|
| 1 | +# Onboarding |
| 2 | + |
| 3 | +This is the complete path from a fresh fork to a private Zaati OS dashboard powered by the LLM you already use. |
| 4 | + |
| 5 | +You will end with: |
| 6 | + |
| 7 | +- a public code fork that stays safe to share |
| 8 | +- a separate private repository for personal snapshots |
| 9 | +- one scheduled LLM workflow that refreshes several sources together |
| 10 | +- a private dashboard protected by Cloudflare Access |
| 11 | + |
| 12 | +> Want to look around first? Stop after [the synthetic tutorial](#2-run-the-synthetic-tutorial). It needs no credentials, provider account, `.env` file, or personal data. |
| 13 | +
|
| 14 | +## The journey |
| 15 | + |
| 16 | +| Stage | What you do | What Zaati OS creates | |
| 17 | +| ------------------- | --------------------------------------------- | ------------------------------------------- | |
| 18 | +| 1. Test drive | Fork, install, and run the tutorial | A local dashboard with synthetic data | |
| 19 | +| 2. Connect your LLM | Generate and paste one private task prompt | Validated snapshots in a private repository | |
| 20 | +| 3. Deploy safely | Protect a hostname, then connect private data | Your private, always-available dashboard | |
| 21 | + |
| 22 | +## Before you start |
| 23 | + |
| 24 | +You need: |
| 25 | + |
| 26 | +- [Git](https://git-scm.com/downloads) |
| 27 | +- [Node.js 22 or newer](https://nodejs.org/) |
| 28 | +- a GitHub account |
| 29 | +- an LLM or automation environment that can use your approved sources and write to GitHub |
| 30 | +- a Cloudflare account and custom domain only when you are ready to deploy |
| 31 | + |
| 32 | +ChatGPT, Claude, Gemini, local models, n8n, cron, and custom commands can all use the same generated contract. Provider menus differ, but the Zaati OS side does not. |
| 33 | + |
| 34 | +## 1. Fork, clone, and personalize |
| 35 | + |
| 36 | +Fork [`mohsinht/zaati-os`](https://github.com/mohsinht/zaati-os), then clone your fork: |
| 37 | + |
| 38 | +```bash |
| 39 | +git clone https://github.com/YOUR_GITHUB_USERNAME/zaati-os.git |
| 40 | +cd zaati-os |
| 41 | +npm install |
| 42 | +npm run setup |
| 43 | +``` |
| 44 | + |
| 45 | +The setup assistant asks for your dashboard name, timezone, currency, starter sources, theme, and optional encrypted snapshot storage. It writes `config/instance.local.json`, which is ignored by Git and uses private file permissions. |
| 46 | + |
| 47 | + |
| 48 | + |
| 49 | +Good starter choices: |
| 50 | + |
| 51 | +| Question | Recommended first answer | |
| 52 | +| ----------- | ------------------------------------------------------------- | |
| 53 | +| Source pack | `everyday` | |
| 54 | +| Palette | `sage` | |
| 55 | +| Font | `system` | |
| 56 | +| Headers | `plain` | |
| 57 | +| Encryption | `no` for the synthetic tutorial, decide before real snapshots | |
| 58 | + |
| 59 | +Rerun the wizard later with `npm run setup -- --force`. |
| 60 | + |
| 61 | +## 2. Run the synthetic tutorial |
| 62 | + |
| 63 | +```bash |
| 64 | +npm run tutorial |
| 65 | +``` |
| 66 | + |
| 67 | +The tutorial uses a credential-free mock LLM. It deliberately produces an invalid bundle once, receives safe validation feedback, retries, creates six synthetic snapshots atomically, and opens the local dashboard. |
| 68 | + |
| 69 | + |
| 70 | + |
| 71 | +Nothing personal is written. If this screen opens, the complete local ingestion and rendering loop works. |
| 72 | + |
| 73 | +## 3. Create the private memory repository |
| 74 | + |
| 75 | +Create a new private GitHub repository, for example `YOUR_GITHUB_USERNAME/zaati-data`. Do not fork the public code repository for this. |
| 76 | + |
| 77 | +The LLM workflow will maintain this shape: |
| 78 | + |
| 79 | +```text |
| 80 | +data/ |
| 81 | + snapshots/ |
| 82 | + <domain>/ |
| 83 | + <source>/ |
| 84 | + <YYYY>/<MM>/<YYYY-MM-DD>.json |
| 85 | +``` |
| 86 | + |
| 87 | +Your code fork can stay public. Your data repository must stay private. See [Private data repository](deployment/data-repository.md) for permissions, encryption, retention, and same-day reruns. |
| 88 | + |
| 89 | +## 4. Understand the environment setup |
| 90 | + |
| 91 | + |
| 92 | + |
