@astrale-os/cli 1.0.0-beta.7 → 1.0.0-beta.9

package/src/commands/view.ts

@@ -42,7 +42,7 @@ import {
 import { snapshotText, waitForSettledSnapshot } from '../lib/view/snapshot'
 
 /**
- * `astrale view` — open ONE view in an emulated host shell, authenticated as
+ * `astrale view` — open ONE view in a local browser shell, authenticated as
  * the CLI identity, driveable by agent-browser (default) or a real browser.
  * Design + protocol details: VIEW_CLI_SPEC.md at the workspace root.
  */
@@ -485,7 +485,7 @@ async function sessionsCommand(opts: ViewOpts): Promise<void> {
 
 export default {
   name: 'view',
-  description: 'Open one view in an emulated host shell your agent can drive',
+  description: 'Open one view in a local browser shell your agent can drive',
   arguments: [
     {
       name: 'spec',
@@ -525,7 +525,7 @@ export default {
   afterHelpText: `
 What it does:
   Renders ONE view — no GUI, no cookies, no WorkOS. It resolves the view on the
-  kernel, starts a loopback session server that emulates the shell host (real
+  kernel, starts a loopback session server that supplies the shell handshake (real
   handshake via @astrale-os/shell, token minted from YOUR CLI identity, kernel
   calls proxied), and opens the page headless in agent-browser. Driving stays
   agent-browser's job; auth follows --as/--creds/-i like any kernel command.

package/src/connection/__tests__/credential.test.ts

@@ -6,6 +6,7 @@ import { describe, expect, test } from 'bun:test'
 
 import type { AstraleConfig } from '../../lib/config'
 
+import { bindCredentialIdentity } from '../auth'
 import { createCliCredential, createConnectionCredential } from '../credential'
 
 const SOURCE = issuer.accept('https://kernel.example')
@@ -20,6 +21,24 @@ const config: AstraleConfig = {
 }
 
 describe('connection credential', () => {
+  test('pins the bookmark identity while leaving explicit credentials unnamed', async () => {
+    const target = {
+      url: `${SOURCE}/invoke`,
+      kernelIssuer: SOURCE,
+      defaultIdentity: 'bookmark-owner',
+    }
+
+    await expect(bindCredentialIdentity({}, target)).resolves.toMatchObject({
+      as: 'bookmark-owner',
+    })
+    await expect(bindCredentialIdentity({ as: 'explicit-owner' }, target)).resolves.toEqual({
+      as: 'explicit-owner',
+    })
+    await expect(bindCredentialIdentity({ creds: 'opaque' }, target)).resolves.toEqual({
+      creds: 'opaque',
+    })
+  })
+
   /** @evidence TEST-CLI-CONNECTION-RESOLVES-SOURCE-AUTH-BEFORE-ROUTING */
   test('resolves source authority without destination knowledge', async () => {
     const audiences: IssuerId[] = []

package/src/connection/__tests__/target.test.ts

@@ -68,6 +68,7 @@ describe('connection target', () => {
           id: 'managed-id',
           slug,
           url: 'https://managed.example',
+          state: 'ready',
         }),
       }),
     ).toEqual({

package/src/connection/auth.ts

@@ -1,4 +1,5 @@
 import type { AstraleConfig } from '../lib/config'
+import type { ConnectionOptions, ConnectionTarget } from './target'
 
 import { AuthError } from '../errors'
 import { getDefault, getIdentity, type Identity } from '../identity/registry'
@@ -21,6 +22,18 @@ export type KeyIdentityAuthOptions = {
   audience: string
 }
 
+/** Pin the local identity label before a session performs any authenticated effect. */
+export async function bindCredentialIdentity<Options extends ConnectionOptions>(
+  options: Options,
+  target: ConnectionTarget,
+): Promise<Options> {
+  if (options.anonymous === true || options.creds !== undefined || options.as !== undefined) {
+    return options
+  }
+  const identity = target.defaultIdentity ?? (await getDefault()).name
+  return Object.freeze({ ...options, as: identity })
+}
+
 /**
  * Resolve a signed JWT credential from CLI options.
  *

package/src/connection/failure/index.ts

@@ -1,7 +1,7 @@
 import type { OperationRecovery } from '../command'
 
