Run the daemon on Earth: make install-server, a unit that waits for a Spectra (#25) aa72eb904932

#!/bin/sh

# Install `spectra serve` on another machine as a systemd user service

# (spec §8.6, spectra#25): build a release here, copy a stripped binary and

# the unit over SSH, and enable it. The unit waits until a Spectra exists

# there (`spectra init --owner KEYID`), and starts from boot when the

# account has lingering on.

#

#   scripts/install-server.sh [USER@]HOST

set -eu

[ $# -eq 1 ] || { echo "usage: $0 [USER@]HOST" >&2; exit 2; }

target=$1

cd "$(dirname "$0")/.."

SPECTRA_BUILD="$(oxy --plain describe 2>/dev/null || true)" CARGO_INCREMENTAL=0 cargo build --release -p spectra

bin=${CARGO_TARGET_DIR:-target}/release/spectra

tmp=$(mktemp -d)

trap 'rm -rf "$tmp"' EXIT

strip -o "$tmp/spectra" "$bin"

ssh -o BatchMode=yes "$target" 'mkdir -p ~/.local/bin ~/.config/systemd/user'

scp -q -o BatchMode=yes "$tmp/spectra" "$target:.local/bin/spectra.new"

scp -q -o BatchMode=yes packaging/spectra.service "$target:.config/systemd/user/spectra.service"

ssh -o BatchMode=yes "$target" '

set -e

chmod 755 ~/.local/bin/spectra.new && mv ~/.local/bin/spectra.new ~/.local/bin/spectra

systemctl --user daemon-reload

systemctl --user enable spectra >/dev/null 2>&1

if systemctl --user is-active --quiet spectra; then systemctl --user restart spectra; fi

echo "installed: $(~/.local/bin/spectra --version)"

if [ -e ~/.local/share/spectra/spectra.db ]; then

  systemctl --user start spectra

  echo "service: $(systemctl --user is-active spectra)"

else

  echo "service: enabled; waiting for a Spectra: spectra init --owner KEYID, then systemctl --user start spectra"

fi

echo "linger: $(loginctl show-user "$(id -un)" -p Linger --value) (yes means it runs from boot)"

'

- **Added: `make install-server HOST=user@host` (#25).** Builds a release, copies a stripped binary and the systemd user unit over SSH, and enables the service. The unit now waits until a Spectra exists instead of failing in a loop. `make install` copies the binary rather than linking into the build tree, so cleaning a build directory no longer breaks an installed service. The README describes setting up the daemon on another machine.

.PHONY: install-server build check test fmt clippy changelog run ts install deps-check

	install -D -m 755 $${CARGO_TARGET_DIR:-$(CURDIR)/target}/release/spectra $(HOME)/.local/bin/spectra

# The daemon on another machine over SSH (spec §8.6): make install-server HOST=user@host

install-server:

	@test -n "$(HOST)" || { echo "make install-server HOST=[USER@]HOST" >&2; exit 2; }

	scripts/install-server.sh $(HOST)

make install          # release build with its build identity, copied into ~/.local/bin

make install-server HOST=user@host   # the same, over SSH, with the systemd user unit

## The daemon on another machine

Spectra can run on a server while you, your keys and your agents stay on your workstation (spec §8.6). Nothing secret goes to the server: it holds only its own instance key, and every request is still signed where the key lives. Traffic is TLS with a certificate the server makes itself; your workstation trusts it because your own identity delegates to the server's instance key, which vouches for the certificate. No certificate authority is involved.

On the workstation, install the server and note your KeyId:

```

make install-server HOST=claude@earth

oxy identity show                              # the 64-hex key

```

On the server:

```

spectra init --owner KEYID --name earth        # no key of yours is needed there

# in ~/.local/share/spectra/spectra.toml, under [server]:

#   bind = "[::]:7350"

#   names = ["earth", "earth.example"]

systemctl --user start spectra

```

On the workstation:

```

spectra connect https://earth.example:7350     # prints the delegation to run, the first time

oxy identity delegate add ~/.config/spectra/earth-instance.identity --scope changes

spectra connect https://earth.example:7350     # trusted, pinned, and claimed as yours

```

From then on every command on the workstation works against the server, with no ledger file locally. Agents name their home, since it is on the workstation: `spectra mcp --agent claude-oxygen --home ~/.oxy-agents/claude-oxygen`. `spectra open` serves Radar on `http://127.0.0.1:7350` through a proxy to the server.

- [x] #25 Run the daemon on Earth — done 2026-11-03: make install-server, a unit that waits for a Spectra, make install copies; Earth runs `spectra serve` on [::]:7350 as the claude account from boot, set up with `spectra init --owner d89664ced1fc…` (Andy's public KeyId) and waiting for his claim; /api/v1/instance answers from the workstation.

  1. Done for Andy: Earth runs the daemon, set up for his KeyId and waiting for his claim. Before step 2, `spectra --version` here should be the release (`make install`).

  2. On the workstation: `spectra connect https://earth.andymccall.xyz:7350`; run the printed `oxy identity delegate add ~/.config/spectra/earth-instance.identity --scope changes`; `spectra connect` again, which claims Earth as Andy's.

  5. Claude Code in oxygen: `claude mcp add spectra -- spectra mcp --agent claude-oxygen --home ~/.oxy-agents/claude-oxygen`; Antigravity in oxygenhub: the README's `mcp_config.json` line with `--home` added.

  7. `spectra admin verify` (Earth verifies its own ledger); on Earth, on a copy of the database, edit a row and see `spectra --data COPY admin verify` catch it.

#   (on another machine: make install-server HOST=user@host)

After=default.target network-online.target

# Until `spectra init` (or `spectra init --owner KEYID` on a server) makes

# a Spectra, the enabled service waits instead of failing in a loop.

ConditionPathExists=%h/.local/share/spectra/spectra.db