| 93 | +There is no required `.env` file for the local demo. `.env.example` is a reference for optional deployment configuration. |
| 94 | + |
| 95 | +Keep values in the system that needs them: |
| 96 | + |
| 97 | +| Value | Where it belongs | Commit it? | |
| 98 | +| ------------------------------------- | ----------------------------------------------------- | ---------- | |
| 99 | +| Dashboard name, timezone, theme | Ignored `config/instance.local.json` | No | |
| 100 | +| Generated LLM task prompt | Ignored `.zaati/generated-prompts/` | No | |
| 101 | +| GitHub and source access | Your LLM provider's connection settings | No | |
| 102 | +| Hostname and Worker name | GitHub `production` environment variables | No | |
| 103 | +| Cloudflare and data repository tokens | GitHub `production` environment secrets | No | |
| 104 | +| Optional snapshot key | Protected deployment secret or ignored local key file | No | |
| 105 | + |
| 106 | +Never paste tokens into a generated prompt. Prefer provider-managed connections and narrow repository permissions. |
| 107 | + |
| 108 | +## 5. Connect the LLM you already use |
| 109 | + |
| 110 | +Generate a copy-ready task prompt: |
| 111 | + |
| 112 | +```bash |
| 113 | +npm run prompt:create |
| 114 | +``` |
| 115 | + |
| 116 | + |
| 117 | + |
| 118 | +For a useful first daily task, choose: |
| 119 | + |
| 120 | +- `agenda:primary` |
| 121 | +- `inbox:attention` |
| 122 | +- `work:focus` |
| 123 | +- `overview:daily`, after its dependencies |
| 124 | + |
| 125 | +Prompt Studio asks what each source should contain, which tools it may use, and which presentation blocks would help. It also asks for: |
| 126 | + |
| 127 | +- your public Zaati OS code fork |
| 128 | +- your private data repository |
| 129 | +- provider and timezone |
| 130 | +- schedule in plain language |
| 131 | +- direct commit or pull request publication |
| 132 | + |
| 133 | +It creates `.zaati/generated-prompts/<task>.scheduled-task.md` with the current schemas, privacy limits, retry protocol, deterministic paths, and atomic publication rules. |
| 134 | + |
| 135 | +### Configure the provider |
| 136 | + |
| 137 | +In ChatGPT, Claude, Gemini, n8n, or another supported environment: |
| 138 | + |
| 139 | +1. Connect GitHub and grant access to the private data repository. |
| 140 | +2. Connect only the source tools selected in Prompt Studio, for example calendar or email. |
| 141 | +3. Create a task, automation, or reusable workflow. |
| 142 | +4. Paste the complete generated scheduled-task prompt. |
| 143 | +5. Review the requested repositories, sources, paths, and schedule. |
| 144 | +6. Run it manually once before enabling recurrence. |
| 145 | +7. Confirm that all selected snapshots arrive in one commit or pull request. |
| 146 | + |
| 147 | +The provider must read the current default branch contracts on every run. A copied prompt alone is not permanent authority to ignore newer schemas. |
| 148 | + |
| 149 | +### Verify the first real run |
| 150 | + |
| 151 | +Check the private repository, not the public fork. A successful run should: |
| 152 | + |
| 153 | +- write only registered dated snapshot paths |
| 154 | +- update all selected sources together |
| 155 | +- contain no credentials, raw provider exports, or unnecessary personal content |
| 156 | +- preserve missing values, uncertainty, provenance, and warnings |
| 157 | +- leave no partial commit if one snapshot fails |
| 158 | + |
| 159 | +For safer review, keep `pull-request` publication until the workflow is stable. |
| 160 | + |
| 161 | +### Local command alternative |
| 162 | + |
| 163 | +If your LLM is exposed as a command that prints the exact JSON bundle: |
| 164 | + |
| 165 | +```bash |
| 166 | +your-llm-command | npm run snapshot:ingest -- --output-dir data/snapshots |
| 167 | +``` |
| 168 | + |
| 169 | +See [Local command adapter](tutorials/local-command-adapter.md). |
| 170 | + |
| 171 | +## 6. Preview real snapshots locally |
| 172 | + |
| 173 | +Keep the real files under ignored `data/snapshots/`, or point `ZAATI_DATA_DIR` to a private local checkout, then run: |
| 174 | + |
| 175 | +```bash |
| 176 | +npm run data:validate |
| 177 | +npm run dev |
| 178 | +``` |
