cli: day-1 bootstrap helpers — config check, agent cert, node pairing

[mbertschler]

Problem (friction log F1–F4, F34, F35 — bootstrap day)

Bootstrap was the friction-densest stretch of the reference-setup walk. Everything trust-critical is DIY:

• F1 — agent TLS cert + sha256:<hex of DER> pin require hand-rolled openssl incantations; no command produces either, nothing prints the fingerprint.
• F2 — crypt passwords must be pre-obscured with rclone obscure by hand (4 invocations for two crypt destinations), the only place rclone leaks through squirrel's "you never touch rclone" stance. (sync: sftp and b2 credential keys don't match rclone's option schema #153 fixes the sftp pass case internally; crypt config should follow the same principle.)
• F3 — one nas↔htpc relationship needs four token bindings across two files; nothing validates the pairing until a runtime 401.
• F4 — a freshly configured machine reports nothing: volumes reads the DB, not the config, so parse-success is indistinguishable from "nothing configured".
• F34 — the node byte-path is an unvalidated out-of-band contract (nothing checks it at load; failures surface as undiagnosable transfer errors).
• F35 — cadence-only machines must run the full agent listener just to get the scheduler.

Decision (Martin, 2026-07-24 — option 6d)

Day-1 helpers get their own issue (this one); recovery paths (destination reset, machine replacement) are a separate issue.

Scope

• squirrel config check — parse + resolve everything (env vars included), validate offload_requires satisfiability (with sync: plain mirrors earn durability evidence; unsatisfiable offload_requires is a config error #156), stat volume paths and node byte-paths, flag empty volume paths, and print the affirmative summary: "5 volumes, 3 destinations, 2 nodes — all resolvable".
• squirrel agent cert — generate self-signed cert+key at the configured paths and print the sha256: pin ready to paste into peers' [nodes.X.tls]; the agent also logs its own fingerprint at startup.
• Node pairing helper — generate the matching config halves for both sides of a peer relationship (tokens both directions, endpoint, fingerprint), killing the F3 token-matrix class of error. Exact shape (squirrel node pair emitting TOML snippets vs something richer) to be designed in the PR.
• Crypt secrets accepted as plaintext (env or literal) and obscured at rclone.conf render time, retiring the manual rclone obscure step (breaking-change note: existing obscured values need a migration story or a marker key).
• Listener-less agent mode (scheduler without [agent] listen, F35) — possibly its own small PR.

See design/friction-log.md F1–F4, F34, F35.

[mbertschler]

Landed across two PRs: #171 (config check, agent cert, node pair, plaintext crypt secrets) merged straight into main, and #175 (listener-less agent mode, F35) merged into claude/issue-162-bootstrap-helpers and reached main with #171 — the stacked base is why #175's Closes #162 keyword never auto-closed this.

Verified on main (09c2760): cmd/squirrel/config_check.go, agent_cert.go, node_pair.go, the crypt-obscure-at-render path, and listener-less operation (agent/serve.go RunSchedulers + agent_listenerless_test.go). All five scoped boxes are done.

Two decisions from those PRs are worth a second look at some point, both documented in the PR bodies rather than settled by me: the print-both-halves shape of node pair, and the breaking change on crypt secrets (existing obscured values need obscured = true).

Closing as completed.

---

Generated by Claude Code