+import { printFailureDebug } from '../../lib/failure-debug'
 import { classifyFailure } from './classify'
-import { printFailureDebug } from './debug'
 import { renderFailure } from './render'
 
 export { functionInputIssues, schemaUpgradeHint } from '../reasons'

package/src/connection/session.ts

@@ -21,6 +21,7 @@ import { fetchWithCaFile } from '../lib/ca-fetch'
 import { readConfig } from '../lib/config'
 import { log } from '../lib/log'
 import { isMachine } from '../lib/output'
+import { bindCredentialIdentity } from './auth'
 import { createCliCredential, validateCredentialSelection } from './credential'
 import { resolveAdminConnectionTarget, resolveConnectionTarget } from './target'
 
@@ -38,6 +39,8 @@ export interface ConnectionContext {
   readonly graph: GraphApi
   readonly auth: AuthApi
   readonly target: ConnectionTarget
+  /** Local identity label selected for this session; absent for raw credentials or anonymous use. */
+  readonly identity?: string
 }
 
 interface OwnedConnection {
@@ -63,6 +66,7 @@ export async function withClientSession<Value>(
   const target = await resolveConnectionTarget(options, config, {
     managed: (slug) => lookupManagedInstance(slug, options),
   })
+  options = await bindCredentialIdentity(options, target)
   warnMissingExplicitTarget(options, target)
   return runResolvedClientSession(target, timeoutMs, options, config, action, openConnection)
 }
@@ -76,6 +80,7 @@ export async function withAdminClientSession<Value>(
   const timeoutMs = resolveTimeoutMs(options.timeout)
   const config = await readConfig()
   const target = await resolveAdminConnectionTarget(options, config)
+  options = await bindCredentialIdentity(options, target)
   return runResolvedClientSession(target, timeoutMs, options, config, action, openConnection)
 }
 
@@ -141,7 +146,13 @@ function openConnection(
   const graph = createGraph((call, request) => session.call(call, request))
   const authApi = createAuth((path, input, request) => session.call(call(path, input), request))
   return {
-    context: Object.freeze({ session, graph, auth: authApi, target }),
+    context: Object.freeze({
+      session,
+      graph,
+      auth: authApi,
+      target,
+      ...(options.as === undefined ? {} : { identity: options.as }),
+    }),
     close() {
       session.close()
     },

package/src/lib/__tests__/command-dx.test.ts

@@ -16,7 +16,7 @@ function dx(
   error: CommanderError,
   argv: string[],
 ) {
-  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv))) as {
+  const rendered = JSON.parse(stripAnsi(renderCommanderError(program, error, argv, true))) as {
     error: string
     message: string
     detail: string

package/src/lib/__tests__/domain-publication.test.ts

@@ -3,7 +3,7 @@ import { defineSchema } from '@astrale-os/sdk/schema'
 import { describe, expect, test } from 'bun:test'
 
 import { releaseFor } from '../../__tests__/fixtures/publication'
-import { fetchDomainPublication } from '../domain-publication'
+import { domainPublicationUrl, fetchDomainPublication } from '../domain-publication'
 
 const ROOT = 'https://publication-reader.example.dev'
 const PUBLICATION_URL = `${ROOT}/.well-known/astrale/domain.json`
@@ -23,6 +23,11 @@ describe('Domain Publication reader', () => {
     expect(requests).toEqual([{ url: PUBLICATION_URL, redirect: 'error' }])
   })
 
