title: Docker Crestodian first-run onboarding

scenario:
  id: docker-crestodian-first-run
  surface: docker-podman-hosting
  category: docker-podman-hosting.container-setup
  coverage:
    primary:
      - docker.first-run-onboarding
    secondary:
      - raspberry-pi.first-run-verification
  objective: Verify a fresh package-installed Docker state routes through modern first-run onboarding and Crestodian setup without leaking secrets.
  successCriteria:
    - A bare invocation routes to onboarding and modern onboard routes to Crestodian.
    - Crestodian reports missing config, writes the default workspace/model, and creates the configured agent.
    - Discord setup is written through a SecretRef without persisting the raw token.
    - Config validation and expected Crestodian audit entries succeed.
  docsRefs:
    - docs/install/docker.md
    - docs/cli/crestodian.md
    - docs/help/testing.md
  codeRefs:
    - scripts/e2e/crestodian-first-run-docker.sh
    - test/e2e/qa-lab/runtime/crestodian-first-run-docker-client.ts
    - scripts/e2e/crestodian-first-run-spec.json
  execution:
    kind: script
    path: test/e2e/qa-lab/runtime/docker-e2e-lane.ts
    summary: Runs the existing Crestodian first-run Docker E2E lane and records primary Docker first-run onboarding evidence; the Raspberry Pi link is secondary because this is generic Linux/container first-run proof, not Pi hardware proof.
    args:
      - --lane
      - crestodian-first-run