# wendy-device-enrollment

Walks your agent through first-touch enrollment of WendyOS devices in pki-core and the certificate lifecycle that follows.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 62
- Author: wendylabsinc
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-device-enrollment/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/wendy-device-enrollment

## What it does

This skill is a reference the agent consults when a WendyOS device has to join pki-core. Three files ship with it: device tiers, first touch, and trusted time. Two first-boot paths are covered. With a network, the operator asks for a token while installing the OS, the cloud forwards the signed request to pki-core, and a single-use token bound to that device and tenant comes back. Airgapped, the machine links to the operator's computer, generates a CSR, and the operator carries a signed request to the cloud for a grant.

The keypair is created on the device itself and the private half stays there. A platform root travels inside the OS image, so the delivered chain gets checked against what was already flashed instead of being trusted on sight. Renewal runs unattended over ACME/EST, yet it only works while the current certificate is valid; an expired one needs a standing proof, such as re-attestation or an operator grant. When trusted time cannot be established, the device holds its state rather than guessing.

Any interop change must leave the self-hosted path intact, and the skill points to wendy-self-hosted for that. It distills AAA Contract v0.21; where the contract and the skill disagree, the contract is the one to follow. Have the hardware on your desk and pki-core reachable before you start.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/wendy-device-enrollment/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wendy-device-enrollment/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/wendy-device-enrollment/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/wendy-device-enrollment/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install wendylabsinc/claude-skills wendy-device-enrollment
```

2. **Manually: put the files in place**
- File: `.github/skills/wendy-device-enrollment/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-device-enrollment
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wendy-device-enrollment/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-device-enrollment/SKILL.md

## When to use it
- enroll a WendyOS device online at first boot
- run enrollment in an airgapped network via CSR
- work out device tiers and TPM, OP-TEE or eFuse attestation
- recover a device whose certificate has expired
- keep renewals automatic over ACME/EST

## Example prompts
- Explain how to enroll a WendyOS device with pki-core over the network
- The device has no internet — how do I get the CSR and the operator grant?
- The cert expired; walk me through re-enrollment

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [wendylabsinc/claude-skills](https://affpapa.org/en/nevibecode/by/wendylabsinc/claude-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md