+  test('normalizes an origin and admits the exact canonical Publication URL', () => {
+    expect(domainPublicationUrl(ROOT).href).toBe(PUBLICATION_URL)
+    expect(domainPublicationUrl(PUBLICATION_URL).href).toBe(PUBLICATION_URL)
+  })
+
   test('propagates redirect rejection instead of accepting another target', async () => {
     const fetch = async (_input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
       expect(init?.redirect).toBe('error')

package/src/lib/__tests__/instance-candidates.test.ts

@@ -18,7 +18,6 @@ const managedDemo: OwnedInstanceInfo = {
   slug: 'demo',
   url: 'https://demo.eu.astrale.ai',
   state: 'ready',
-  region: 'eu',
 }
 
 describe('collectInstanceCandidates', () => {
@@ -138,11 +137,10 @@ describe('describeInstanceCandidate', () => {
         slug: 'twin',
         url: 'https://twin.eu.astrale.ai',
         state: 'ready',
-        region: 'eu',
       },
     ])
     expect(describeInstanceCandidate(managed!)).toBe(
-      'twin (managed) https://twin.eu.astrale.ai/api — eu',
+      'twin (managed) https://twin.eu.astrale.ai/api',
     )
   })
 })

package/src/lib/__tests__/instance-target.test.ts

@@ -113,6 +113,7 @@ describe('resolveInstanceTarget', () => {
             id: 'node-1',
             slug,
             url: `https://${slug}.eu.astrale.ai`,
+            state: 'ready',
           }),
         },
       ),

package/src/lib/__tests__/log-errors.test.ts

@@ -36,6 +36,17 @@ describe('terminal error safety', () => {
     })
   })
 
+  test('retains unknown failure evidence only under explicit debug output', () => {
+    const failure = new AggregateError([new Error('provider rejected organization scope')], '')
+
+    expect(() => fatal(failure, { json: true, debug: true })).toThrow(ExitError)
+
+    expect(stderr).toContain(
+      '{"error":"UNEXPECTED_ERROR","message":"The CLI encountered an unexpected internal failure."}',
+    )
+    expect(stderr).toContain('aggregate: Error: provider rejected organization scope')
+  })
+
   test('rejects blank admitted CLI diagnostics', () => {
     expect(() => new AstraleError('INVALID_INPUT', '  ')).toThrow(TypeError)
   })

package/src/lib/admin-instance.ts

@@ -6,7 +6,7 @@ import { withAdminClientSession } from '../connection'
 export {
   AdminInstanceNotFoundError,
   findOwnedInstance,
-  formatInstanceLocation,
+  formatInstanceState,
   type InstanceInfo,
   type InstanceState,
   type OwnedInstanceInfo,
@@ -19,19 +19,25 @@ export function listOwnedInstances(options: AdminConnectionOptions) {
   )
 }
 
+/** Read caller-visible inventory together with the exact local identity used for the Admin call. */
+export function listOwnedInstancesWithIdentity(options: AdminConnectionOptions) {
+  return withAdminClientSession(options, async (context) =>
+    Object.freeze({
+      instances: await (await connectAdminInstances(context)).list(),
+      ...(context.identity === undefined ? {} : { identity: context.identity }),
+    }),
+  )
+}
+
 /** Reuse an already-open Admin session for a caller-visible Instance inventory. */
 export async function listOwnedInstancesInContext(context: ConnectionContext) {
   return (await connectAdminInstances(context)).list()
 }
 
-/** Provision through Fleet placement or one explicitly resolved Host receiver. */
-export function createOwnedInstance(
-  options: AdminConnectionOptions,
-  slug: string,
-  hostId?: string,
-) {
+/** Request one managed Instance; Admin owns infrastructure placement. */
+export function createOwnedInstance(options: AdminConnectionOptions, slug: string) {
   return withAdminClientSession(options, async (context) =>
-    (await connectAdminInstances(context)).create(slug, hostId),
+    (await connectAdminInstances(context)).create(slug),
   )
 }
 

package/src/lib/command-dx.ts

@@ -2,8 +2,6 @@ import type { Command, CommanderError } from 'commander'
 
 import chalk from 'chalk'
 
