feat(installer): first-run UX — interim slice of the v2 spec (copy, naming, location fix, clearer errors)

scripts/install-k8s.ps1

@@ -250,9 +250,6 @@ function Print-Banner {
   Write-Host "  " -NoNewline; Write-Host "tracebloc" -ForegroundColor Cyan -NoNewline; Write-Host " -- client setup"
   Write-Host "  " -NoNewline; Write-Host ([string]([char]0x2500) * 40) -ForegroundColor DarkGray
   Write-Host ""
-  Write-Host "  Test AI models from external vendors on your"
-  Write-Host "  infrastructure -- without exposing your data."
-  Write-Host ""
   Hint "This installer sets up a secure compute environment"
   Hint "on your machine and connects it to the tracebloc network."
   Write-Host ""
@@ -1107,7 +1104,7 @@ function Install-ClientHelm {
 
   PromptHeader "To connect this machine, you need a tracebloc client."
   Hint "A client links your secure environment to the tracebloc"
-  Hint "platform so vendors can submit models for evaluation."
+  Hint "platform so other collaborators can submit models for evaluation."
   Write-Host ""
   Hint "Create one here (free):"
   Write-Host "    " -NoNewline; Write-Host "https://ai.tracebloc.io/clients" -ForegroundColor White
@@ -1367,14 +1364,14 @@ function Print-Summary {
       Write-Host "  Your client is live. Confirm it shows as Online:"
       Write-Host "    https://ai.tracebloc.io/clients" -ForegroundColor Cyan
       Write-Host ""
-      Hint "Models that vendors submit train on this machine -- your data never leaves it."
+      Hint "Models other collaborators submit train on this machine -- your data never leaves it."
       Write-Host ""
       Hint "After a reboot, start Docker Desktop to bring your client back (enable 'Start Docker Desktop when you sign in' in Settings -> General to automate)."
       Write-Host ""
       Write-Host "  What to do next" -ForegroundColor White
       Write-Host "  1. Ingest your training and test data with the tracebloc CLI:"
-      Write-Host "       tracebloc dataset push ./data" -ForegroundColor Cyan
-      Write-Host "  2. Define your first AI use case and invite vendors"
+      Write-Host "       tracebloc data ingest ./data" -ForegroundColor Cyan
+      Write-Host "  2. Create your use case and invite other collaborators: https://ai.tracebloc.io/my-use-cases"
       Write-Host ""
       Hint "Dashboard: https://ai.tracebloc.io   Logs: ~\.tracebloc\   Data: /tracebloc/$ns"
       Write-Host ""
@@ -1710,7 +1707,7 @@ function Invoke-DiagnoseBundle {
 # Installs the `tracebloc` CLI via its own released installer (tracebloc/cli),
 # which downloads the right build for this OS/arch and verifies it (SHA256 +
 # cosign signature). Lets the user push datasets to the client they just set
-# up:  tracebloc dataset push ./data
+# up:  tracebloc data ingest ./data
 #
 # NON-FATAL: runs after the client is connected, so a CLI-install hiccup warns
 # and moves on. The CLI's own installer sets $ErrorActionPreference='Stop' and
@@ -1742,7 +1739,7 @@ function Test-TraceblocCli {
 
   if (Has "tracebloc") {
     # `tracebloc version` is the real proof; cosmetic, never fatal. The canonical
-    # "tracebloc dataset push ./data" next step lives in Print-Summary's "What to
+    # "tracebloc data ingest ./data" next step lives in Print-Summary's "What to
     # do next" — don't duplicate it; just confirm the verdict.
     $ver = ""
     try { $ver = (& tracebloc version 2>$null | Select-Object -First 1) } catch { $ver = "" }
@@ -1756,7 +1753,7 @@ function Test-TraceblocCli {
   # it is and how to use it now (so the summary's command works from a new window).
   Ok "tracebloc CLI installed -- open a new PowerShell window to use it."
   Hint "  Installed to: $TRACEBLOC_CLI_INSTALL_DIR"
-  Hint "  Or use it now via:  & `"$TRACEBLOC_CLI_INSTALL_DIR\tracebloc.exe`" dataset push .\data"
+  Hint "  Or use it now via:  & `"$TRACEBLOC_CLI_INSTALL_DIR\tracebloc.exe`" data ingest .\data"
 }
 
