Epic: Starter ops/DevOps agents — one-click Trinity instance management onboarding

[vybe]

Summary

Make standing up and operating a Trinity instance a near-one-click experience. This epic is the instance-onboarding umbrella: it covers the full first-hour arc — provision an instance (pre-baked VM image / agent-guided one-shot install / cross-platform bootstrap), deploy a starter ops/DevOps agent to manage it (health, updates, logs, rollback, provisioning), and onboard the operator (5-minute quickstart + an agent-readable repo). It builds on the existing public ops agent (abilityai/trinity-ops-public) and the trinity plugin scaffolding in abilityai/abilities (/trinity:deploy-new-instance, /trinity:onboard), turning ad-hoc scaffolding into a first-class onboarding path.

Context

Trinity is sovereign, per-deployment infrastructure: every operator runs their own instance. The hardest part of adoption is the first hour — provisioning the box, connecting, deploying, and learning to operate the platform. We already proved the management model with the Claude Code ops agent (abilityai/trinity-ops-public) and the /trinity:deploy-new-instance skill. This epic widens that into the whole funnel so "get a running, managed Trinity" is a one-click starting point rather than a from-scratch build.

Scope confirmed with requester (2026-06-15): focus the starter set on the instance ops / DevOps archetype (not role agents, channel-demo chat agents, or a general gallery), in the public tracker for community contribution. Widened 2026-06-29 (/roadmap-plan): absorbed instance provisioning (#835 VM image) and the agent-readable onboarding repo (#1280); the agent-guided one-shot install (trinity-enterprise#39) is tracked as a cross-tracker sibling (sub-issue links can't cross repos).

Children (sub-issues)

Stand up an instance (provisioning):

• One-click VM image for Trinity deployment (GCP + Hetzner) #835 — One-click VM image for Trinity deployment (GCP + Hetzner)
• feat: Cross-platform bootstrap for the ops starter agent (Linux / macOS / cloud VM & Docker host) #1217 — Cross-platform bootstrap (Linux server / macOS / cloud VM & Docker host)
• (cross-tracker, by reference) trinity-enterprise#39 — One-line install + agent-guided one-shot install (discovery → running, configured)

Deploy an agent to manage it (ops/DevOps starter):

• feat: Package the ops/DevOps agent as a first-class one-click Trinity starter #1216 — Package the ops/DevOps agent as a first-class one-click starter

Onboard the operator:

• docs: \"Operate your Trinity in 5 minutes\" onboarding quickstart for the ops starter #1218 — "Operate your Trinity in 5 minutes" quickstart + sample ops prompts
• Prep repo + agent files for agent-readable zero-to-value onboarding #1280 — Agent-readable zero-to-value repo (agents self-orient from AGENTS.md)

Acceptance Criteria

• A new operator can provision an instance from a documented, near-one-click path (VM image and/or agent-guided install)
• A new operator can deploy a working instance-management agent from a documented, near-one-click flow
• The starter works across the common platforms operators run Trinity on (self-hosted Linux, macOS, cloud VM / Docker host)
• Onboarding docs let a first-time user go from zero to a running ops agent in ~5 minutes
• Starter agent capabilities cover the core ops loop: health checks, updates, log inspection, rollback, basic provisioning
• Reuses and consolidates the existing trinity-ops-public agent and /trinity:deploy-new-instance / /trinity:onboard scaffolding rather than duplicating them

Technical Notes

• Existing assets to build on (all public): abilityai/trinity-ops-public (the ops agent), abilityai/abilities → trinity plugin (/trinity:connect, /trinity:onboard, /trinity:deploy-new-instance, which already "scaffold a complete ops agent to manage it").
• Local starter templates live under config/agent-templates/; the platform already supports template-based agent creation (POST /api/agents with a template, including github:Org/repo).
• Decide whether the ops starter ships as a Trinity template (in config/agent-templates/), a pinned github: template repo, or both.
• Provisioning paths share scripts/deploy/start.sh as the canonical entrypoint (One-click VM image for Trinity deployment (GCP + Hetzner) #835 pre-positions it; trinity-enterprise#39 drives it agent-side). Keep them building on the same installer, not parallel ones.
• Keep agent-defined pipeline / heartbeat work owned by the agent (CLAUDE.md Rule security: implement safe tar extraction with symlink/hardlink validation #8) — Trinity provides the read surface, not an orchestrator.
• Related (distinct epic): Epic: First-run & self-host robustness — the OSS front door #1258 First-run & self-host robustness hardens this same front door (bug-resilience), where this epic adds new provisioning/onboarding paths.