-import { isMachine } from './output'
-
 export type CommandCatalogEntry = {
   path: string[]
   usage: string
@@ -30,13 +28,15 @@ export function renderCommanderError(
   program: Command,
   error: CommanderError,
   argv = process.argv.slice(2),
+  machine = argv.some((token) => token === '--ci' || token === '--json' || token === '--raw') ||
+    !(process.stdout.isTTY ?? false),
 ): string {
   const tokens = stripOptions(argv)
   const catalog = collectCommandCatalog(program)
   const matched = matchRegisteredPrefix(program, tokens)
 
   if (matched.path.length === 0 && tokens.length > 0) {
-    return maybeMachine(renderUnknownCommand(tokens, catalog))
+    return maybeMachine(renderUnknownCommand(tokens, catalog), machine)
   }
 
   if (error.code === 'commander.missingArgument') {
@@ -48,6 +48,7 @@ export function renderCommanderError(
         'Usage:',
         `  astrale ${usage}`,
       ].join('\n'),
+      machine,
     )
   }
 
@@ -63,6 +64,7 @@ export function renderCommanderError(
         'Usage:',
         `  astrale ${usage}`,
       ].join('\n'),
+      machine,
     )
   }
 
@@ -74,6 +76,7 @@ export function renderCommanderError(
         ? ['', 'Did you mean:', ...suggestions.map((s) => `  astrale ${s}`)]
         : []),
     ].join('\n'),
+    machine,
   )
 }
 
@@ -140,8 +143,8 @@ function usageFor(path: string[], command: Command): string {
 
 const ANSI_RE = new RegExp(String.fromCharCode(27) + '\\[[0-9;]*m', 'g')
 
-function maybeMachine(text: string): string {
-  if (!isMachine()) return text
+function maybeMachine(text: string, machine: boolean): string {
+  if (!machine) return text
   const plain = text.replace(ANSI_RE, '')
   const first = plain.split('\n').find((line) => line.trim().length > 0) ?? plain
   return JSON.stringify({ error: 'USAGE_ERROR', message: first, detail: plain })

package/src/lib/domain-publication.ts

@@ -9,8 +9,7 @@ export async function fetchDomainPublication(
   signal?: AbortSignal,
   fetchImpl: FetchLike = globalThis.fetch,
 ): Promise<publication.Publication> {
-  const root = deploymentRoot(input)
-  const url = new URL(publication.PATH, root)
+  const url = domainPublicationUrl(input)
   const response = await fetchImpl(url, {
     redirect: 'error',
     ...(signal === undefined ? {} : { signal }),
@@ -81,7 +80,8 @@ async function cancel(body: ReadableStream<Uint8Array> | null): Promise<void> {
   if (body !== null) await body.cancel().catch(() => undefined)
 }
 
-function deploymentRoot(input: string): URL {
+/** Canonical discovery document for a Domain origin or exact Publication URL. */
+export function domainPublicationUrl(input: string): URL {
   let url: URL
   try {
     url = new URL(input)
@@ -94,9 +94,11 @@ function deploymentRoot(input: string): URL {
     url.password !== '' ||
     url.search !== '' ||
     url.hash !== '' ||
-    !['', '/'].includes(url.pathname)
+    !['', '/', publication.PATH].includes(url.pathname)
   ) {
-    throw new TypeError(`Domain deployment URL must be an HTTP(S) origin: ${input}`)
+    throw new TypeError(
+      `Domain deployment URL must be an HTTP(S) origin or canonical Publication URL: ${input}`,
+    )
   }
-  return new URL(url.origin)
+  return new URL(publication.PATH, url.origin)
 }

package/src/lib/instance-candidates.ts

@@ -1,6 +1,6 @@
 import type { InstanceEntry, InstanceStore } from './instance'
 
