Your VM. Your workflow. Start your PoC.

First exercise: create a local Work record

Use CREATE_AUDIT_ARTIFACT to learn the submission → execution → same-Work inspection path. The input is a short intent plus one unused idempotency key. No customer dataset or model subscription is needed for this local operation.

Scope: it creates a structured local lineage artifact. It does not analyze an attached document, query your database or demonstrate an AI model call. Run it only when your supplied release lists the operation and your customer administrator has authorized this one Work.

1. Check the installed interface

On the Debian appliance, use your existing authorized root administration session for the following runuser commands. If that route is unavailable, use the installation’s documented operator route; do not change socket permissions or grant new privileges.

CTL=/opt/vibepackr/current/bin/packrctl
SOCKET=/run/vibepackr/control-plane.sock
"$CTL" --help
runuser -u vibepackr-runtime -- "$CTL" --socket "$SOCKET" status --json
runuser -u vibepackr-runtime -- "$CTL" --socket "$SOCKET" health --json

Read the actual status and reason fields. Service liveness is not Work authority. Resolve a refusal, missing binding or unmet prerequisite using the installed bootstrap before submitting.

2. Submit once and retain the response

Set WORK_DIR to an existing customer-approved private directory and POC_KEY to one approved unused key for this exercise. Keep the same shell variables for the following blocks. Submission creates a Work record; the website’s Copy button never executes it.

# Set your actual WORK_DIR and approved unused POC_KEY first.
(
  : "${WORK_DIR:?Set the approved existing private directory}"
  : "${POC_KEY:?Set one approved unused key}"
  : "${CTL:?Run the interface block first}"
  : "${SOCKET:?Run the interface block first}"
  test -d "$WORK_DIR" || exit 66
  umask 077
  RUN_DIR=$(mktemp -d "$WORK_DIR/first-work.XXXXXX") || exit 73
  printf '%s\n' "$RUN_DIR"
  printf '%s\n' "$POC_KEY" > "$RUN_DIR/request-key.txt"
  set +e
  runuser -u vibepackr-runtime -- "$CTL" --socket "$SOCKET" \
    --timeout-seconds 30 work run CREATE_AUDIT_ARTIFACT \
    "Create a local audit artifact for this PoC" "$POC_KEY" --json \
    > "$RUN_DIR/work-run.json" 2> "$RUN_DIR/work-run.stderr"
  work_exit=$?
  printf '%s\n' "$work_exit" > "$RUN_DIR/work-run.exit"
  exit "$work_exit"
)

Read work-run.json and work-run.exit in the printed directory. Copy the actual result.work.work_id into WORK_ID. A timeout, empty result or exit 0 is not a completion receipt. Do not rerun this block to recover an uncertain submission.

3. Inspect the same Work and its evidence

# Set WORK_ID to the exact result.work.work_id returned above.
(
  : "${WORK_ID:?Set the actual returned Work ID}"
  : "${CTL:?Run the interface block first}"
  : "${SOCKET:?Run the interface block first}"
  runuser -u vibepackr-runtime -- "$CTL" --socket "$SOCKET" \
    work show "$WORK_ID" --json
)

Evidence scope: this walkthrough uses the supplied public CLI and a retained local Debian PoC execution from 6 November 2026. That execution is separate from the newer installer-only check. It is not a new run in your VM, a business-data test, a cloud-wide certification or a timed five-minute guarantee.

Network and data boundaries

Separate the download path, VM-local control path and optional business connections. The diagram describes the supplied installation model; use the actual configuration and listener observations to review your deployment.

Self-hosting does not itself prohibit outbound traffic. Local Sources attachment controls supplied context, not every file permission of a connected agent. Review runtime permissions and network controls separately. Do not open a firewall or expose a service merely to make a health check pass.

Keep these checks at hand

These commands read status and bounded logs. Use the customer-approved operator session; journal and socket inspection may require existing administrator access. Keep raw outputs in the customer’s private records.

/opt/vibepackr/setup paths
systemctl status vibepackr-control-plane.service --no-pager --full
journalctl -u vibepackr-first-boot.service -u vibepackr-control-plane.service -n 100 --no-pager
/opt/vibepackr/health

setup paths identifies the installed bootstrap and Skills. The installer log is install.log, with install.exit beside it, in the private directory printed by install.md. Runtime service output is inspected through journald; no fixed /var/log/vibepackr.log is assumed. Read the actual health exit and missing prerequisite.

ss -lntup
ss -lx
systemctl status vibepackr-customer-access-gateway.service --no-pager
systemctl status vibepackr-remote-admin-gateway.service --no-pager

Resume, disable or retire without erasing history

Resume the original Work using its supported inspection/reconciliation path. /opt/vibepackr/diagnostics, /opt/vibepackr/disable and /opt/vibepackr/uninstall are native administrative entry points that require the installation’s state root, request and credential files. They are not generic restart, rollback or cleanup commands. Use the installed administrator procedure and verify the result; do not delete /var/lib/vibepackr or repoint current by hand.