[guidovizoso]

What this changes

Intelligence 0.16.0 lets a project's runtime key create a Learning container in its own project (POST /api/v1/learning/containers, idempotent by id). Until now OpenBot could not do that with the key it holds, so it tried a CLI login, a service token or a browser sign-in. This PR makes the server create the openbot default and each person's own Learning space with the runtime key, and removes the rest.

Removed

• The CopilotKit CLI login path: finding a login on the machine, listing projects, matching the key's organization and project by name and slug, and creating from a scratch directory.
• The service token: INTELLIGENCE_SERVICE_TOKEN with INTELLIGENCE_PROJECT_ID, in config, the server and the chart.
• The Helm chart's Learning setup Job, config.learning.setup.cliLoginSecret / serviceTokenSecret / projectId, their validation, and the CI step that rendered the Job.
• The Learning step scripts/start.sh ran on every start (the server now does it at boot).
• The check that a newly created container was not in another project. A key can only create in its own project, so this can no longer happen.

Simplified

• The existence probe reads the container (GET /api/v1/learning/containers/:id) instead of inferring it from the skills read's error codes. The key no longer works out its own project from a dashboard link.
• scripts/setup-learning.ts: with a key, it creates the container with that key. Fresh managed setup creates it with the key it just provisioned. Fresh self-hosted setup still signs in through the browser, because that is what mints the key, and the desktop app uses that path.
• server/src/learning/ensure-container.ts goes from 800 lines to about 300, of which about 100 are the CLI helpers the other setup scripts still share.

On an Intelligence older than 0.16.0, the log and Admin → Automatic Learning say to upgrade, or to create a container with ID openbot by hand.

Do not merge until production Intelligence runs 0.16.0. Hosted OpenBot talks to managed Intelligence, which is on 0.15.1 today, and has no route that lets a key create a container. The bundled chart and the desktop app already ship 0.16.0-rc.7.

Overlap with #987: both PRs change the Learning-credentials block in server/src/index.ts and the service-token config in server/src/config.ts. Whichever merges second resolves a small conflict there. This PR changes server/src/learning/personal-space.ts only enough to drop the removed check, because #987 rewrites that file.

Where it runs

• New state that outlives a request? None. The container lives in Intelligence, as before.
• What happens on the second replica? Every replica may create openbot or a person's space at once. Intelligence answers 200 (or 409 LEARNING_CONTAINER_ALREADY_EXISTS) to all but the first, and those count as present. The assignment is still the existing conditional insert, so one replica wins.
• Anything serialised? Container ids are unique per Intelligence project, and creation is idempotent by id.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? None. The chart loses one Job.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. A failed creation is logged once as learning-auto-assign / create_failed, as before.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

• Against a local Intelligence 0.16.0-rc.2 stack: probing openbot returns present; a new container is absent, then created; creating it again returns present; probing it then returns present. A fresh OpenBot on that stack created and assigned openbot by itself at start (learning-auto-assign → assigned).
• Tests:
  • bun test over server/tests/learning*, server/tests/config.test.ts, scripts/setup-learning.test.ts, scripts/self-hosted-learning.test.ts, scripts/start-restart-guard.test.ts, scripts/setup-composio.test.ts and app/tests/learning-admin.test.tsx: all pass.
  • After merging main (Intelligence 0.16.0-rc.7 bundled): the same files plus server/tests/learning-mastra.test.ts, server/tests/learning-langgraph.test.ts and tests/chart-bundled-intelligence.test.ts, 480 pass, 0 fail.
• bun run lint, format:check, typecheck, typecheck:tests (one baseline entry this change fixed is dropped) and build pass.
• helm template plus scripts/check-rendered-chart.ts pass on all six CI targets. Rendering with the old config.learning.setup.* values set still succeeds; they are ignored.