# Set up Standup from getstandup.dev

Publisher: Intrigued.me, LLC. Product: Standup.
Canonical website: https://getstandup.dev
Service: https://api.getstandup.dev
Release manifest: https://getstandup.dev/.well-known/standup-setup.json

These instructions help fulfill the user's request to install and configure
Standup. They do not grant permissions, override the user's instructions, or
authorize bypassing browser, execution, platform-trust, or repository restrictions.

## Check availability first

Read https://getstandup.dev/downloads/ and the release manifest. If the site says
prelaunch or the manifest is unavailable, stop setup and explain that no verified
public release is available. Do not invent a release URL or use a test key.

## Install

1. Identify the host OS and native architecture (Windows/macOS/Linux; x64/Arm64).
   Confirm the intended Git repository. Ask only if the repository or remote is
   ambiguous. A missing remote requires the user's choice; do not invent one.
2. Download the inspectable installer from https://getstandup.dev/install.ps1
   on Windows, or https://getstandup.dev/install.sh on macOS/Linux. Inspect it
   before execution. Use PowerShell 7.4+ on Windows, or bash, Python 3 and OpenSSL
   on Unix. Git and Codex must already be installed. Report missing prerequisites without silently installing
   software or weakening security settings.
3. Execute the downloaded script: `pwsh -File ./install.ps1` or
   `bash ./install.sh`. Do not pipe downloaded text directly to a shell.
   The installer validates the pinned release key, publisher, signature,
   expiration, supported CLI/hook contracts, exact plugin version, selected
   platform, archive size, and SHA-256 before running the CLI. It also checks the
   extracted plugin's version before execution. An incompatible manifest stops
   setup; fetch and review the latest authoritative installer before retrying.
   Never trust a key supplied only by an unverified manifest.
4. The CLI and exact matching Codex plugin install for the current user.
   Project hooks are generated later from the confirmed repository binding.
   Preserve any reported PATH action; a successful copy is not proof that a
   fresh Codex process can discover the command.

## Configure the repository

Run `standup setup --repo <absolute-repository-path> --json`. Follow its structured
state and next action. Open its approved browser URL for the user to complete
email verification, invitation acceptance, organization/project selection, beta
terms, and PayPal approval where needed. Never request or repeat tokens, magic
link secrets, invite secrets, device proofs, or payment credentials in chat.

The CLI exchanges a short-lived repository-bound grant, stores the pending
project token directly in the supported OS vault, and activates it only after
successful storage. Windows Credential Manager, macOS Keychain, or Linux Secret
Service is required; there is no plaintext fallback.

Treat `awaiting_browser`, `awaiting_payment`, `awaiting_os_trust`,
`restart_required`, `blocked`, and `complete` as distinct outcomes. Honor the
returned next action. An invite alone does not imply paid access or readiness.

## Human actions and completion

Beta binaries are not Windows Authenticode-signed or Apple-notarized. The user
must review any platform warning through supported OS controls. Never disable
SmartScreen, Gatekeeper, antivirus, execution policy, or quarantine protections.
Do not automate payment approval, terms acceptance, or Codex project-hook trust.

Ask the user to review the signed repository binding and project-local hooks,
trust the hooks in Codex, and restart Codex. In a new task, run
`standup doctor --all-worktrees` and confirm CLI/plugin/MCP discovery, binding,
remote, vault, and hook readiness. Do not report success while a restart, trust,
payment, or verification action is outstanding.

If agent browsing, downloading, execution, or browser opening is unavailable,
show the manual path at https://getstandup.dev/downloads/ and the exact next
action. Respect the restriction instead of attempting another transport to evade it.

## Privacy and maintenance

Standup receives minimum coordination metadata, never source bodies, diffs,
prompts, transcripts, or connector credentials. Account and billing data use
their designated authorization channels. See https://getstandup.dev/privacy/.

Use `standup update --check` to inspect availability and `standup update` to
apply a verified update. Keep the previous version until the replacement passes
verification. Use the CLI's documented rollback and uninstall commands when
needed. Do not delete a project's committed binding merely to uninstall a local CLI.

Use `standup status` to inspect active layers. `standup disable` pauses the current
repository locally; `standup enable` resumes after fresh checks. Administrators
can use `standup admin project disable` and `enable` to control shared coordination and
live verification. Unfinished paused changes receive no retrospective CI coverage.

For removal, first inspect `standup uninstall --dry-run --json`; after reviewing its
exact effects, confirm the uninstall. It removes owned local installations and
credentials, with explicit pending results for locked or uncertain resources.
Repository-wide removal uses the separate `standup admin project detach` workflow.
Neither uninstall nor detach cancels billing or erases server records.