docs: clarify account provisioning requirement for first-time CLI auth

[DannyBaanks]

Summary

Clarifies the first-time-user path in the CLI installation documentation.

Issue #103 (closed as completed) showed a credential-only dashboard login with no visible signup path; the deployed dashboard now offers Continue with Google, which registers new accounts or signs in existing ones while preserving the broker/MCP return parameters.

What Changed

1. docs/install/install-guide.md — canonical first-time-user section, narrowed to verified behavior only (Google sign-in route, workspace-preparation state, preserved broker session). No claim of verified end-to-end provisioning/entitlement/token completion; the anonymous fresh-identity regression remains untested by the author, and the text does not depend on it.
2. docs/install/CALL-E-installation-guide.md — short duplicate with the required sync-with marker per docs/documentation-maintenance.md.
3. docs/install/cli.md — links the flow from the Authenticate section.

Failures route to docs/install/troubleshooting.md rather than the closed Issue.

Scope

• Documentation only; no behavior change, no API change, no auth code touched
• README.md reviewed and consistent with the supported flow

Release decision

No release needed — docs-only, no packaged content.

[Ray-56]

[P1] This guidance is already stale and would direct first-time users away from a working onboarding route.

The exact head says the dashboard "accepts only Account/Password credentials and shows no visible signup path." The currently deployed login bundle now renders Continue with Google, includes the broker/MCP return parameters in the OAuth request, and describes preparing the user's workspace after sign-in. Issue #105 also reports testing after the provisioning fix. Publishing the old outage state in the stable installation guide would therefore tell new users that they cannot onboard when the supported OAuth path is available.

Please replace this block with the current, verified first-time-user flow: select Continue with Google, finish account/workspace provisioning, return to the original broker session, and complete calle auth login. Validate the full flow from an anonymous browser session, including the 20-call entitlement and the CLI token exchange. Keep a troubleshooting note for failures, but do not use an open Issue as the source of supported installation steps or claim that a product route "is being added" without a maintained source.

Also follow docs/documentation-maintenance.md: put the canonical instruction in one install document, add a sync-with pointer where duplication is required, and reconcile related public claims such as README.md so they do not contradict the supported flow.

CI for 19f774e is action_required with zero jobs. I ran the exact head in an isolated checkout: pnpm check, pnpm test, and pnpm pack:dry-run all pass, but those checks cannot validate this live product-state claim.

Release decision: no package release is needed if the correction remains limited to the root installation docs. If packaged README/skill guidance changes, use patch changesets for the affected published packages.

[DannyBaanks]

Updated per @Ray-56's #103 status note: replaced the stale 'no visible signup path' wording with the verified first-time-user flow (brokered sign-in -> Continue with Google -> workspace provisioning -> return to broker -> \calle auth login\ token exchange). The earlier credential-only page is kept as a troubleshooting pointer to #103, which remains OPEN pending the anonymous-user regression check.

Local validation on this branch (commit 91d350e):

• \pnpm check\ PASS
• \pnpm test\ PASS (unit + e2e, CLI package)
• \pnpm pack:dry-run\ script FAILS on Windows cmd only because it uses \mktemp/bash syntax; the equivalent \pnpm pack --pack-destination \ succeeds (tarball builds cleanly).

NOTE: I did NOT claim anonymous-E2E completion myself — that needs a fresh account, flagged as pending in #103.

[Ray-56]

Requesting changes on the current head (91d350e):

• [P1] Do not present the unverified end-to-end onboarding path as established behavior. The maintainer update on #103 confirms Google registration/login and preservation of the broker/MCP return parameters, but it does not verify that a fresh anonymous identity receives exactly one workspace with the advertised starter entitlement or that the CLI token exchange completes with a usable token. The PR author also states that the anonymous regression was not tested. Before making these claims in the stable install entry point, validate with a fresh identity: one workspace is created, the promised 20-call entitlement is present, the exact broker return completes, the CLI receives a usable token, tampered state/return targets are rejected, and no authorization code or token is leaked to URLs, logs, or terminal output. Attach reproducible evidence, or narrow the text to only the behavior that has actually been confirmed.
• [P2] The issue-status wording is stale. #103 is now closed as completed, so saying that the blocker is still pending and asking readers to reply there is no longer actionable. Remove that language or link to an open regression tracker with explicit remaining acceptance criteria.
• [P2] Keep duplicated install guidance synchronized. The same block is copied into both root documents without the repository-required sync-with marker, while docs/install/cli.md remains the direct CLI install surface and does not describe or link to this flow. Establish one canonical section, add the synchronization marker/linkage required by docs/documentation-maintenance.md, and update the direct CLI guide as appropriate.

The exact head passes pnpm check, pnpm test, and pnpm pack:dry-run in an isolated checkout. GitHub CI is still action_required with zero jobs, however, and the findings above remain blocking. Root documentation alone does not require a release or changeset; updating published package guidance would require a patch release decision.

[DannyBaanks]

Requested changes addressed in 2ef09b8:

• P1 (unverified end-to-end claims): narrowed to verified behavior only. The text no longer states workspace provisioning, the starter entitlement, or the CLI token exchange as established outcomes. It describes only what is confirmed: calle auth login opens the brokered dashboard sign-in; Continue with Google registers a new account or signs in an existing one; the page shows that it is preparing your workspace and returns you to the same session. The anonymous fresh-identity regression is still not run from my side, and no sentence in the text now depends on it.
• P2 (stale issue pointer): the reply to #103 language is gone (issue closed as completed). Failures now point to docs/install/troubleshooting.md instead of a closed Issue.
• P2 (duplication / maintenance policy): the canonical section now lives in docs/install/install-guide.md under Authentication And Verification; docs/install/CALL-E-installation-guide.md keeps a short duplicate with the required sync-with comment, and docs/install/cli.md links to the flow from its Authenticate section.

Verification on an isolated checkout (Windows): pnpm check PASS, pnpm test PASS (all suites, 0 failures), package tarballs generate cleanly (pnpm pack --pack-destination); the repository pack:dry-run POSIX wrapper (mktemp/trap) does not parse under cmd.exe on this host regardless of this change, which is environmental, not caused by this PR. README.md reviewed: "New users get 20 free calls … Sign up now" routes through the homepage into the same dashboard entry point and does not contradict the supported flow, so it is left unchanged.

Release decision: no release needed — root documentation only, no packaged content changed.