> ## Documentation Index
> Fetch the complete documentation index at: https://docs.khal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enroll, request a workstation, and connect

> Redeem your invite, get a real cloud workstation, and SSH in.

For a new FDE with an invite code. By the end you're SSHed into your own full-sudo Ubuntu box.

<Note>
  Minting invites is an admin job — see [Mint an invite and approve access](/fde-start-here/access/admin-guide).
</Note>

## Before you start

* The `khal` CLI — see [Install your FDE toolchain](/fde-engineer/khal-cli).
* A single-use **invite code** from an admin. Ask for it over a secure channel.

<Steps>
  <Step title="Have an SSH key ready">
    `khal fde enroll` needs your **public** key — never your private one.

    <CodeGroup>
      ```bash Check for one theme={null}
      ls -la ~/.ssh/id_ed25519.pub 2>/dev/null || echo "no key yet"
      ```

      ```bash Generate one theme={null}
      ssh-keygen -t ed25519 -C "you@namastex.ai" -f ~/.ssh/id_ed25519 -N ""
      ```
    </CodeGroup>
  </Step>

  <Step title="Redeem your invite">
    ```bash theme={null}
    khal fde enroll --invite <your-invite-code> --target dev --ssh-key ~/.ssh/id_ed25519.pub
    ```

    * `--invite` is **single-use**. If it says "already used," ask for a new one — don't retry.
    * `--target` is the environment label (`dev`/`hml`/`prod`); new FDEs want `dev`. Not a hostname.
    * `--ssh-key` is the **public** key — it's what lands on your workstation.

    Success moves your state to `platform_enrollment_completed`.
  </Step>

  <Step title="Request your workstation">
    <Tabs>
      <Tab title="Default (recommended)">
        ```bash theme={null}
        khal fde instance
        ```

        Uses the standard `engineer-standard` profile.
      </Tab>

      <Tab title="Explicit provider">
        ```bash theme={null}
        khal fde instance --provider kubevirt
        ```
      </Tab>
    </Tabs>

    This is where access becomes real: a background worker clones the `engineer-standard` Ubuntu 24.04 image into a real KubeVirt VM (not a container), and cloud-init sets up your user, installs your key, and joins Tailscale. State goes `instance_requested` → `runtime_ready` — a few minutes; watch `khal fde status`.
  </Step>

  <Step title="Wait for approval">
    The SSH lease is gated by the Deploy Ledger until a lead approves it — expected, not a bug. Ping whoever's onboarding you and point them at the [admin guide](/fde-start-here/access/admin-guide).
  </Step>

  <Step title="Connect">
    <Tabs>
      <Tab title="Plan first">
        ```bash theme={null}
        khal fde ssh --dry-run
        ```
      </Tab>

      <Tab title="Connect">
        ```bash theme={null}
        khal fde ssh
        ```

        Once approved, prints a ready `ssh <user>@<host>` (your workstation's Tailscale hostname).
      </Tab>
    </Tabs>

    <Warning>Before approval, `khal fde ssh` returns a clear "not approved yet" — you're waiting, not stuck.</Warning>
  </Step>

  <Step title="Verify">
    ```bash theme={null}
    whoami; hostname; sudo -v && echo "sudo ok"
    ```

    Your own user, your workstation's hostname, working `sudo` — a real dev box, not a shared jump host. That's access.
  </Step>
</Steps>

## Anytime

```bash theme={null}
khal fde status
```

Shows exactly where you are — before, during, or after any step.

## Next

<CardGroup cols={2}>
  <Card title="Install your FDE toolchain" icon="terminal" href="/fde-engineer/khal-cli">
    Git, Node, Bun, and the `khal`/`khaw` CLIs.
  </Card>

  <Card title="Day 0 walkthrough" icon="route" href="/fde-engineer/khal-cli">
    What to do once you're on your workstation.
  </Card>
</CardGroup>

<Accordion title="🤖 Agent paste prompt">
  ```text theme={null}
  TASK: Use `fde-start-here/access/engineer-guide.mdx` to guide a new FDE through getting access; run safe verification first, return evidence + blockers.
  SAFE FIRST COMMANDS: `khal fde status`, `khal fde ssh --dry-run`, `khal --version` (none mutate).
  MUTATING — confirm first: `khal fde enroll` (consumes the single-use invite), `khal fde instance` (provisions a real VM).
  EVIDENCE: command, exit status, sanitized output (no raw invite codes or hostnames), what it proves, next safe action.
  ```
</Accordion>