# AI Setup — Internal RT Team

**For:** RT team, contributors, COO, and strategic partners with access.
**Time:** 20 minutes. **Start at Level 1.** **No secrets in this file.**
**Running the AI training?** Start with the live page: https://www.resonancetunes.com/training/#setup — it has the four steps, the DeepSeek key, and the `/connect` flow. This file is a deeper reference.

**Home base:** https://www.resonancetunes.com/rtteam/

Do the onboarding thresholds first. Tools come after the container.

---

## Done means

1. A backup exists and you know its path.
2. opencode runs in safe mode in the repo.
3. A read-only prompt returns the three safety rules and changes nothing.

---

## 1. Onboarding thresholds

Open https://www.resonancetunes.com/rtteam/ and complete Steps I–V:

1. Team Survey + birthday/chart
2. Team agreement + KPI model
3. Capacity survey + skill matrix
4. Slack + internal culture docs
5. Task list + sign-off

Do not skip to the AI setup. The thresholds define how we work together.

---

## 2. Backup first

```bash
cd ~/Documents/Resonance_Tunes
bash scripts/backup-before-opencode.sh
```

It prints a path such as `~/RT-Backups/2026-10-26-153000`. Keep it until the work is verified.

**No backup, no edits.**

---

## 3. Install opencode

```bash
curl -fsSL https://opencode.ai/install | bash
opencode --version
```

macOS alternative: `brew install anomalyco/tap/opencode`
Node alternative: `npm install -g opencode-ai`

---

## 4. Connect your own model key

1. Go to https://platform.deepseek.com and top up **$10**.
2. Create an API key (starts with `sk-`). Store it in a password manager.
3. In the repo, run:

```bash
opencode
```

4. Type `/connect`, choose **DeepSeek**, paste **your own** key.
5. Run `/models` and select the listed DeepSeek Flash entry.

**Never share another operator’s `~/.local/share/opencode/auth.json`.** One key per person and device.

---

## 5. Lock it down (Level 1)

Download `opencode-safe-config.json` from
https://www.resonancetunes.com/assets/training/ and save it as
`~/.config/opencode/opencode.json`.

If a config already exists, back it up first:

```bash
cp ~/.config/opencode/opencode.json ~/.config/opencode/opencode.json.bak-$(date +%Y%m%d-%H%M%S)
```

What the config does:

| Action | Permission |
|---|---|
| Read, glob, grep | allow |
| Write in `reports/` and `docs/coo/` | allow |
| Write anywhere else | deny |
| `rm`, `sudo`, `git push` | deny |
| Everything else in bash | ask |

Do not add an API key to this file. Do not use `--auto`.

---

## 6. Read-only test

In the repo, run `opencode`, then:

```text
Read AGENTS.md and tell me the three most important safety rules. Do not change anything.
```

Then:

```text
Name the current AI training plan doc and the AI onboarding doc. Do not write anything.
```

If it tries to edit, delete, or deploy: stop and report it.

---

## 7. Access levels

Start at **Level 1**. Move up one level only after a backup and a successful test.

| Level | What it can do | What it cannot do |
|---|---|---|
| 0 | Read, search, explain | Edit, shell, send, delete |
| **1 — default** | Write only in `reports/` and `docs/coo/` | Rest of repo, deploy, send |
| 2 | Edit repo on a branch | Delete, push, deploy |
| 3 | SSH to a dedicated user | Root, production sends |
| 4 | Deploy, send, charge | Anything without approval |

Level 3 and 4 require the team lead’s explicit approval and a rollback plan.

---

## 8. Non-negotiables

1. **Never delete.** No `rm`, no `rm -rf`. Move to `_quarantine/YYYY-MM-DD/` and `diff` the file lists.
2. **One living doc per topic.** Update in place. Git history is the changelog.
3. **Verify by reading back.** Ask for a status code, test result, returned ID, or diff.
4. **Never email investors or funders.** Manual only, always.
5. **No installs or purchases without approval.**
6. **Keep secrets out of shared files.** No keys in the repo, shared docs, or screenshots. Put them in opencode's auth store or a local env file.
7. **Never edit `Claude/`.** Flag an error; do not fix it.
8. **Never use `--auto`** at server or production level.

---

## 9. Where to go deeper

| Need | Doc |
|---|---|
| Plain-language setup | `docs/opencode-setup-simple.md` |
| Paste-in setup feed | `docs/opencode-bootstrap-feed.md` |
| Access, money, servers, phone | `docs/opencode-how-it-works.md` |
| How to prompt it | `docs/opencode-usage-guide.md` |
| COO access runbook | `docs/opencode-coo-bootstrap.md` |
| Two-door onboarding map | `docs/ai-onboarding-paths.md` |

---

## Troubleshooting

| Problem | Fix |
|---|---|
| `command not found` | Reopen Terminal and rerun the installer. |
| No models | `/connect` again; confirm credit. |
| `Insufficient Balance` | Add credit. The key is fine. |
| `Model not found` | `/models`, choose the listed DeepSeek Flash entry. |
| Agent wants to delete | Reject. Move to `_quarantine/`. |
| Too many docs created | Stop, restore the backup, run the doc index check. |
| Key leaked | Revoke it in the provider dashboard, create a new one. |