Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,84 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-09-25 — A licensed instance can choose the managed model while it is being installed `api 0.113.0` `web 0.138.0`
+
+**The install screen now asks for the licence before the model, and offers the managed model
+there.** The model step used to come first and knew only your own provider. The managed model can
+only be offered to an instance your Jarvis provider has linked to its licence, that link is made by
+the instance's licence report, and an instance being installed sent none — so a licensed customer
+had to type a key for a provider they did not want, or skip the model and choose the managed one
+afterwards under **Settings → Platform → Model**.
+
+**Adding a paid or trial key on the install screen now sends the licence report straight away**,
+rather than once the install is finished — and so does opening the licence step with a key the
+instance already holds from `JARVIS_LICENSE_KEY`. That is a new moment of sending, so here is
+exactly what it is: the same report with the same fields as every other — the licence id, this
+instance's id and public key, its version, contract checksum, counts and public address, the
+timestamps and the signature; no names and no conversation content. The
+[README](README.md#licence-keys-and-what-your-instance-reports) lists every field. It goes early
+because it is what links the instance to its licence. The licence step says so beside the key field,
+and shows how the report went — linked, refused by your provider and why, or not sent and why — with
+**Report now** to try again.
+
+**Nothing else reports earlier than before.** Only the licence step sends a report while the
+instance is being installed; nothing reports on its own until the install is finished, even when
+the key and the address both come from the environment. An instance without a licence still sends
+nothing until then, and the licence step sends nothing for a licensed one whose address is not set
+yet, is `localhost` or another loopback address, or is an example address such as
+`jarvis.example.com`.
+
+**The model step is now the same choice as the settings screen**: your own provider, with the test
+button and "Skip for now" as before, or the managed model, with the same statement of what it sends
+and the same box to tick before it is selected. Choosing the managed model there is enough to
+continue, so a licensed install can be finished without a model key of your own. Without a licence,
+the managed option is shown as unavailable, with the reason and a way back to the licence step.
+Reaching the model step on a licensed instance asks your provider whether the managed model is
+offered, exactly as opening **Settings → Platform → Model** does: a signed request with no
+conversation content.
+
+**Also in this release.**
+
+- "Report now", under the managed model's option in the model settings, now says what your provider
+  answered when a report did not link the instance — a licence it does not know, one already in use
+  on as many instances as it allows, one it has withdrawn — where it used to say nothing and leave
+  the option unavailable.
+- When your provider refused to link the instance for a reason another report cannot change — the
+  licence is already in use on as many instances as it allows, or your provider does not know it —
+  the managed option now says that, on the settings screen and on the install screen, instead of
+  "available after this instance's next report". The licence step keeps saying it when you come back
+  to it.
+- "Your own provider" is marked **In use** only once an endpoint's model and key are saved. A new
+  instance used to show it over an empty form.
+- An install that has been started can be resumed from a browser that is not signed in: the install
+  screen asks you to sign in, and the sign-in page now opens instead of sending you back.
+- The Kubernetes `02-config.yaml` no longer sets `WEB_ORIGIN` to the placeholder
+  `https://jarvis.example.com`; it is commented out. Applied unedited, it was stored as the
+  instance's address until the install screen replaced it.
+
+**Self-hosters:** api and console. The schema gains one column, the licence server's answer to the
+last report, applied automatically when the api starts; it only adds, so the schema guard has
+nothing to refuse. No new environment variable. An instance that is already installed reports
+exactly as before. On Kubernetes, nothing to do either: the install screen saved your real address
+over the placeholder when you installed.
+
+**Rolling back past this version** drops that column, which the schema guard refuses once a report
+has filled it, and the api does not start. To go back anyway, set `SCHEMA_ACCEPT_DATA_LOSS=true`
+for that one deploy — in `.env` on compose, on the `jarvis-migrate` Job on Kubernetes — then put
+it back. What is lost is only that last answer, which the next report writes again.
+
+## 2026-09-25 — The model is chosen in one place, and the form you are not using is out of the way `web 0.137.1`
+
+Under **Settings → Platform → Model**, the choice between your own provider and the managed model is
+now made with the selector and nothing else. The separate "Use your own provider" button is gone:
+picking that option in the selector does the same thing, and still asks first when your own provider
+is not configured, because switching would then leave the assistant with no model.
+
+Your own provider's form now appears only while the selector is on it. While the managed model is in
+use — or has been picked and is waiting for you to confirm — the form is hidden rather than shown with
+a note saying it is not in use. Its settings, key included, are kept exactly as they were, and come
+back with the form when you switch back.
+
 ## 2026-09-24 — A licensed instance can choose a managed model, and this is exactly what it sends `api 0.112.0` `web 0.137.0`
 
 **No conversation content leaves unless somebody chooses it.** The assistant keeps using your own

README.md

@@ -195,8 +195,9 @@ to how the containers are scheduled.
 - A hostname and a TLS terminator in front of it. Jarvis speaks plain HTTP and does not manage
   certificates.
 - An API key for an OpenAI-compatible endpoint — or a paid or trial licence that includes the
-  [managed model](#if-you-choose-the-managed-model), which you choose after installing. The install
-  screen asks for the key and tests it before saving; you do not need it in hand before you start.
+  [managed model](#if-you-choose-the-managed-model), which the install screen offers once the licence
+  is in. The install screen asks for either, and tests a key before saving it; you do not need
+  either in hand before you start.
 - **No licence key.** Jarvis runs the [community edition](#the-community-edition) out of the box; a
   key raises the limits when you outgrow them.
 - Roughly 2 GB of RAM for the stack and room for Postgres to grow.
@@ -212,13 +213,23 @@ That is the whole first deployment. **There is no `.env` step.** First boot gene
 secrets, syncs the database schema and runs its data backfills before the API listens, so give it
 about a minute. Then point your reverse proxy at port 8080 and open the address in a browser.
 
