Use email OTP signup in onboarding skill

[mnvsk97]

Summary

• Updates the onboarding skill to support creating a tenant via email OTP from the terminal session.
• Calls the hosted registration service by default, with TFY_REGISTRATION_SERVER_URL as an override.
• Sends x-truefoundry-registration-source: skills so backend metadata records signup source.

Scope

Only the onboarding skill instructions changed. Other skills are untouched.

Validation

• git diff --check
• ./scripts/validate-skills.sh
• ./scripts/validate-skill-security.sh

---

Note

Medium Risk
Updates onboarding instructions to perform tenant signup via terminal-based OTP using curl, which introduces a new external API call flow and handling of user email/OTP values. Impact is limited to the truefoundry-onboard skill documentation/allowed-tools, but mistakes could break onboarding or leak sensitive inputs in command history.

Overview
The truefoundry-onboard skill now supports creating a new TrueFoundry tenant from the session via email OTP, in addition to accepting an existing tenant URL.

It adds curl as an allowed tool and documents calling the hosted registration service (overrideable via TFY_REGISTRATION_SERVER_URL) to initiate/complete OTP signup, extract TENANT_URL from the response, and then run tfy login using that URL.

^{Reviewed by Cursor Bugbot for commit 704d248. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 60b4f74. Configure here.}