Enroll, request a workstation, and connect

For a new FDE with an invite code. By the end you’re SSHed into your own full-sudo Ubuntu box.

Minting invites is an admin job — see Mint an invite and approve access.

Before you start

The khal CLI — see Install your FDE toolchain.
A single-use invite code from an admin. Ask for it over a secure channel.

Have an SSH key ready

khal fde enroll needs your public key — never your private one.

ls -la ~/.ssh/id_ed25519.pub 2>/dev/null || echo "no key yet"

ssh-keygen -t ed25519 -C "you@namastex.ai" -f ~/.ssh/id_ed25519 -N ""

Redeem your invite

khal fde enroll --invite <your-invite-code> --target dev --ssh-key ~/.ssh/id_ed25519.pub

--invite is single-use. If it says “already used,” ask for a new one — don’t retry.
--target is the environment label (dev/hml/prod); new FDEs want dev. Not a hostname.
--ssh-key is the public key — it’s what lands on your workstation.

Success moves your state to platform_enrollment_completed.

Request your workstation

Default (recommended)
Explicit provider

khal fde instance

Uses the standard engineer-standard profile.

khal fde instance --provider kubevirt

This is where access becomes real: a background worker clones the engineer-standard Ubuntu 24.04 image into a real KubeVirt VM (not a container), and cloud-init sets up your user, installs your key, and joins Tailscale. State goes instance_requested → runtime_ready — a few minutes; watch khal fde status.

Wait for approval

The SSH lease is gated by the Deploy Ledger until a lead approves it — expected, not a bug. Ping whoever’s onboarding you and point them at the admin guide.

Connect

Plan first
Connect

khal fde ssh --dry-run

khal fde ssh

Once approved, prints a ready ssh <user>@<host> (your workstation’s Tailscale hostname).

Before approval, khal fde ssh returns a clear “not approved yet” — you’re waiting, not stuck.

Verify

whoami; hostname; sudo -v && echo "sudo ok"

Your own user, your workstation’s hostname, working sudo — a real dev box, not a shared jump host. That’s access.

Anytime

khal fde status

Shows exactly where you are — before, during, or after any step.

Install your FDE toolchain

Git, Node, Bun, and the khal/khaw CLIs.

Day 0 walkthrough

What to do once you’re on your workstation.

🤖 Agent paste prompt

TASK: Use `fde-start-here/access/engineer-guide.mdx` to guide a new FDE through getting access; run safe verification first, return evidence + blockers.
SAFE FIRST COMMANDS: `khal fde status`, `khal fde ssh --dry-run`, `khal --version` (none mutate).
MUTATING — confirm first: `khal fde enroll` (consumes the single-use invite), `khal fde instance` (provisions a real VM).
EVIDENCE: command, exit status, sanitized output (no raw invite codes or hostnames), what it proves, next safe action.

Onboarding & access

Enroll, request a workstation, and connect

Before you start

Anytime

Next

Install your FDE toolchain

Day 0 walkthrough

​Before you start

​Anytime

​Next

Install your FDE toolchain

Day 0 walkthrough

Before you start

Anytime

Next