-An install screen takes it from there. It welcomes you, creates the first administrator inside a
-bounded window, then asks for the address this instance answers on and who may create an account on
-it, the model, your first organization, and — every one of them skippable — mail, a licence and
-whether this instance reports anything about itself. It finishes by showing you what the deployment
-actually looks like from inside, and by making you take a backup of the one value nothing can
-reconstruct. Ten screens, about five minutes, and **only the address really needs you**: everything
-else has a "later" that costs nothing.
+An install screen takes it from there. It welcomes you, creates the first administrator, then asks
+for the address this instance answers on and who may create an account on it, a licence, the model,
+your first organization and mail — the licence, the model and mail all skippable. It finishes by
+showing you what the deployment actually looks like from inside, and by making you take a backup of
+the one value nothing can reconstruct. Nine steps, about five minutes, and **only the address really
+needs you**: everything else has a "later" that costs nothing.
+
+**The licence comes before the model, and with a paid or trial key it sends something.** Adding the
+key on the install screen's licence step makes this instance send its licence report to your Jarvis
+provider straight away, rather than once the install is finished — and so does opening that step
+with a key the instance already holds from `JARVIS_LICENSE_KEY`. That report is what links the
+instance to its licence, and the [managed model](#if-you-choose-the-managed-model) is only offered
+to a linked instance. So the model step can offer it beside your own endpoint, with the same
+statement of what it sends as the settings screen, and a licensed install can be finished without a
+model key of your own. What the report carries is
+[listed field by field below](#licence-keys-and-what-your-instance-reports). Without a key, nothing
+leaves until the install is finished.
 
 Everything it asks is a setting you can change afterwards from an ordinary screen. Nothing it asks
 needs a container restart to change.
@@ -735,6 +746,18 @@ key; a community one to `checkin.luxit.be`, compiled into the build. The interva
 to set — every ten minutes on the current arrangement, so that a renewal or a revocation reaches you
 promptly rather than tomorrow.
 
+**An instance that is still being installed reports nothing — until a licence is adopted and its
+address is set, and then only from the install screen's licence step.** A community instance sends
+its first report once the install screen is finished. A licensed one sends it from the licence
+step, which comes after the step that sets the address: the moment the key is added there, or, for
+a key that came from `JARVIS_LICENSE_KEY`, when that step opens. Nothing reports on its own before
+the install is finished, so a stack that brings both its key and its address in the environment
+still sends nothing until somebody reaches that step. That early report is the same report, with the
+same fields — it goes early because it is what links the instance to its licence, which the managed
+model needs. An address that is still `localhost` or another loopback address does not count as
+set, and neither does an example one such as `jarvis.example.com`: that instance sends nothing from
+the licence step.
+
 This is everything the licence report and a licence request send, in full. The managed model, if you
 choose it, sends conversation content — see
 [If you choose the managed model](#if-you-choose-the-managed-model).
@@ -784,9 +807,11 @@ checked without a network.
 **Off unless a platform administrator turns it on, and only on a paid or trial licence.** Your
 Jarvis provider can run a model for licensed instances, so that the assistant works without an
 endpoint or a key of your own. A platform administrator chooses it under **Settings → Platform →
-Model**, on a screen that states everything below and asks them to confirm they have read it.
-Nothing else selects it: no environment variable, no licence, no answer from the licence server. A
-community instance cannot use it; its assistant runs on your own provider, as it always has.
+Model**, or on the model step of the install screen, which shows the same choice once the licence
+step before it has linked the instance to its licence. Either way it is chosen on a screen that
+states everything below and asks them to confirm they have read it. Nothing else selects it: no
+environment variable, no licence, no answer from the licence server. A community instance cannot use
+it; its assistant runs on your own provider, as it always has.
 
 **While it is chosen, conversation content goes to your Jarvis provider instead of the endpoint you
 configured.** Every request the assistant then makes to the model carries:
@@ -805,9 +830,10 @@ exactly as its licence report is, which carries the product (`jarvis`), the lice
 id and public key, and the version — nothing else — and it keeps the credential in memory only.
 
 **Opening the screen already asks.** On a licensed instance, opening **Settings → Platform → Model**
-sends that signed request, so the screen can say whether the managed model is offered to you and
-which model it is — whether or not anybody then chooses it. It carries the fields above and no
-conversation content, and your Jarvis provider sees that this instance asked.
+— or reaching the model step of the install screen — sends that signed request, so the screen can
+say whether the managed model is offered to you and which model it is, whether or not anybody then
+chooses it. It carries the fields above and no conversation content, and your Jarvis provider sees
+that this instance asked.
 
 **Where it goes.** Over HTTPS to the host your licence reports to — the address written into your
 licence key, `checkin.luxit.be` on current licences, which is where its licence report goes too. The

kubernetes/02-config.yaml

@@ -45,8 +45,12 @@ data:
   TRUST_PROXY_HOPS: "1"
 
   # The seed for the address enrolled agents dial back to. Whatever the install screen stores wins
-  # from then on, so this is a starting value rather than the answer.
-  WEB_ORIGIN: "https://jarvis.example.com"
+  # from then on, so this is a starting value rather than the answer — and it is COMMENTED OUT
+  # because a placeholder is a worse start than none. Seeded as it stood, `jarvis.example.com` was
+  # stored as this instance's address before anybody had opened the install screen, which asks for
+  # the address anyway, prefilled with the one your browser used. Uncomment it only with your real
+  # address.
+  # WEB_ORIGIN: "https://jarvis.example.com"
 
   # Where the agent binaries are, filled per pod by an initContainer. Leaving it unset is
   # supported: everything works except the agent installer, which answers 503 saying no build is