 function Install-TraceblocCli {
@@ -1765,7 +1762,7 @@ function Install-TraceblocCli {
   if (Has "tracebloc") {
     Info "tracebloc CLI already present -- re-running its installer to pick up the latest."
   }
-  Info "Installing the tracebloc CLI (dataset push / cluster info / dataset rm)..."
+  Info "Installing the tracebloc CLI (data ingest / cluster info / data delete)..."
 
   # [System.IO.Path]::GetTempPath() is cross-platform (%TEMP% on Windows, /tmp
   # on Linux); $env:TEMP is null under Linux pwsh, which the ubuntu Pester run

scripts/install.sh

@@ -107,7 +107,7 @@ if [[ "${USING_BRANCH:-0}" == "1" || ! "$REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][A
   else
     echo "[ERROR] '$REF' is not an immutable release tag (expected vX.Y.Z)." >&2
     echo "        The bootstrap only trusts content-addressable release tags so a moved" >&2
-    echo "        branch ref can't change what runs as root on your box (RFC-0001 R8)." >&2
+    echo "        branch ref can't change what runs as root on your box." >&2
     echo "        Use a release tag, or for local dev set TRACEBLOC_ALLOW_UNVERIFIED=1." >&2
     exit 1
   fi
@@ -121,7 +121,7 @@ fi
 case "$REF" in
   */*|*..*)
     echo "[ERROR] Ref '$REF' contains a path separator or '..' — refusing to build a" >&2
-    echo "        fetch URL from it (path-traversal guard, RFC-0001 R8)." >&2
+    echo "        fetch URL from it (path-traversal guard)." >&2
     exit 1 ;;
 esac
 
@@ -135,7 +135,7 @@ REPO_REL="https://github.com/tracebloc/client/releases/download/${REF}"
 TMPDIR="$(mktemp -d)"
 trap 'rm -rf "$TMPDIR"' EXIT
 
-echo "Downloading Tracebloc client installer (ref: $REF)..."
+echo "tracebloc client installer · $REF"
 
 mkdir -p "$TMPDIR/lib"
 
@@ -203,6 +203,9 @@ _sha256_of() {
 verify_against_manifest() {
   local manifest="$TMPDIR/manifest.sha256"
 
+  echo ""
+  echo "Verifying the installer is authentic before anything runs…"
+
   if ! _sha256_of "$TMPDIR/install-k8s.sh" >/dev/null 2>&1; then
     echo "[ERROR] No sha256 tool (sha256sum / shasum) on PATH — can't verify the" >&2
     echo "        installer's integrity. Install coreutils (Linux) or ensure" >&2
@@ -216,7 +219,7 @@ verify_against_manifest() {
       return 0
     fi
     echo "[ERROR] Couldn't fetch manifest.sha256 for ref '$REF' — refusing to run" >&2
-    echo "        unverified installer scripts (RFC-0001 R8). If this ref pre-dates" >&2
+    echo "        unverified installer scripts. If this ref pre-dates" >&2
     echo "        signed manifests, pin a newer release tag." >&2
     exit 1
   fi
@@ -232,7 +235,7 @@ verify_against_manifest() {
     # many spaces the sha tool emits); take its first field as the digest.
     expected="$(awk -v p="$rel" '$NF == p {print $1; exit}' "$manifest")"
     if [[ -z "$expected" ]]; then
-      echo "[ERROR] $rel has no entry in manifest.sha256 — refusing to run it (RFC-0001 R8)." >&2
+      echo "[ERROR] $rel has no entry in manifest.sha256 — refusing to run it." >&2
       exit 1
     fi
     actual="$(_sha256_of "$TMPDIR/${f#scripts/}")"
@@ -241,11 +244,11 @@ verify_against_manifest() {
       echo "          expected: $expected" >&2
       echo "          actual:   $actual" >&2
       echo "        Someone may have tampered with the installer. Aborting before any" >&2
-      echo "        privileged step runs (RFC-0001 R8)." >&2
+      echo "        privileged step runs." >&2
       exit 1
     fi
   done
-  echo "  ✓ all installer scripts verified against the signed manifest"
+  echo "  ✔ All ${#FILES[@]} installer files verified — none were altered"
 }
 
