Connect your first agent runtime.

Create an enrollment

Sign in at console.null.select, select Connect your first agent runtime, and choose Create enrollment.

The console displays a secret beginning with nle_. Keep the page open—you will paste this secret into the CLI once, and it cannot be recovered later.

If the secret is copied to the wrong place or no longer needed, choose Revoke in Recent enrollments. Revocation is durable, survives a page refresh, and wins atomically against any concurrent exchange; create a fresh enrollment afterward.

Install the CLI

The installer detects your operating system and architecture, downloads the latest GitHub release, verifies its SHA-256 checksum, and installs without sudo to $HOME/.local/bin/null.

curl -fsSL https://raw.githubusercontent.com/null-select/null/main/install.sh | sh

Prefer to inspect before running? Download install.sh, review it, then run sh install.sh. Pin this guide's release with NULL_VERSION=v0.2.0.

Connect the runtime

Copy the exact command from your console. The current deterministic pilot uses the following declared runtime identity and admitted fixture capability:

$HOME/.local/bin/null connect \
  --server https://console.null.select/connect \
  --provider declared \
  --model deterministic-client-a \
  --capability-digest ad39823476e3a8a6db81f61364d4f25159a2f99c3be280b4507dff2bf140ee37

At Enrollment token:, paste the nle_… secret and press Return. Input is hidden. The CLI exchanges it once, saves the resulting execution-bound credential with owner-only permissions, asks for the epoch-1 lease, and renews that exact lease while the process remains active.

Keep this terminal open for the runtime session. Ctrl-C stops heartbeats and lets the last confirmed lease expire. Use --once only when you intentionally want a diagnostic bind without renewal.

Verify the result

A successful connection looks like this:

Connected to null.select
Execution: exec_…
Runtime: runtime_…
Model: declared/deterministic-client-a
Fencing epoch: 1
Lease expires: …
Credential: …/null-select/client.json
Lease heartbeat active. Keep this process running; press Ctrl-C to disconnect.

Inspect persisted authority

From another terminal, ask the control plane whether this exact runtime and fencing epoch still hold effect authority:

$HOME/.local/bin/null status
$HOME/.local/bin/null doctor

null status distinguishes active, frozen, fenced, and expired authority and shows whether unresolved consequential work blocks continuation. null doctor checks the private credential file, gateway authentication, runtime binding, fencing epoch, lease, and recovery hold. Neither command prints credentials or accepts tenant scope.

Available now: status and doctor ship in CLI v0.2.0 and are supported by the live gateway.

Test the protected-effect engine

Open Console → Integrations and select Install write App, then Install read-only App. Choose the same GitHub account and repository selection for both. The console verifies the App identity, exact permission, your access, and the matching repository scope; you never copy an installation ID, build an enrollment binary, or manage an App private key.

The first customer-shaped adapter adds one label to one GitHub pull request. Its deterministic Docker case runs PostgreSQL 18, the control API, gateway, separate write executor, separate read-only verifier, and a GitHub-compatible target:

make github-integration

The test kills the executor after the target responds but before outcome storage, marks the attempt uncertain, blocks takeover, reconciles the label as present, promotes a different declared model, rejects the stale runtime, and proves the destination saw one request and one mutation.

With a GitHub-capable runtime connected, dispatch the protected action with one stable customer key:

$HOME/.local/bin/null github label \
  --owner YOUR_ORG \
  --repo YOUR_REPO \
  --pr 123 \
  --label continuity-verified \
  --idempotency-key your-stable-request-key

Then run the same command with github observe in place of github label to ask the separate read-only verifier whether the label is present. If dispatch returns an uncertain or transport result, do not choose a new idempotency key: repeat with the original key or observe it until authoritative evidence resolves the effect.

Available now: CLI v0.2.0, the console installation flow, and both live adapter services have completed a real private-repository pilot. The Docker conformance case remains credential-free and makes no paid model call.