-import { formatInstanceLocation, type OwnedInstanceInfo } from './admin-instance'
+import { formatInstanceState, type OwnedInstanceInfo } from './admin-instance'
 import { normalizeInstanceKernelUrl, resolveInstanceKey } from './instance'
 
 export type InstanceCandidate =
@@ -44,6 +44,6 @@ export function describeInstanceCandidate(candidate: InstanceCandidate): string
   if (candidate.source === 'bookmark') {
     return `${candidate.key} (bookmark) ${candidate.url}`
   }
-  const extra = formatInstanceLocation(candidate.info)
+  const extra = formatInstanceState(candidate.info)
   return `${candidate.key} (managed) ${candidate.url}${extra ? ` — ${extra}` : ''}`
 }

package/src/lib/instance.ts

@@ -297,22 +297,26 @@ export async function upsertInstance(
  * bookmark was repointed to a different kernel so callers can warn.
  */
 export async function upsertManagedBookmark(
-  key: string,
-  slug: string,
-  rawUrl: string,
-  organizationId?: string,
+  input: Readonly<{
+    key: string
+    slug: string
+    url: string
+    organizationId?: string
+    defaultIdentity?: string
+  }>,
 ): Promise<{ entry: InstanceEntry; repointedFrom?: string }> {
   const store = await readInstances()
-  const previousUrl = store.instances[key]?.url
-  const url = normalizeInstanceKernelUrl(rawUrl)
-  const { entry } = await upsertInstance(key, {
+  const previousUrl = store.instances[input.key]?.url
+  const url = normalizeInstanceKernelUrl(input.url)
+  const { entry } = await upsertInstance(input.key, {
     url,
     issuer: url,
-    slug,
-    name: slug,
+    slug: input.slug,
+    name: input.slug,
     kind: 'bookmark',
     mode: 'remote',
-    ...(organizationId ? { organizationId } : {}),
+    ...(input.organizationId ? { organizationId: input.organizationId } : {}),
+    ...(input.defaultIdentity ? { defaultIdentity: input.defaultIdentity } : {}),
   })
   return {
     entry,

package/src/lib/log.ts

@@ -2,6 +2,7 @@ import chalk from 'chalk'
 import ora, { type Ora } from 'ora'
 
 import { AstraleError, NotImplementedError } from '../errors'
+import { printFailureDebug } from './failure-debug'
 import { formatElapsed } from './format'
 import { isMachine, type MachineOpts } from './output'
 
@@ -18,7 +19,7 @@ export const log = {
 
 /** Report an error with hint (when present) and exit. `--json` / `--ci` / a
  *  non-TTY stdout always get one structured JSON line on stderr. */
-export function fatal(e: unknown, opts?: MachineOpts): never {
+export function fatal(e: unknown, opts?: MachineOpts & { readonly debug?: boolean }): never {
   // Ctrl-C at an interactive (@inquirer/prompts) prompt — exit quietly with the
   // SIGINT convention, not a red error line.
   if (e instanceof Error && e.name === 'ExitPromptError') process.exit(130)
@@ -29,10 +30,11 @@ export function fatal(e: unknown, opts?: MachineOpts): never {
     const payload: Record<string, unknown> = { error: code, message: msg }
     if (e instanceof AstraleError && e.hint) payload.hint = e.hint
     process.stderr.write(JSON.stringify(payload) + '\n')
-    process.exit(1)
+  } else {
+    log.error(`${code}: ${msg}`)
+    if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
   }
-  log.error(`${code}: ${msg}`)
-  if (e instanceof AstraleError && e.hint) log.dim(`  hint: ${e.hint}`)
+  if (opts?.debug) printFailureDebug(e, '')
   process.exit(1)
 }
 

package/src/lib/provision-instance.ts

@@ -9,12 +9,10 @@ import { createOwnedInstance } from './admin-instance'
 import { setActive, upsertManagedBookmark } from './instance'
 import { withSpinner } from './log'
 import { isMachine } from './output'
-import { promptSelect } from './prompt'
 import { validateSlug } from './validation'
 
 export type ProvisionOpts = KernelCommandOpts &
   AdminTargetCommandOpts & {
-    hostId?: string
     // Global flags (program.ts) that force non-interactive — mirrors `instance use`.
     ci?: boolean
     noPrompt?: boolean
@@ -35,10 +33,10 @@ export type ProvisionResult = {
 const SAGA_TIMEOUT_MS = '240000'
 
