge batch canary
Hub MCP tools
agent parity
| list_nodes / hub_status | Spokes + groups |
| issue_token / revoke_node | Membership |
| create_group / set_group_members | Targeting |
| spoke_call | SSH ForceCommand tool |
| run_module / run_playbook | Enrolled hosts or groups |
Lab one-shot
$ cd lab && ./scripts/demo.sh
# hub + 3 spokes · enroll · smoke · shell
$ ./scripts/tui.sh
$ ./scripts/opencode-host.sh
Attach the agent
hub session
— write OpenCode config, launch against the bastion, never against a spoke.