Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/NODE_AGENT.md

@@ -19,6 +19,34 @@ different site work without inbound exposure.
 
 ## Enrolling
 
+For the v1.3.0 RC, an administrator can use **Console → Hardware → Enroll node**. The wizard offers
+5-minute, 15-minute, 1-hour, and 24-hour token expiry, and locks the node's API origin to the
+Console's current API origin. RC enrollment always sets `production_eligible=false`. The one-time
+token is held only in the open wizard's component memory; closing the wizard, checking readiness,
+revoking the unused token, or reaching its expiry clears the reveal. The generated `.env` contains
+only non-secret settings. Paste the start command into a Bash shell from the node-agent repository;
+it disables shell tracing, reads the token without echo, uses a temporary mode-0600 env file, and
+removes that file on exit, including error and signal paths.
+
+Use **Check node readiness** after starting the agent. Readiness is tied to the exact node ID returned
+by the enrollment record; it checks connection, inventory age, protocol compatibility, agent health,
+and telemetry age and includes diagnostic next steps. After enrollment is consumed, use the wizard's
+container recreation command to remove the one-time token from the running container environment
+while preserving its persisted identity and credential. A node is not ready merely because it
+connected.
+
+The API flow below remains available for automation and existing installations.
+
+The RC wizard defaults to the local four-image release bundle. Verify the release `SHA256SUMS`, load
+`modelforge-1.3.0-rc.1-images.tar` on the node with `docker image load`, and paste
+`images.modelforge-node-agent` from the matching release manifest. The wizard requires the exact
+`modelforge-node-agent:1.3.0-rc.1` tag, RootFS layer list, architecture, and all recorded OCI labels.
+It ignores the build-host image/config ID because Docker may rewrite it during `docker load`; before
+Compose starts it captures the local image ID and verifies the created container uses that same ID.
+Start and cleanup use `--no-build --pull never`, and the generated configuration sets the local tag
+explicitly. A registry image pinned to `@sha256:<digest>` remains available as an alternate mode.
+The source-build Compose workflow below is separate and intended for development.
+
 1. An operator mints a single-use token:
 
 ```bash
@@ -79,9 +107,13 @@ bounded diagnostic check that never enrolls is available as:
 ```bash
 docker run --rm --gpus all --network none \
   -e MODELFORGE_AGENT_ACCELERATOR_MODE=nvidia \
-  modelforge-node-agent:1.1.1 modelforge-node-agent --preflight
+  modelforge-node-agent:1.1.1 python3 -m modelforge_node_agent.main --preflight
 ```
 
+The chiselled runtime intentionally contains no shell or packaging-script directory. Invoke the
+reviewed Python module directly for this bounded diagnostic, just as the image's default command
+does.
+
 ## Identity
 
 A node's identity is persisted and survives restarts. If a node reappears as a *new* identity, its