 download_manifest() {
@@ -281,7 +284,7 @@ verify_manifest_signature() {
     fi
     echo "[ERROR] cosign is required to verify the installer's signed manifest and" >&2
     echo "        couldn't be found or bootstrapped. Refusing to fall back to an" >&2
-    echo "        unauthenticated, same-channel checksum (RFC-0001 R8)." >&2
+    echo "        unauthenticated, same-channel checksum." >&2
     echo "        Fix: install cosign (https://docs.sigstore.dev/cosign/installation/)" >&2
     echo "        and re-run, or for local development only set TRACEBLOC_ALLOW_UNVERIFIED=1." >&2
     exit 1
@@ -294,7 +297,7 @@ verify_manifest_signature() {
       return 0
     fi
     echo "[ERROR] manifest.sha256.sig / .cert not published for release '$REF' — can't" >&2
-    echo "        authenticate the manifest. Pin a release tag that ships them (RFC-0001 R8)." >&2
+    echo "        authenticate the manifest. Pin a release tag that ships them." >&2
     exit 1
   fi
 
@@ -305,10 +308,10 @@ verify_manifest_signature() {
         --certificate "$cert" \
         --signature "$sig" \
         "$manifest" >/dev/null 2>&1; then
-    echo "  ✓ manifest signature verified (cosign keyless)"
+    echo "  ✔ Signature verified — published by tracebloc (Sigstore keyless)"
   else
     echo "[ERROR] cosign signature verification FAILED for manifest.sha256 — refusing" >&2
-    echo "        to install (RFC-0001 R8)." >&2
+    echo "        to install." >&2
     exit 1
   fi
 }
@@ -342,7 +345,7 @@ ensure_cosign() {
   local bin="$TMPDIR/cosign"
   local sums="$TMPDIR/cosign_checksums.txt"
 
-  echo "  cosign not found — bootstrapping pinned ${COSIGN_VERSION} to verify the manifest…"
+  echo "  · Fetching the signature-verification tool (cosign)…"
   curl -fsSL --tlsv1.2 "$base/$asset"               -o "$bin"  2>/dev/null || return 1
   curl -fsSL --tlsv1.2 "$base/cosign_checksums.txt" -o "$sums" 2>/dev/null || return 1
 
@@ -363,5 +366,4 @@ verify_against_manifest
 
 chmod +x "$TMPDIR/install-k8s.sh"
 
-echo "Running Tracebloc environment setup..."
 bash "$TMPDIR/install-k8s.sh" "$@"

scripts/lib/common.sh

@@ -140,7 +140,7 @@ preflight_sudo() {
     return 0
   fi
   echo ""
-  prompt_header "Tracebloc needs administrator permissions to install"
+  prompt_header "tracebloc needs administrator access to install"
   hint "Docker and system dependencies."
   echo ""
   hint "You may be asked for your password once."
@@ -353,15 +353,9 @@ print_banner() {
   echo -e "  ${BOLD}${CYAN}tracebloc${RESET} — client setup"
   echo -e "  ${DIM}────────────────────────────────────────${RESET}"
   echo ""
-  echo -e "  Test AI models from external vendors on your"
-  echo -e "  infrastructure — without exposing your data."
-  echo ""
   echo -e "  ${DIM}This installer sets up a secure compute environment${RESET}"
   echo -e "  ${DIM}on your machine and connects it to the tracebloc network.${RESET}"
-  echo ""
-  echo -e "  ${DIM}Nothing will be modified outside:${RESET}"
-  echo -e "  ${DIM}  ~/.tracebloc/    (data and config)${RESET}"
-  echo -e "  ${DIM}  Docker           (container runtime)${RESET}"
+  echo -e "  ${DIM}All data and config stay in ~/.tracebloc/.${RESET}"
   echo ""
   log "OS=$OS  Arch=$ARCH  Cluster='$CLUSTER_NAME'  Servers=$SERVERS  Agents=$AGENTS"
   log "Host data dir: $HOST_DATA_DIR → /tracebloc (inside k3s nodes)"

