Seed device fleet and document agent

Populate varied device posture states in seed data and link the
probo-agent release guide from AGENTS.md.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

AGENTS.md

@@ -12,6 +12,7 @@ Detailed guides for specific subsystems live in `contrib/claude/`:
 - [`contrib/claude/httpclient.md`](contrib/claude/httpclient.md) — HTTP client (kit/httpclient, SSRF protection by default, connector wiring)
 - [`contrib/claude/gid.md`](contrib/claude/gid.md) — Global identifiers (GID layout, TenantID, entity type registry)
 - [`contrib/claude/coredata.md`](contrib/claude/coredata.md) — Data access layer (Scoper, SQL patterns, filters, order fields, migrations)
+- [`contrib/claude/ownership.md`](contrib/claude/ownership.md) — Resource ownership (membership profile vs identity; provisional)
 - [`contrib/claude/logging.md`](contrib/claude/logging.md) — Structured logging (PII-free rules, field helpers, logger wiring)
 - [`contrib/claude/graphql.md`](contrib/claude/graphql.md) — Go GraphQL backend (gqlgen, @goModel, connection types, cursor pagination)
 - [`contrib/claude/mcp.md`](contrib/claude/mcp.md) — MCP API patterns (specification.yaml, mcpgen, resolvers, type helpers)

contrib/seed.sh

@@ -140,6 +140,8 @@ PRB="./bin/prb"
 
 echo "  Creating people..."
 
+PROFILE_IDS=()
+
 create_person() {
   local full_name="$1"
   local position="$2"
@@ -165,6 +167,14 @@ create_person() {
     }
   ' "$vars")
   check_error "$resp" "createPerson: $full_name"
+
+  local profile_id
+  profile_id=$(echo "$resp" | jq -r '.data.createUser.profileEdge.node.id // empty')
+  if [ -z "$profile_id" ]; then
+    echo "ERROR (createPerson: $full_name): no profile id in response" >&2
+    exit 1
+  fi
+  PROFILE_IDS+=("$profile_id")
 }
 
 create_person "Jane Cooper" \
@@ -695,6 +705,203 @@ create_measure "Tabletop Disaster Recovery Exercises" \
 
 echo "    15 measures created"
 
