onbehalf 0.1.0

This is the first version. It is for a proof of concept on one shared
host with Ubuntu or Arch.

Users and operators

• onbehalf user add and onbehalf user remove enroll and offboard a
  user: account, gateway key, shared stack and runtime.
• onbehalf user sync keeps the users the same as the members of an
  Entra group.
• A user can enroll at their first SSH login.
• Operators are separate from users. The runtime of an operator runs in a
  separate runtime account.
• onbehalf restart starts the runtime of a user again.

Shared stack and work tools

• onbehalf stack install makes a reviewed shared stack current for each
  user. It starts the runtimes again.
• The model catalog permits only the providers of the model gateway.
• onbehalf tools guides a user through the login of each work tool and
  each MCP connection. Operators can add work tools in the shared stack.

Checks

• onbehalf setup guides the first setup of the host and checks the
  access to the model gateway.
• onbehalf doctor checks the host and each user, and gives the fix for
  each problem.
• onbehalf status shows a user their setup, their logins and their
  model use. It also shows at each login.
• onbehalf report shows who uses the runtimes, how much, and which
  requests fail.
• onbehalf health sends an alert when a problem starts or stops.

Security

• Each user has a personal gateway key. A user cannot read the files,
  logins or sessions of a different user. The tests prove this.
• Account names use only lowercase ASCII letters, digits and the signs
  ., _, @ and -. A fuzzer checks the name rules.

Upgrade

There is no earlier version. To install, follow the
operator guide.