The eight-minute quickstart

The shortest safe path ends with a customer-owned mock call. It does not require a provider key, spend money, or promote a feature to live.

Minute 0–1 — sign in. Run weirgate auth login. Review the tenant, test environment, app bounds, tool groups, expiry, and propose scope in the browser. The CLI stores the reveal-once grant in macOS Keychain.
Minute 1–2 — inspect. Run weirgate auth status, list visible apps, and read readiness for the target app. MCP users start with weirgate_whoami.
Minute 2–4 — propose. Define the app authentication contract, tiers, and mock features against the current config revision. A feature owns routing, model, output ceiling, unit cost, and key policy; callers select only its stable feature ID.
Minute 4–5 — review and apply. Read the proposal diff, validation, impact, base revision, and expiry. A human applies it with an apply-scoped test grant. Never bypass the proposal workflow.
Minute 5–6 — prove the control plane. Run the explicit auth doctor check and the deterministic success sandbox fixture. Rehearse the typed-error fixtures relevant to the integration.
Minute 6–7 — wire the request. Obtain the generated HTTP snippet or use an official SDK. Supply a fresh end-user JWT, X-App-Id, stable X-Feature-Id, and a per-action X-Idempotency-Key.
Minute 7–8 — make the app-owned mock call. Send it from the integrating app, retain the request ID, then read usage, the user timeline, readiness, and audit attribution.
After the timer — promote deliberately. Enter provider credentials only through the local browser or hidden-stdin ceremony, rerun doctor, and use a separate reviewed proposal to move the feature to live.

weirgate init --app <app-id> orchestrates the public readiness steps; it is not a privileged shortcut. Config propagation can take up to 30 seconds, so retry a typed resource_not_found within that documented window instead of changing the proposal.

Do not promote a feature until mock success and the required typed-error fixtures pass.