dsh-setup

You are bootstrapping a Dome Sovereign Hub (DSH) node on a fresh Apple Silicon Mac. The user has already cloned garochee33/DSH to $HOME/DSH (or set $DOME_ROOT). Your job is to run the end-to-end setup without leaving anything halfway.

1. Preflight

Confirm before doing anything destructive:

• $DOME_ROOT resolves to a real directory (default: $HOME/DSH). If not, stop and ask.
• macOS version is ≥ 13 (sw_vers -productVersion). Windows users must run scripts/sovereign-setup-windows.ps1 instead — bail out.
• xcode-select -p returns a path. If not, run xcode-select --install and exit — tell the user to re-run after it completes.
• sudo -v prompt works (fail early if the user can't authorize).

2. Run the base setup

cd "$DOME_ROOT"
bash scripts/sovereign-setup-mac.sh

This is the 20-step Homebrew/pyenv/nvm/VSCode/DB bootstrap. It is idempotent — safe to re-run. Near the end it prompts for an AI-assistant pick; choose based on user preference or skip.

When it finishes, verify:

• command -v brew && command -v pnpm && command -v pyenv all print paths.
• "$DOME_ROOT/.venv/bin/python" --version reports the version pinned in $DOME_ROOT/.python-version (currently Python 3.14.x).
• cat "$DOME_ROOT/.env" exists (copied from .env.example by the setup script if it wasn't already there).

3. Render secrets into .env (if template backend is in use)

If .env.template has {{keychain:...}} or {{pass:...}} markers:

bash "$DOME_ROOT/scripts/render-env.sh"

This replaces markers with values from macOS Keychain (preferred) or pass (GPG). Confirm with head -5 "$DOME_ROOT/.env" — there should be no {{...}} tokens left. If any marker remains, list them for the user to provision before continuing.

4. Apply sovereign lockdown

bash "$DOME_ROOT/scripts/lock-down.sh"           # kill phone-home daemons, pin DNS
bash "$DOME_ROOT/scripts/lock-down-phase2.sh"    # firewall + stealth
bash "$DOME_ROOT/scripts/lock-down-phase3.sh"    # pf anchor for telemetry endpoints
bash "$DOME_ROOT/scripts/lock-down-phase4.sh"    # daemon audit + permanent removal
bash "$DOME_ROOT/scripts/pf-reload.sh"           # reload pf with the anchor

Each script will prompt for sudo once and keep the cached credential alive while it runs. If any exits non-zero, STOP — do not proceed to steps 5+ until the lockdown is clean.

5. Probe the machine

"$DOME_ROOT/.venv/bin/python" "$DOME_ROOT/scripts/machine-probe.py"

Write-out lands at agents/core/.mesh/machine.json. Report the summary line to the user:

Apple M5 Pro · 18 cores (6S + 12P) · 48.0 GB RAM · 40+ TOPS NPU · tier=sovereign

6. Pull right-sized local LLM weights

bash "$DOME_ROOT/scripts/ollama-init.sh"

This reads the tier detected in step 5 and pulls the matching Ollama models. On a sovereign tier (≥18 GB RAM) expect qwen2.5-coder:14b + llama3.1:8b + nomic-embed-text. Confirm with ollama list.

7. Initialize state + ingest KB

cd "$DOME_ROOT"
source .venv/bin/activate
python3 scripts/register-claude.py    # creates dome.db tables: agents, skills, tools, stack
python3 scripts/ingest.py             # indexes kb/, logs/, docs into ChromaDB

After this: sqlite3 db/dome.db "SELECT COUNT(*) FROM skills" should return ≥ 8. python3 -c "import chromadb; print(chromadb.PersistentClient('db/chroma').get_collection('dome-kb').count())" should return ≥ 1500.

8. Verify all protocols

python3 scripts/pre-spore-verify.py   # expect: 27/27 READY FOR SPORE.SH
bash scripts/audit.sh                 # expect: all green (or documented yellows)
bash scripts/dome-check.sh            # expect: 0 failures on a fresh install

If any of the three fails, surface the specific failure and do NOT declare setup complete. Common causes:

• akashic:write+query fails → stale akashic ChromaDB collection. Fix: delete via python3 -c "import chromadb; chromadb.PersistentClient('db/chroma').delete_collection('akashic')" then re-run.
• dome-check fails on SQLite DB missing → skipped step 7. Go back.
• audit.sh fails on FileVault OFF → user must enable in System Settings → Privacy & Security. This is not auto-fixable.

9. Report

Give the user a single-block status:

✅ DSH installed at $DOME_ROOT
✅ Lockdown active — firewall + pf anchor + DNS pinned
✅ Machine: <summary_one_liner output>
✅ KB indexed: <N> chunks in dome-kb
✅ pre-spore-verify: 27/27
Next: run `spore.sh` with a Trinity SPORE_TOKEN to activate Phase 2 (mesh).

Non-negotiables

• Never proceed past a failing step.
• Never commit .env or log output from lockdown scripts.
• Never run lockdown steps without explicit user sudo approval (the scripts handle it, but if they error-out silently, STOP).
• If the user has a non-M-series Mac (Intel), warn them — DSH is tested on Apple Silicon; some MPS-specific PyTorch code will not use acceleration.