# Jayberth — agent setup

This origin is Jayberth. It is a current-state workspace on a JayBase store. Aim a client at https://command-hostinger.tail3e5e03.ts.net:9443/llm.txt.

An agent connection is a live API/writer credential on the JayBase (a current writer token). It is not a linked Magpie, Martin, or Grok app. Opening this page does not create a connection.

Do not use MCP. Jayberth does not offer /mcp. A new inventory (or any other) tool should be a CLI on the same Jaybase store, not a new MCP endpoint.

## Connect

Jaybase is the source of truth. Magpie and other CLIs are optional tools on top of it.

```sh
export JAYBASE_URL='https://command-hostinger.tail3e5e03.ts.net:9444'
export JAYBASE_TOKEN='writer-token-for-this-store'
```

- JAYBASE_URL is an HTTPS origin only (no path, token, query, or fragment).
- JAYBASE_TOKEN lives only in the environment. Never put it in a flag, URL, payload, log, or prompt.
- This is the Jaybase writer/reader token (32-512 characters). It is not a Jayberth UI password, not an MCP bearer (MAGPIE_MCP_TOKEN), and not a workspace registry id.
- Workspace ids look like agt_… / ten_… / usr_… and are exactly 20 characters. Jaybase rejects anything under 32 characters with 401 valid bearer token required. If the value you were given is 20 characters, it is the wrong secret.
- Jayberth does not display this token on the standing Agents page. After you sign in, mint a reader or writer at https://command-hostinger.tail3e5e03.ts.net:9443/account/agents. Jayberth shows the plaintext once on that POST, then never again. This is not writer-initial from jaybase-server init, not a Jayberth password, and not an MCP bearer.
- Operators can still mint on the store host with add-token if the one-time reveal was lost:
```sh
jaybase-server add-token /path/to/secrets/auth.json agent-writer writer
```
Then export the printed token as JAYBASE_TOKEN. Recreate the Jaybase process so it reloads auth.json. Do not put the new token in this prompt.

Prove the store:

```sh
curl -fsS "$JAYBASE_URL/health/ready"
curl -fsS -H "Authorization: Bearer $JAYBASE_TOKEN" "$JAYBASE_URL/v1/root"
```

Ready must be Jaybase JSON ({"status":"ready"}). If you see the workspace UI ready JSON instead, you pointed JAYBASE_URL at the UI host. The UI is https://command-hostinger.tail3e5e03.ts.net:9443. The operator/bootstrap store is https://command-hostinger.tail3e5e03.ts.net:9444.

## Workspace stores

Each customer workspace is an isolated Jaybase. A token minted at https://command-hostinger.tail3e5e03.ts.net:9443/account/agents is valid only on that workspace origin. It returns 401 against the operator store above.

### future-perfect

```sh
export JAYBASE_URL='https://future-perfect.command-hostinger.tail3e5e03.ts.net:9444'
export JAYBASE_TOKEN='writer-token-minted-at-https://command-hostinger.tail3e5e03.ts.net:9443/account/agents'
```

```sh
curl -fsS "$JAYBASE_URL/health/ready"
curl -fsS -H "Authorization: Bearer $JAYBASE_TOKEN" "$JAYBASE_URL/v1/root"
```

- GET /health/ready is unauthenticated. Expect {"status":"ready"}.
- GET /v1/root requires Authorization: Bearer $JAYBASE_TOKEN (writer or reader minted for this store).
- On this Tailnet host, :9444 is SNI-routed. If TLS verify fails on a peer, fetch the host CA from https://command-hostinger.tail3e5e03.ts.net:9443/folio-jaybase-ca.crt and pass curl --cacert until Tailscale ACL nodeAttrs includes dns-subdomain-resolve and a wildcard cert is issued.


## Named records CLI

```sh
# named-records CLI on this Jaybase (binary name is historical)
folio --actor owner init
folio --actor owner table create --slug things --title Things --id-prefix thing --primary name
folio --actor owner record list --table things
```

Do not pass --store when JAYBASE_URL is set. --actor is a domain identity, not authentication.

Other apps (Magpie, Martin, a future inventory CLI) use the same env. Install only what you need.

## Humans

Sign in at https://command-hostinger.tail3e5e03.ts.net:9443/login. Source: https://command-hostinger.tail3e5e03.ts.net:9443/source.