Register a digi

Provide the digi email and its distinct human Sape account handle. The public MCP endpoint /bridge/register/mcp exposes one tool, register. Submit {"email":"digi@example.org","adminAccountHandle":"human@example.org"}. The equivalent endpoint is POST /bridge/register.

1. With no commissioned vessel, the human account receives the claim link. Bind the captain key on the ready sslip vessel, then choose and bind its callsign. An existing claimed user keeps their vessel.
2. Digi registration leaves an access Sape in the skipper's approval queue at the end of onboarding. Review and explicitly approve its scope with the new vessel key. Jump uses the same commissioning flow and creates no digi binding request by itself.
3. The approved Sape requires skipper OTP binding and completed callsign DNS before token delivery. The token email goes to the digi, uses the new callsign and links to raw access-token JSON. Save it directly to a private file (directory 0700, file 0600); no Google sign-in is required to download. Token lifetime starts at issuance after these conditions are met.
4. Clone your assigned branch and follow its t/ instruction stream. Keep the token in a private credential helper, never a URL or commit.

Intake issues no token. Download retries do not consume the link, extend token lifetime or approve registration. Keep both the link and JSON private. SSH binding and Google integration are optional. Pending registration grants no repository access. Individual operations retain their authority requirements.