 /**
- * Provision an alpha instance through the admin kernel, then bookmark it and
+ * Provision an instance through the admin kernel, then bookmark it and
  * make it the active target. Extracted from `instance create` so `astrale
- * setup` provisions through the exact same saga (auth assertion → alphaCreate →
- * bookmark → set-active), including the interactive multi-host picker.
+ * setup` provisions through the exact same saga (auth assertion → create →
+ * bookmark → set-active).
  *
  * Presentation is deliberately minimal here (a spinner + a one-line success);
  * the caller renders anything richer — `setup` follows this with a hero panel.
@@ -48,15 +46,10 @@ export async function provisionInstance(
   opts: ProvisionOpts,
 ): Promise<ProvisionResult> {
   validateSlug(slug)
-  await assertAlphaCreateAuth(opts)
-  // The created instance must belong to the LOGGED-IN identity — never to an
-  // identity pinned on the admin bookmark (that mismatch silently made a fresh
-  // user's instance unusable). `--as` still wins.
-  if (!opts.as) opts = { ...opts, as: (await readIdentities()).default }
+  const authentication = await instanceCreateAuthentication(opts)
+  opts = authentication.opts
 
   const machine = isMachine(opts)
-  const interactive = !!process.stdin.isTTY && !(opts.ci || opts.noPrompt || process.env.CI)
-
   let repointedFrom: string | undefined
   let selectionError: unknown = null
   // The global 30s default doesn't just fail the CLIENT: the disconnect kills
@@ -65,21 +58,24 @@ export async function provisionInstance(
   // timeout; an explicit --timeout still wins.
   const createOpts = { ...opts, timeout: opts.timeout ?? SAGA_TIMEOUT_MS }
 
-  const runProvision = (hostId: string | undefined) =>
+  const runProvision = () =>
     withSpinner(
       `Provisioning instance ${slug}`,
       !machine,
       async () => {
-        const created = await createOwnedInstance(createOpts, slug, hostId)
+        const created = await createOwnedInstance(createOpts, slug)
         try {
           // Org id from the create response — authoritative for token scoping
           // (the router's /auth/org is eventually consistent).
-          const bookmarked = await upsertManagedBookmark(
-            slug,
+          const bookmarked = await upsertManagedBookmark({
+            key: slug,
             slug,
-            created.url,
-            created.organizationId,
-          )
+            url: created.url,
+            ...(created.organizationId ? { organizationId: created.organizationId } : {}),
+            ...(authentication.defaultIdentity
+              ? { defaultIdentity: authentication.defaultIdentity }
+              : {}),
+          })
           repointedFrom = bookmarked.repointedFrom
           await setActive(slug)
         } catch (e) {
@@ -93,23 +89,7 @@ export async function provisionInstance(
       },
     )
 
-  // Host placement is chosen SERVER-side (the caller's ready + USE-granted
-  // hosts). We recover ONLY from its multi-host ambiguity: pop a picker and
-  // retry with the chosen host_id — the ambiguity error throws before any
-  // provisioning side effect, so the retry is clean. No host / permission /
-  // capacity / a non-interactive run all reject through to the caller's `fatal`,
-  // surfacing the server's own message plus the listed ids. An explicit
-  // `--host-id` skips all of this.
-  const created = await runProvision(opts.hostId).catch(async (e: unknown) => {
-    const hostIds = !opts.hostId && interactive ? parseEligibleHostIds(e) : null
-    if (!hostIds) throw e
-    const chosen = await promptSelect(
-      `${hostIds.length} hosts available — pick one to provision on`,
-      hostIds.map((hid) => ({ name: hid, value: hid })),
-    )
-    if (!chosen) throw e
-    return runProvision(chosen)
-  })
+  const created = await runProvision()
 
   // Warnings go to stderr so machine-readable stdout stays clean.
   const warn = (msg: string) => console.error(chalk.yellow('⚠'), msg)
@@ -124,31 +104,28 @@ export async function provisionInstance(
   return { created, slug, repointedFrom, ...(selectionError ? { selectionError } : {}) }
 }
 
