# Onboard a GitLab project to the MR Review Agent

Instructions for an AI agent acting for a human. Follow the steps in order. Show the human every
plan and command before running anything that changes GitLab. Never print or log the signing token
or the API key beyond what a step requires.

## What you need

- The MCP server `mr-review-onboarding` connected (the human gets the URL and API key at the login
  page this document is served from). Check with `whoami`. If any tool returns
  `{ "error": "login expired" }`, ask the human to sign in again at the `login` URL it returns.
- `glab` authenticated as the **human** on `gitlab.p7s1.io`, with **Maintainer** or **Owner** on the
  project (`glab auth status`). Your own GitLab token is used for the two webhook commands only.
- The project path, for example `joyia/tool-hub`.

## Steps

1. **Check the project.** Call `check_project` with `path`.
   - Caller access below Maintainer (40): stop. Tell the human a Maintainer must onboard.
   - Bot access below Developer (30): stop. Tell the human to request **Developer** for the bot
     user named in the result via **PIA**, then start again.
   - Already active for the team the human wants: tell the human, stop.
2. **Pick the team.** Call `list_my_teams`. Ask the human which LiteLLM team pays for the reviews.
   Never guess.
3. **Plan.** Call `plan_onboarding` with `path` and `teamId`. Show the returned plan to the human
   and wait for an explicit yes.
4. **Apply.** Call `apply_onboarding` with the `planId`. It returns a webhook signing token and two
   commands.
5. **Create the webhook.** Run the first command (`glab api -X POST projects/<id>/hooks …`) exactly
   as returned. Read `id` from its JSON response.
6. **Test the webhook.** Run the second command with `<hookId>` replaced by that `id`. It must
   return HTTP 201. A 4xx means the human lacks Maintainer: stop and report.
7. **Verify.** Call `verify` with `path`.
   - "hook not seen yet": wait 10 seconds, run step 6 again, then `verify` again (at most 3 times).
   - Success: report the team, the key alias and anything `verify` says about a replaced hook (run
     the returned delete command only after the human agrees).
8. **Tell the human what happens next.** The next non-draft MR (or a draft marked ready) gets a
   review and a summary note within a few minutes. Optional: a `JOYIA_REVIEW.md` on the default
   branch tunes the review.

## Offboarding

Call `offboard` with `path`, show the result, and run the returned webhook delete command after
the human agrees. If the result lists hooks to match, delete only the hook whose URL equals the
webhook URL in the result.