scripts/lib/detect-gpu.sh

@@ -9,17 +9,10 @@ detect_gpu() {
   if [[ "$OS" == "Darwin" ]]; then
     if [[ "$ARCH" == "arm64" ]]; then
       GPU_VENDOR="apple_silicon"
-      echo ""
-      warn "Apple Silicon detected."
-      info "GPU acceleration is not yet available on macOS."
-      info "Your environment will run in CPU mode."
-      echo ""
-      hint "For GPU-accelerated model training,"
-      hint "deploy tracebloc on a Linux machine with NVIDIA GPUs."
-    else
-      warn "Intel Mac detected."
-      info "Your environment will run in CPU mode."
     fi
+    echo ""
+    warn "GPU training isn't supported on macOS yet — this machine will run in CPU mode."
+    hint "For GPU-accelerated training, deploy on a Linux machine with NVIDIA GPUs."
     return
   fi
 

scripts/lib/install-cli.sh

@@ -5,7 +5,7 @@
 #  Installs the `tracebloc` command-line tool so the user can push datasets to
 #  the client they just set up:
 #
-#      tracebloc dataset push ./data
+#      tracebloc data ingest ./data
 #
 #  It does NOT reimplement any install logic — it runs the CLI's own released
 #  installer (github.com/tracebloc/cli), which downloads the right build for
@@ -94,7 +94,7 @@ _verify_tracebloc_cli() {
     # too; otherwise be honest and say how to use it now.
     # `tracebloc version` is the real proof; keep it cosmetic (never let a failing
     # version call or a SIGPIPE flip the outcome). The canonical "tracebloc
-    # dataset push ./data" next step lives in the summary's "What to do next".
+    # data ingest ./data" next step lives in the summary's "What to do next".
     local ver; ver="$(tracebloc version 2>/dev/null | head -1 || true)"
     if has tracebloc; then
       # Usable right now AND in new terminals — the fully-clean verdict.
@@ -113,7 +113,7 @@ _verify_tracebloc_cli() {
       local rc; rc="$(_cli_rc_for_shell || true)"
       hint "This shell won't see it yet — open a new terminal, or load it now:  source ${rc}"
     fi
-    info "Then the 'tracebloc dataset push ./data' step below will work."
+    info "Then the 'tracebloc data ingest ./data' step below will work."
     return 0
   fi
 
@@ -137,7 +137,7 @@ _verify_tracebloc_cli() {
     hint "  echo '${export_line}' >> ${rc}"
     hint "  source ${rc}"
   fi
-  info "Then the 'tracebloc dataset push ./data' step below will work."
+  info "Then the 'tracebloc data ingest ./data' step below will work."
   return 0
 }
 
@@ -153,7 +153,7 @@ install_tracebloc_cli() {
     info "tracebloc CLI already present${ver:+ ($ver)} — re-running its installer to pick up the latest."
   fi
 
-  info "Installing the tracebloc CLI (dataset push / cluster info / dataset rm)…"
+  info "Installing the tracebloc CLI (data ingest / cluster info / data delete)…"
 
   local installer
   installer="$(mktemp)" || { warn "Couldn't install the tracebloc CLI (no temp dir) — your client is set up fine."; return 0; }

scripts/lib/install-client-helm.sh

@@ -387,7 +387,7 @@ install_client_helm() {
 
   prompt_header "Connect this machine to a tracebloc client."
   hint "A client links your secure environment to the tracebloc"
-  hint "platform so vendors can submit models for evaluation."
+  hint "platform so other collaborators can submit models for evaluation."
   echo ""
   hint "Already have one? Enter its credentials below — or set"
   hint "TRACEBLOC_CLIENT_ID / TRACEBLOC_CLIENT_PASSWORD to skip this prompt."