-/**
- * Recover the eligible host ids from alphaCreate's multi-host error
- * ("N ready hosts are assigned (id1, id2). Specify host_id…") — only when
- * there's a real choice (>1). Returns null for any other error (no host,
- * permission, capacity). Deliberately coupled to that message wording (Option
- * B: no admin-side change); if it ever drifts we simply stop offering the
- * picker and the raw error is shown instead — no worse than before.
- */
-export function parseEligibleHostIds(error: unknown): string[] | null {
-  const text = error instanceof Error ? error.message : String(error)
-  const match = /ready hosts are assigned \(([^)]+)\)/.exec(text)
-  if (!match) return null
-  const ids = match[1]!
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean)
-  return ids.length > 1 ? ids : null
+async function instanceCreateAuthentication(opts: ProvisionOpts): Promise<{
+  readonly opts: ProvisionOpts
+  readonly defaultIdentity?: string
+}> {
+  if (opts.creds) return { opts }
+  const store = await readIdentities()
+  const defaultIdentity = selectInstanceCreateIdentity(store, opts)
+  return {
+    opts: opts.as ? opts : { ...opts, as: defaultIdentity },
+    defaultIdentity,
+  }
 }
 
-async function assertAlphaCreateAuth(opts: Pick<ProvisionOpts, 'as' | 'creds'>): Promise<void> {
-  if (opts.creds) return
-  assertAlphaCreateIdentity(await readIdentities(), opts)
+export function selectInstanceCreateIdentity(
+  store: IdentityStore,
+  opts: Pick<ProvisionOpts, 'as'> = {},
+): string {
+  assertInstanceCreateIdentity(store, opts)
+  return opts.as ?? store.default
 }
 
-export function assertAlphaCreateIdentity(
+export function assertInstanceCreateIdentity(
   store: IdentityStore,
   opts: Pick<ProvisionOpts, 'as'> = {},
 ): void {

package/src/program/__tests__/program.test.ts

@@ -187,7 +187,7 @@ describe('program composition', () => {
       'whoami',
     ])
     expect(createHash('sha256').update(JSON.stringify(surface)).digest('hex')).toBe(
-      '42b4812abbbca3d54289a16d0b066dfb3b1caaf1df6597a425c675744466a728',
+      'abd4d584cbefa707ecc2c939d990b0bfdff8f4d1b28bce9fe4b206fdd1a3e3e9',
     )
   })
 
@@ -213,6 +213,19 @@ describe('help contract — no internal SPEC anchors leak to users', () => {
 
     expect(offenders).toEqual([])
   })
+
+  test('Kernel and Instance vocabulary does not expose retired Host or Interface concepts', async () => {
+    const program = await buildProgram()
+    const help = allCommands(program)
+      .map((command) => command.helpInformation())
+      .join('\n')
+
+    expect(help).not.toContain('host.astrale.ai')
+    expect(help).not.toContain(':interface.')
+    expect(help).not.toContain('Class or Interface')
+    expect(help).not.toContain('emulated host')
+    expect(help).not.toContain('Host shell')
+  })
 })
 
 describe('help contract — IdP/auth surface is registered', () => {
@@ -251,14 +264,17 @@ describe('help contract — admin target surface is registered', () => {
     expect(adminUse?.helpInformation()).not.toContain('--issuer <url>')
   })
 
-  test('instance create is the alphaCreate flow, not legacy Instance.init DX', async () => {
+  test('instance create delegates infrastructure placement to Admin', async () => {
     const program = await buildProgram()
     const instanceCreate = allCommands(program).find((command) => command.name() === 'create')
     const help = instanceCreate?.helpInformation() ?? ''
 
-    expect(help).toContain('Instance.alphaCreate')
+    expect(help).toContain('Provision an instance through the Admin control plane')
+    expect(help).not.toContain('Host')
+    expect(help).not.toContain('Fleet')
+    expect(help).not.toContain('--host-id')
     expect(help).not.toContain('--no-use')
-    expect(help).not.toContain('Instance.init requires --host-id')
+    expect(help).not.toContain('Instance.init')
   })
 })