New Fleet wizard: replace Template/Overlay compose with Vendor + chat platform + ACP flow

[brettchien]

Context

Follow-up to #119. Brett's direction (2026-08-29, this thread): drop the "pick a Template/Overlay from a compose library" model for the New Fleet wizard's Step 2 entirely — it ships empty on every fresh install (no default template, by design — see #119's investigation) and doesn't match how people actually think about spinning up an agent. Replace with a flow modeled on openab create's CLI wizard, generalized.

Scope (confirmed with Brett)

1. Vendor select: Claude, codex, agy, cursor. Claude→claude-code/codex are already deployable via the existing ECR BACKENDS path (oabctl create's convention); cursor/agy have real CI-built images but only on GHCR (ghcr.io/openabdev/openab:<tag>-<variant>), not ECR — Studio will resolve images via GHCR directly for all 4 (Orca's own deployment already proves ECS Fargate can pull GHCR images with no extra infra).
2. Vendor auth v1: optional API key text field (stored as a secret), + an inline note for device-auth vendors (codex/kiro-style login --device-auth) pointing at doing it after the agent is up — no generic auth-flow abstraction exists to build on yet (researched: OAuthVendor in openab-mcp is a different axis — LLM subscription auth, not this).
3. Chat platform select: Discord / LINE / Telegram / none — openab-core already has full config schema + adapters for all three (mature, no new platform code needed), Studio just needs to write the right config.toml section + store the token(s) as secrets.
4. ACP checkbox: default checked, wired to feat(oabctl,studio-cp): enable ACP by default on Studio-deployed agents #127's Spec.acp_enabled. Forced off/disabled when vendor=agy — agy's agy-acp bridge is architecturally separate from openab-gateway's /acp route entirely, confirmed via code read.
5. Build config.toml + a Bundle{image_tag, files} directly in the wizard, bypassing compose_named/the template library (confirmed not a hard dependency of provision_manifest/provision_k8s).
6. Remove the old Template/Overlay compose editor UI entirely (Brett: not keeping it for advanced users).

Not yet resolved

• Exact GHCR tag scheme to pin per vendor (channel/version selection) — TBD during implementation, will default to something sane and flag in the PR.
• EKS-style vendor auth (device-flow-in-wizard) is out of scope — same v1 simplification as feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2 above.

🤖 Filed by Orca, continuing the #119 thread's direction.

[brettchien]

Final wireframe (confirmed with Brett, 2026-08-29)

┌────────────────────────────────────────────┐
│ New fleet — fleet identity                  │
├────────────────────────────────────────────┤
│ Step 2 — first instance                     │
│                                              │
│ Vendor                                      │
│ [ Claude               ▾ ]                  │
│ ☐ Beta channel                               │
│  → ghcr.io/openabdev/openab:stable-claude    │
│                                              │
│ API key (optional)                          │
│ [                                    ]      │
│  ⓘ device-auth vendor (codex/kiro): finish  │
│    login after the agent is up              │
│                                              │
│ Chat platform (optional)                     │
│ [ — none — (use ACP directly)      ▾ ]      │
│  (Bot token field(s) appear only if a       │
│   platform is selected)                      │
│                                              │
│ ☑ Enable ACP                                │
│  (forced off + disabled when vendor = agy)   │
│                                              │
│ Agent name                                   │
│ [ Hermes                    ] [🔀 shuffle]   │
│  (pre-filled with a random Greek god name,   │
│   editable)                                  │
│                                              │
│  [ Deploy ]   ready to deploy                │
└────────────────────────────────────────────┘

Confirmed decisions this round

1. Vendor list: Claude, codex, agy, cursor, kiro — all resolve to ghcr.io/openabdev/openab:<channel>-<vendor> images (verify exact tag scheme against pre-beta-build.yml/build-images.yml before hardcoding — don't guess).
2. Chat platform is optional and defaults to none — ACP (Studio's own chat panel) is the primary connection path; Discord/LINE/Telegram are additive, not required.
3. No manual Image tag field — replaced by a Vendor select + a "Beta channel" checkbox (default unchecked = stable); the resolved image is computed and shown read-only.
4. Agent name pre-fills with a random Greek god name (shuffle button to re-roll), still editable.
5. No Preview bundle step — Vendor/API-key/chat-platform/ACP/name filled in → Deploy directly, no separate "compose" step like the old Template/Overlay flow had.

Template/Overlay compose editor removal (item 6 from the original scope) unchanged — still going away entirely.

🤖 Orca

[brettchien]

Additional confirmed decisions (2026-08-29, continued)

GHCR image tag resolution (for the Vendor's Image tag field):

• No literal stable/beta tags exist on GHCR — verified both build workflows (pre-beta-build.yml pushes rolling pre-beta-<vendor>; build-images.yml is workflow_dispatch-only with a manual tag input, not tied to git tags/releases).
• Repo release tags (openab-X.Y.Z) don't reliably correspond to a published per-vendor image either — cutting a release and running build-images.yml are disconnected steps.
• Algorithm: (1) fetch openab repo's release tags, filter to non-beta, sort newest-first; (2) for each candidate, check GHCR's actual package versions for <version>-<vendor> — first one that exists wins → labeled "Stable" in the UI; (3) "Beta" always resolves to pre-beta-<vendor> (rolling, no need to verify — the hourly workflow guarantees it exists for any of the 5 vendors).
• UI shows friendly "Stable"/"Beta" labels; underlying tag scheme (pre-beta-* etc.) never surfaces to the user.

Local config folder (new, separate from the S3-based deploy path):

• New Studio setting: a user-picked local folder ("Config folder"), replacing/supplementing the current hidden OS app-config-dir default.
• Layout: <folder>/<agent-name>/config.toml, one file per agent.
• The New Fleet wizard's server-side generate_agent_config() output gets written here too (in addition to, not instead of, the existing S3 upload — the S3 path that provision_agent/provision_agent_k8s already do is unchanged).
• The "view any agent's config.toml in Studio" feature (confirmed: build this now, not backlog) reads from this local folder only — Brett: "forget about S3 now" for this feature. If an admin agent (or anything else) writes into the same folder, Studio picks it up on next refresh — no S3 round-trip needed for viewing.

Updated scope tally (all confirmed, none built yet except PR #129's backend slice)

1. Vendor select (Claude/codex/agy/cursor/kiro) + GHCR-verified Stable/Beta image tag resolution
2. Optional API key field (captured, not yet consumed — flagged gap)
3. Chat platform select (Discord/LINE/Telegram/none, AWS-only per feat(studio-cp,oab-mcp,src-tauri): add deploy_provision_agent (studio#128) #129's k8s refusal)
4. ACP checkbox (wired to feat(oabctl,studio-cp): enable ACP by default on Studio-deployed agents #127, forced off for agy)
5. Agent name pre-filled with a random Greek god name + shuffle
6. Remove old Template/Overlay compose editor entirely
7. Local "Config folder" setting + per-agent local config.toml mirroring
8. "View this agent's config.toml" screen, reading from the local folder

🤖 Orca — consolidating before driving the rest via usercron, same pattern as #119.