feat(sprint): onboard-first doctrine, orient drift detection, adaptive trust, platform secret push, VPS + installer fixes

[teckedd-code2save]

What's in here

Two sprint commits plus installer fixes, closing #13–#23.

Onboard → orient → plan doctrine (#23, #20)

first contact:   onboard  →  plan        (Convoy asks before it assumes)
every run after: orient   →  plan        (Convoy checks what changed)
greenfield:      onboard  →  plan, fast  (Convoy leads — its pick IS the pattern)

• Onboard gates the first plan. convoy plan/convoy ship on a repo with no .convoy/preferences.json blocks on a 5-question interview (interactive terminals only — CI warns and proceeds). Answers persist to .convoy/preferences.json; a named platform becomes a hard mandate.
• Greenfield = Convoy leads. "Not deployed anywhere" + "first deploy" → Convoy picks decisively, writes its choice into preferences.platform.mandate, and announces it as the team default.
• Orient is drift detection. Every subsequent plan runs orientRepo() and compares artifacts against declared preferences. Drift (e.g. a vercel.json appearing after the team declared Fly) is surfaced as an explicit warning with the remediation command — never a silent re-score. Mandate always wins. --skip-orient / --strict-drift flags included.
• When preferences exist but carry no mandate, orient signals feed the picker: existing platform config +40, CI deploy steps +30, standing VPS host +50 — visible in the score table.

Full commands + adaptive trust (#13–#17)

• convoy orient [path] — reads CI workflows, platform configs, secrets-manager and observability signals from repo artifacts. Also a convoy_orient MCP tool.
• convoy onboard [path] — five-section interview capturing deployment style, platform mandate, release process, compliance, observability. Also a convoy_onboard MCP tool.
• Adaptive trust (src/core/run-history.ts) — per-service trust levels 0–4 earned from .convoy/run-history.jsonl; auto-approves gates as trust grows; compliance requirements hard-disable auto-approve; breaches reset trust.
• DAG-aware lane sequencing — topoSortLanes() (Kahn's algorithm) turns plan.dependencies into deployment waves; CanaryStage executes wave-by-wave.
• Railway + Cloud Run real runners with CLI flags (--real-railway, --real-cloudrun, etc.).

Secrets actually reach the platform (#22)

convoy stage-secrets now pushes each collected value to the plan's platform (Fly / Vercel / Railway / Cloud Run) when CLI + auth allow, falling back gracefully to local-only with the reason. Shared logic in src/core/secret-push.ts; the web secrets panel gains a per-row "push to platform" action.

VPS fixes (#19, #21)

• convoy vps bootstrap probes SSH (BatchMode=yes, 5s timeout) before acting, distinguishes unreachable vs auth-failure, and prints the exact fix (ssh-copy-id … / --ssh-key / --ssh-user) instead of "Bootstrap failed. ssh connectivity".
• The web plan page platform switcher gains a vps option with an inline host input, pre-filled from preferences.

Installer fixes

• Committed a root .env.example (previously only demo-app/ had one — the documented cp .env.example .env referenced a missing file).
• Installer synthesizes .env when the example is absent and prompts for ANTHROPIC_API_KEY from /dev/tty, so curl | bash installs ask for the key instead of skipping silently.
• macOS BSD sed compatibility ([[:space:]] instead of \s).

Verification

• npm run typecheck and (cd web && npm run typecheck) both pass.
• npx tsx src/orient/drift.test.ts — 4/4 pass.
• Smoke-tested the onboard gate's non-interactive path: warns + proceeds with defaults on a prefs-less repo.

Closes #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23.

https://claude.ai/code/session_0127RzVpGF1bqhMxAviNnAMF

---

Generated by Claude Code