+echo "  Creating devices..."
+
+AGENT_API="$BASE_URL/api/agent/v1"
+
+create_device() {
+  local owner_id="$1"
+
+  local input
+  if [ -n "$owner_id" ]; then
+    input=$(jo organizationId="$ORG_ID" ownerId="$owner_id")
+  else
+    input=$(jo organizationId="$ORG_ID")
+  fi
+
+  local resp
+  resp=$(prb_api "createDevice" '
+    mutation($input: CreateDeviceInput!) {
+      createDevice(input: $input) {
+        device { id }
+        enrollmentToken
+      }
+    }
+  ' -f input="$input")
+
+  local device_id token
+  device_id=$(echo "$resp" | jq -r '.data.createDevice.device.id // empty')
+  token=$(echo "$resp" | jq -r '.data.createDevice.enrollmentToken // empty')
+  if [ -z "$device_id" ] || [ -z "$token" ]; then
+    echo "ERROR (createDevice): missing device id or enrollment token in response" >&2
+    exit 1
+  fi
+
+  echo "$device_id $token"
+}
+
+agent_enroll() {
+  local token="$1"
+
+  local resp api_key
+  resp=$(curl -s -X POST \
+    -H "Content-Type: application/json" \
+    -d "$(jq -n --arg t "$token" '{token: $t}')" \
+    "$AGENT_API/enroll")
+  api_key=$(echo "$resp" | jq -r '.api_key // empty')
+  if [ -z "$api_key" ]; then
+    echo "ERROR (agent_enroll): no api_key in response: $resp" >&2
+    exit 1
+  fi
+
+  echo "$api_key"
+}
+
+agent_heartbeat() {
+  local api_key="$1"
+  local hardware_uuid="$2"
+  local hostname="$3"
+  local platform="$4"
+  local os_version="$5"
+  local agent_version="$6"
+  local serial="${7:-}"
+
+  # Build with jq (not jo) so numeric-looking values like os_version "14.5"
+  # stay JSON strings; jo would coerce them to numbers and fail decoding.
+  local body
+  body=$(jq -n \
+    --arg hw "$hardware_uuid" \
+    --arg sn "$serial" \
+    --arg hn "$hostname" \
+    --arg pf "$platform" \
+    --arg ov "$os_version" \
+    --arg av "$agent_version" \
+    '{hardware_uuid: $hw, hostname: $hn, platform: $pf, os_version: $ov, agent_version: $av}
+      + (if $sn == "" then {} else {serial_number: $sn} end)')
+
+  local resp code
+  resp=$(curl -s -w '\n%{http_code}' -X POST \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $api_key" \
+    -d "$body" \
+    "$AGENT_API/heartbeat")
+  code=$(echo "$resp" | tail -n1)
+  if [ "$code" != "200" ]; then
+    echo "ERROR (agent_heartbeat $hostname): HTTP $code" >&2
+    echo "  request: $body" >&2
+    echo "  response: $(echo "$resp" | sed '$d')" >&2
+    exit 1
+  fi
+}
+
+# agent_postures <api_key> <CHECK_KEY:STATUS>...
+agent_postures() {
+  local api_key="$1"; shift
+
+  local now
+  now=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+  local body
+  body=$(printf '%s\n' "$@" \
+    | jq -R --arg o "$now" 'split(":") | {check_key: .[0], status: .[1], observed_at: $o}' \
+    | jq -s '{results: .}')
+
+  local code
+  code=$(curl -s -o /dev/null -w '%{http_code}' -X POST \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $api_key" \
+    -d "$body" \
+    "$AGENT_API/postures")
+  if [ "$code" != "204" ] && [ "$code" != "200" ]; then
+    echo "ERROR (agent_postures): HTTP $code" >&2
+    exit 1
+  fi
+}
+
+revoke_device() {
+  local device_id="$1"
+
+  prb_api "revokeDevice" '
+    mutation($input: RevokeDeviceInput!) {
+      revokeDevice(input: $input) {
+        device { id }
+      }
+    }
+  ' -f input="$(jo deviceId="$device_id")" > /dev/null
+}
+
+# seed_device <owner_id> <hostname> <platform> <os_version> <serial> <CHECK_KEY:STATUS>...
+# Creates a device, enrolls it, sends a heartbeat (activating it) and posts
+# posture results. Prints the device id.
+seed_device() {
+  local owner_id="$1"
+  local hostname="$2"
+  local platform="$3"
+  local os_version="$4"
+  local serial="$5"
+  shift 5
+
+  local out device_id token
+  out=$(create_device "$owner_id")
+  device_id="${out%% *}"
+  token="${out#* }"
+
+  local api_key
+  api_key=$(agent_enroll "$token")
+
+  local hardware_uuid
+  hardware_uuid="hw-$(echo "$hostname" | tr '[:upper:]' '[:lower:]')"
+
+  agent_heartbeat "$api_key" "$hardware_uuid" "$hostname" "$platform" "$os_version" "1.0.0" "$serial"
+  agent_postures "$api_key" "$@"
+
+  echo "$device_id"
+}
+
+# 6 active devices across platforms, each owned by a seeded person with a
+# varied posture mix so the UI shows every badge state.
+seed_device "${PROFILE_IDS[0]}" "jane-macbook-pro" "DARWIN" "14.5" "C02XY1Z2JGH7" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:PASS FIREWALL_ENABLED:PASS TIME_SYNC:PASS \
+  OS_VERSION:PASS AUTO_UPDATE:PASS PASSWORD_POLICY:PASS REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:PASS > /dev/null
+
+seed_device "${PROFILE_IDS[1]}" "marcus-thinkpad" "LINUX" "Ubuntu 24.04" "PF3ABCDE" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:PASS FIREWALL_ENABLED:FAIL TIME_SYNC:PASS \
+  OS_VERSION:PASS AUTO_UPDATE:UNKNOWN PASSWORD_POLICY:PASS REMOTE_LOGIN:FAIL \
+  MALWARE_PROTECTION:NOT_APPLICABLE > /dev/null
+
+seed_device "${PROFILE_IDS[4]}" "emily-macbook-air" "DARWIN" "14.4" "C02AB3C4JGH8" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:FAIL FIREWALL_ENABLED:PASS TIME_SYNC:PASS \
+  OS_VERSION:PASS AUTO_UPDATE:PASS PASSWORD_POLICY:FAIL REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:PASS > /dev/null
+
+seed_device "${PROFILE_IDS[7]}" "alex-devbox" "LINUX" "Debian 12" "PF9ZYXWV" \
+  DISK_ENCRYPTION:FAIL SCREEN_LOCK:PASS FIREWALL_ENABLED:PASS TIME_SYNC:PASS \
+  OS_VERSION:UNKNOWN AUTO_UPDATE:PASS PASSWORD_POLICY:PASS REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:NOT_APPLICABLE > /dev/null
+
+seed_device "${PROFILE_IDS[3]}" "david-surface" "WINDOWS" "Windows 11 23H2" "5CD1234ABC" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:PASS FIREWALL_ENABLED:PASS TIME_SYNC:FAIL \
+  OS_VERSION:PASS AUTO_UPDATE:PASS PASSWORD_POLICY:PASS REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:PASS > /dev/null
+
+seed_device "${PROFILE_IDS[2]}" "sofia-latitude" "WINDOWS" "Windows 11 22H2" "5CD9876ZYX" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:PASS FIREWALL_ENABLED:FAIL TIME_SYNC:PASS \
+  OS_VERSION:FAIL AUTO_UPDATE:FAIL PASSWORD_POLICY:PASS REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:UNKNOWN > /dev/null
+
+# 1 pending device: created and assigned, but never enrolled/activated.
+create_device "${PROFILE_IDS[6]}" > /dev/null
+
+# 1 revoked device: fully activated, then revoked.
+revoked_id=$(seed_device "${PROFILE_IDS[5]}" "james-old-macbook" "DARWIN" "12.7" "C02OLD1JGH9" \
+  DISK_ENCRYPTION:PASS SCREEN_LOCK:PASS FIREWALL_ENABLED:PASS TIME_SYNC:PASS \
+  OS_VERSION:FAIL AUTO_UPDATE:FAIL PASSWORD_POLICY:PASS REMOTE_LOGIN:PASS \
+  MALWARE_PROTECTION:PASS)
+revoke_device "$revoked_id"
+
+echo "    8 devices created (6 active, 1 pending, 1 revoked)"
+
 echo ""
 echo "Seed complete!"
 echo "  Email:    $EMAIL"
@@ -707,6 +914,7 @@ echo "    35 risks"
 echo "    20 third parties"
 echo "    15 measures"
 echo "    8 people"
+echo "    8 devices (6 active, 1 pending, 1 revoked)"
 echo ""
 echo "  To use the CLI:"
 echo "    export PROBO_HOST=$BASE_URL"