What access means for an FDE

FDE “access” isn’t a dashboard account — it’s ssh into your own full-sudo Ubuntu workstation on KHAL infrastructure. This page is the map; the two role guides are the runbooks.

Every command is the khal fde CLI (from app-kit), always talking to platform.khal.ai. --target is an environment label (dev, hml, prod), never a URL.

Two roles, one flow

Admin/superadmin — mints your invite, later approves your SSH lease.
You (engineer) — redeem the invite, request the workstation, connect.

No shortcuts: no workstation without an invite, no SSH without an approval.

The flow

Admin mints an invite

A single-use code that bootstraps your identity.

You enroll

Redeem it and hand over your SSH public key — khal fde enroll.

You request a workstation

khal fde instance provisions a real VM — cloned, booted, on Tailscale.

Admin approves

The workstation exists, but the SSH lease stays gated until approved.

You connect

khal fde ssh. Check khal fde status anytime.

Before you start

Install the khal CLI — see Install your FDE toolchain.

Pick your role

I'm the admin

Mint an invite, then approve the workstation.

I'm the new engineer

Redeem, request, connect.

Stuck? Access troubleshooting.

🤖 Agent paste prompt

TASK: Use `fde-start-here/access/overview.mdx` to orient a new FDE or admin, then hand off to the role-specific guide before running anything.
CONTEXT: Orientation page, not a runbook — commands live in the admin and engineer guides it links to.
SAFE FIRST COMMANDS: `khal fde status`, `khal --version` (neither mutates).
EVIDENCE: Confirm the role (admin or engineer) before recommending a command, then follow that page's own agent prompt.

Enroll, request a workstation, and connect

​Two roles, one flow

​The flow

​Before you start

​Pick your role

I'm the admin

I'm the new engineer

Two roles, one flow

The flow

Before you start

Pick your role