Start the signed customer-local bundle

Stand up the released bundle only on the person's own machine, then run metergraph setup. The CLI does not provision it, and --confirm-prerequisites records confirmation rather than installing anything.

Keep registry, admin and database secrets out of chat, command arguments and output. Never read or print .env values, ~/.docker/config.json, docker compose config output or container environment from docker inspect. Do not configure model-provider keys.

Stop in remote runtimes

Before changing anything, determine where the agent executes. Check only whether these variables exist, never their values: