Deploy deal-onboarding and test the fleet runner connection

[bradflaugher]

@KristianYe — please deploy the new public deal-onboarding repo and test it against fleet so we know the runner seam actually connects and works end to end.

Repo

https://github.com/ElcanoTek/deal-onboarding

Deal Onboarding is a self-hosted deal desk: intake a brief, audit the package, then hand the audited batch to a fleet task runner. The runner agent is supposed to create the deals across Index Exchange, OpenX, PubMatic, Magnite, Xandr, Media.net, and TripleLift and email the deal sheet.

The only outbound seam is POST /api/runner/create — prompt + structured brief + list files to fleet. Nothing else should leave the box.

What to do

1. Deploy deal-onboarding (single-host bootstrap is fine):

   sudo dnf install -y git
   sudo git clone https://github.com/ElcanoTek/deal-onboarding.git /opt/deal-onboarding-src
   sudo bash /opt/deal-onboarding-src/scripts/bootstrap.sh

   Then provision a user, set env, and confirm the service is up:

   deal-onboarding user add you@example.com
   deal-onboarding env edit        # RUNNER_BASE_URL / RUNNER_API_KEY, OPENROUTER_API_KEY
   deal-onboarding env check
   deal-onboarding restart
   deal-onboarding logs

2. Wire it to fleet (this is the actual test):

   • In fleet, create a scoped create_task key for this app (it also authorizes uploads). Do not hand the app an admin key.
   • Confirm the fleet bundle catalogs the MCP servers the prompts route to: indexexchange_mcp, openx_mcp, pubmatic_mcp, magnite_mcp, xandr_mcp, medianet_mcp, triplelift_mcp, deal_sheet, sendgrid, plus the persona named in RUNNER_PERSONA if we use one.
   • Set RUNNER_BASE_URL (bare origin, no path) and RUNNER_API_KEY on the deal-onboarding host and restart.
   • In the submit dialog, press Test connection. That should hit /api-info and confirm the key clears the create gate without creating a task.

3. Run a real submit against fleet (dev runner is fine). Confirm:

   • Connection test passes.
   • Submit creates a fleet task.
   • The task is visible in fleet and starts cleanly.
   • Prompt, brief, and list files land on the runner as expected.
   • Failures (bad key, fleet down, missing MCP) surface clearly in the deal-onboarding UI rather than hanging.

4. Contract check so a tool rename upstream fails CI here instead of a live batch:

   node scripts/check-fleet-contract.mjs /path/to/fleet [/path/to/bundle]

Acceptance

• deal-onboarding is deployed and reachable.
• Scoped fleet create_task key is in place (not an admin key).
• Test connection against fleet passes.
• A submit creates a fleet task with the expected prompt / brief / files.
• Broken-connection cases fail loudly and safely.
• Notes on anything that did not connect correctly, plus any fleet-side fixes needed.

Notes

Docs on the deal-onboarding side: Connecting a runner, docs/ARCHITECTURE.md.

P3 / XL — integration + deploy + live connection test, not a code change unless the seam is broken.