| 179 | + |
| 180 | +The browser receives the facts required to render the dashboard. Treat the local session and every production hostname as private. |
| 181 | + |
| 182 | + |
| 183 | + |
| 184 | +## 7. Deploy privately |
| 185 | + |
| 186 | +The safe order matters: deploy synthetic data, protect the hostname, verify Access from outside your session, then connect private snapshots. |
| 187 | + |
| 188 | + |
| 189 | + |
| 190 | +### A. Create the protected GitHub environment |
| 191 | + |
| 192 | +In your code fork, create an environment named `production`. |
| 193 | + |
| 194 | +Add these environment variables: |
| 195 | + |
| 196 | +| Variable | Purpose | |
| 197 | +| ----------------------- | -------------------------------------------- | |
| 198 | +| `ZAATI_WORKER_NAME` | Cloudflare Worker name | |
| 199 | +| `ZAATI_HOSTNAME` | Exact custom hostname | |
| 200 | +| `ZAATI_ACCESS_VERIFIED` | Set to `true` only after verification | |
| 201 | +| `ZAATI_DATA_REPOSITORY` | Optional private repository, `owner/name` | |
| 202 | +| `ZAATI_DATA_REF` | Private data branch, normally `main` | |
| 203 | +| `ZAATI_AUTO_DEPLOY` | Enable only after a manual deployment passes | |
| 204 | + |
| 205 | +Add these environment secrets: |
| 206 | + |
| 207 | +| Secret | Purpose | |
| 208 | +| ----------------------------- | ----------------------------------------------- | |
| 209 | +| `CLOUDFLARE_ACCOUNT_ID` | Target Cloudflare account | |
| 210 | +| `CLOUDFLARE_API_TOKEN` | Scoped Workers edit token | |
| 211 | +| `ZAATI_DATA_REPOSITORY_TOKEN` | Read-only access to one private data repository | |
| 212 | +| `ZAATI_INSTANCE_CONFIG_JSON` | Optional complete instance configuration | |
| 213 | +| `ZAATI_SNAPSHOT_KEY` | Optional key for encrypted snapshot storage | |
| 214 | + |
| 215 | +### B. Deploy synthetic data |
| 216 | + |
| 217 | +Leave `ZAATI_DATA_REPOSITORY` unset. Run the `Deploy private dashboard` GitHub Actions workflow manually. |
| 218 | + |
| 219 | +### C. Protect and verify the hostname |
| 220 | + |
| 221 | +Create a Cloudflare Access self-hosted application for the exact hostname. Use exact email addresses or a constrained identity group, then test both an authorized browser and an incognito browser. |
| 222 | + |
| 223 | +```bash |
| 224 | +npm run access:verify -- life.example.com |
| 225 | +``` |
| 226 | + |
| 227 | +The command must detect an unauthenticated Access challenge or denial. |
| 228 | + |
| 229 | +### D. Connect private data |
| 230 | + |
| 231 | +Set the private data repository variable and its read-only token, set `ZAATI_ACCESS_VERIFIED=true`, then run the deployment workflow again. Only enable `ZAATI_AUTO_DEPLOY=true` after this manual run passes. |
| 232 | + |
| 233 | +Read [Private Cloudflare deployment](deployment/cloudflare.md) for token scopes, Access policy guidance, encryption, caching, and rollback. |
| 234 | + |
| 235 | +## Go-live checklist |
| 236 | + |
| 237 | +- [ ] The code fork contains no real snapshots or local instance file. |
| 238 | +- [ ] The data repository is private. |
| 239 | +- [ ] The LLM has only the GitHub and source access it needs. |
| 240 | +- [ ] One manual bundle run succeeded before scheduling. |
| 241 | +- [ ] The dashboard shows freshness, provenance, and honest missing states. |
| 242 | +- [ ] Cloudflare Access challenges an incognito visitor. |
| 243 | +- [ ] `npm run access:verify -- <hostname>` passes. |
| 244 | +- [ ] Private snapshots were connected only after Access verification. |
| 245 | +- [ ] `npm run check` passes before application changes are merged. |
| 246 | + |
| 247 | +## Where to go next |
| 248 | + |
| 249 | +- [Prompt Studio](prompt-studio.md), tune or automate prompt generation |
| 250 | +- [One-task daily bundle](tutorials/one-task-daily-bundle.md), refresh several domains in one run |
| 251 | +- [Add a domain](adding-a-domain.md), teach Zaati OS a new source |
| 252 | +- [Encrypted snapshots](tutorials/encrypted-snapshots.md), protect repository copies at rest |
| 253 | +- [Theme Studio](tutorials/theme-studio.md), personalize the interface |
| 254 | +- [Troubleshooting](troubleshooting.md), diagnose common setup and deployment issues |
0 commit comments