[Feature] Org-admin onboarding for shared-node services — friction tracking

[loning]

Context

While trying to connect an org-shared Home Assistant service (home-assistant slug, hosted on org-owned node share-ops-ha) from a fresh org admin perspective, I hit several rough edges that turned a 2-minute task into an exploration of nyxid CLI flags. Filing these as a tracking issue with sub-issues so they can be triaged independently.

The end-to-end task: "I'm a new org admin, I want to call the org's HA REST API via nyxid proxy request <slug> /config, what do I do?"

Sub-issues

• [Feature] node-credential push: allow internal target_url for node-side reachability #770 — node-credential --target-url rejects RFC1918 / homeassistant.local URLs that ARE the legitimate target
• [Feature] Surface stale-node binding when proxy returns node_offline #771 — Surface stale-node binding when service routes through an offline node
• [UX] Explain credential_type=node_managed inline in service show / list #772 — service show / service list should inline-explain credential_type: node_managed + what an admin must do next
• [Feature] Remote credential injection path for org admins (no SSH-to-node required) #773 — Org admin needs a remote / web-driven path to inject node-managed credentials — currently must SSH/console into each node
• [Feature] node show should expose connection source IP / last-seen-from for admin debugging #774 — nyxid node show should expose connection source IP / last-seen-from for connectivity debugging
• [Doc] CLI surface split: nyxid node credentials exists on addon-side runtime, not user-side CLI #775 — Hint message points to nyxid node credentials pending — but that subcommand does not exist on the user-side CLI

Reproducer (the path I took)

nyxid org list                                      → ChronoAI (admin)
nyxid node list                                     → finds share-ops-ha (online, org-owned)
nyxid proxy request home-assistant /config          → 503 node_offline
                                                       (slug pointed at a STALE node id)
nyxid service show home-assistant                   → still shows Status: active, no hint about stale node
nyxid service route <id> --node <share-ops-ha-id>   → ✓ rerouted
nyxid proxy request home-assistant /config          → 401 (auth path now reachable, token bad)
nyxid service rotate-credential home-assistant      → "service is node-managed, update on the node instead"
nyxid service update home-assistant --default-header 'Authorization=Bearer ...'
                                                    → "Authorization is reserved"
nyxid node-credential push <node> --slug home-assistant --target-url <office-HA-URL>
                                                    → "target_url must not resolve to private/internal IP"
nyxid node-credential push <node> --slug home-assistant   (no target-url)
                                                    → ✓ pending credential created
                                                       but now the operator on the office HA node
                                                       must run nyxid node credentials accept ...
                                                       — no way for an org admin to do this remotely

Net: 7-step CLI dance + 4 dead-ends to discover the workflow. The right experience is probably 1-2 commands or a web UI flow.

Why this matters

ChronoAI org has multiple org-shared HA / addon nodes (currently 6 admins on share-ops-ha). As we add more shared nodes (office, parents' home, etc.), every new admin will rediscover the same edge cases. Each pain point above is independent and small; tackling them in a quarter would substantially improve the org admin onboarding UX.

cc node-managed-services area

[chronoai-bot]

github-devloop intake decision: track
Service class: background

Acknowledged as a tracking umbrella. Individual waves should enter the pipeline as separate issues; this issue stays open for tracking.

Reason:
Tracker/epic practice applies: this bundles independent sub-issues #770-#775 for org-admin onboarding friction, so it is organizational rather than one autonomous implementation request.