# LEMCSSH field guide

## Register for the demo

No beta request is required. Register for the public demo at demo.letemcook.dev with stock OpenSSH, use LEMCSSH to run one reviewed Tool, and request beta access after the demo only if your team wants LEMC installed on its own infrastructure.

> [!IMPORTANT] Do not guess a host key or accept a changed fingerprint. Verify it out of band before the first connection.

## Register for demo.letemcook.dev with SSH

Generate a distinct key, keep the private file local at mode 0600, and register only its public half through the LEMCSSH registration screen.

ssh-keygen -t ed25519 -a 64 -f ~/.ssh/lemc-demo
chmod 600 ~/.ssh/lemc-demo

# Verify the host-key fingerprint out of band.
# Register only ~/.ssh/lemc-demo.pub.

ssh -t -p 2222 \
  -i ~/.ssh/lemc-demo \
  -o IdentitiesOnly=yes \
  demo.letemcook.dev

LEMCSSH registration → Create demo account

The registration screen cannot run jobs, read product data, open a shell, or read storage. After the account is created, reconnect with the exact username from the confirmation.

## Keep one verified SSH alias

Host lemc-demo
    HostName demo.letemcook.dev
    Port 2222
    User YOUR_EXACT_USERNAME
    IdentityFile ~/.ssh/lemc-demo
    IdentitiesOnly yes
    StrictHostKeyChecking yes

Use the alias for every later command. A key is bound to one exact user and account; use a separate key and alias for another account.

## Verify identity and discover actions

ssh lemc-demo auth whoami --format=json
ssh lemc-demo apps list --format=json
ssh lemc-demo jobs surface app \
  --uuid APP_UUID \
  --scope individual \
  --format=json

• auth whoami confirms the effective username and account.
• apps list returns only apps authorized for this key.
• jobs surface returns the page, scope, recipe, stable action ID, and declared inputs.
• Discovery does not grant permission. The server checks current authority again when the job is admitted.

## Run and follow one reviewed action

ssh lemc-demo jobs run app \
  --uuid APP_UUID \
  --action ACTION_ID \
  --set environment=production \
  --follow \
  --render json

Use only the action ID and declared form values returned by the surface. Do not select a runner, execution mode, host path, or arbitrary command. LEMC owns admission, isolation, scheduling, event persistence, and cleanup.

## Inspect durable proof

ssh lemc-demo jobs status app \
  --uuid APP_UUID \
  --page 1 \
  --scope individual \
  --task-id TASK_ID \
  --format=json

ssh lemc-demo jobs logs app \
  --uuid APP_UUID \
  --page 1 \
  --scope individual \
  --recipe "check release readiness" \
  --task-id TASK_ID

ssh lemc-demo jobs artifacts list app \
  --uuid APP_UUID \
  --page 1 \
  --scope individual \
  --task-id TASK_ID

A complete caller checks the task ID, terminal status, terminal reason, system and recipe steps, logs, rendered output, artifacts, and cleanup result.

## Build through the governed boundary

Accepted teams can use the server-owned Builder through LEMCSSH. The agent sends a Dockerfile or source file through bounded stdin; the Runner builds and tests it in fresh jailed guests. The SSH host never becomes a shell or Docker host for the agent.

ssh lemc-demo builder images --help
ssh lemc-demo builder images list --format=json
ssh lemc-demo builder images compile-run IMAGE_UUID \
  --expected-revision REVISION_UUID \
  --idempotency-key REQUEST_UUID \
  --follow

Recipe secrets are write-only. Supply a value through bounded stdin; never put it in a prompt, URL, argument list, log, or artifact.

## Minimal agent loop

request beta access
  → register the invited key through LEMCSSH
    → verify the exact account
      → list authorized apps
        → inspect the action surface
          → run the returned action
            → follow events to terminal state
              → report the task ID and evidence

Keep planning and execution separate. The model can explain why it chose an action; LEMC supplies the evidence for what that action did.