a member's claude is their own binary and their own login

First half of per-user Claude. Provisioning and the privilege drop, not yet
wired to a turn — the chat gates stay up and behaviour is unchanged for
everyone. Committed unfinished on purpose so the reasoning is on the record
before the server agent runs any of it; the state is written up in
COMMS/sidecar-app-store/2026-08-11-per-user-claude-handoff.md.

THE CLAIM THAT CHANGED. docs/per-user-linux-accounts.md:226-229 says the Agent
SDK "has nowhere to put a uid", so a member's turn has to become its own
process — a change of shape rather than a flag. It is a flag:
sdk.d.ts:951 exposes spawnClaudeCodeProcess, documented for exactly this ("run
Claude Code in VMs, containers, or remote environments"), and node's spawn
already satisfies the SpawnedProcess shape it wants. So no second sidecar, no
PM2 entry, no inverted transport, and none of the registry rework a second
instance would have forced (registration is name-keyed and evicts its
namesake; the nine claude verbs resolve by capability with no selector).

THE PLATFORM NEVER RUNS AS A MEMBER. The tempting reading of "each member runs
their own Claude" is a second officer-agent under their uid, and it is wrong:
that sidecar needs POSTGRES_URL and the JWT signing secret, so a member-uid
process holding them could read every account and sign a token as the owner —
strictly more than their shell can do, and already forbidden by the .env boot
check. The harness stays the service user's; the thing that runs the member's
code and holds the member's credential is theirs. That is the pty sidecar's
shape, not a new one.

PER-MEMBER BINARY, deliberately, over one shared /usr/local/bin/claude. The
private part is the credential, not the executable — but claude updates itself,
and a root-owned binary is one a member cannot update, which turns "my agent is
a version behind" into a request to the owner. Same installer the owner's own
install uses, run as them, in their home. Idempotent by skipping when present
rather than re-running: the retry button reprovisions on every press.

ALLOWLIST, NOT A FILTER, for the child's environment. At the moment of the call
the calling process holds POSTGRES_URL, the JWT secret and the owner's
ANTHROPIC_API_KEY; setpriv --reset-env means nothing crosses unless written
into the argv, so an allowlist is the complete answer to what a turn can see,
and a denylist would have to be right about every variable added later.
NEVER_ENV throws rather than leaks if someone widens it.

Login is the member's own act against their own account. The platform cannot do
it for them and must not try — the alternative is lending them the owner's
credential. claudeLoginState only reports whether the credential has appeared,
and reads it as the member, so a true answer means their process can reach it.

NOT VERIFIED: any of it at runtime. tsgo passes; nothing has been provisioned
and the spawn hook has never been called. If it turns out setpriv breaks how
the SDK reaches the process, this approach is wrong and the fallback is the
earlier plan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/users/provision-os.ts

@@ -2,6 +2,7 @@ import { updateUser } from 'officerdb';
 import { OS_USERS_ENABLED, ensureOsUser, osUserHome } from '@@/os-user';
 import { provisionSshAccess } from '@@/os-user-ssh';
 import { seedShellConfig } from '@@/os-user-shell';
+import { provisionClaudeCli } from '@@/os-user-claude';
 import { provisionRootlessDocker } from '@@/os-user-docker';
 import { provisionUserDirs } from '@@/data-path';
 
@@ -73,6 +74,13 @@ export async function provisionOsAccount(params: {
   // work, the terminal opens; it just opens with zsh's bare defaults.
   const shell = await seedShellConfig({ email: params.email, uid: account.uid, gid: account.gid });
 
+  // Their own `claude`, in their own home. After the shell because it installs into a home that is not ours
+  // until `ensureOsUser` has chowned it away, and because the installer wants a working HOME.
+  //
+  // Only the binary. Logging in is the member's own act against their own Anthropic account — the platform
+  // cannot do it for them and must not try, because the alternative is lending them the owner's credential.
+  const claude = await provisionClaudeCli({ email: params.email, osUser: account.osUser });
+
   // Their own rootless Docker daemon. Last, and the most tolerant of failure: a host without the uidmap
   // package or a kernel that will not do rootless still gets a perfectly good account, minus containers.
   //
@@ -93,9 +101,17 @@ export async function provisionOsAccount(params: {
   // Reported in order of consequence, not in order of execution: no keys matters more than a plain prompt,
   // which matters more than no containers. Only one is surfaced because the UI shows one line — the rest are
   // in the log.
-  for (const step of [shell, docker] as const) {
+  for (const step of [claude, shell, docker] as const) {
     if (!step.ok) console.warn(`[users] ${params.email}: ${step.error}`);
   }
-  const error = !ssh.ok ? ssh.error : !shell.ok ? shell.error : !docker.ok ? docker.error : null;
+  const error = !ssh.ok
+    ? ssh.error
+    : !claude.ok
+      ? claude.error
+      : !shell.ok
+        ? shell.error
+        : !docker.ok
+          ? docker.error
+          : null;
   return { osUser: account.osUser, sshPublicKey, error };
 }