CON-1584: Surface host account and CLI/API/SDK docs - #2

…lace-install

docs(agents): use marketplace install flow for agent plugins

…I content

- Remove host content from the renter notifications guide and account settings
- Add host/notifications page for host machine, verification, and maintenance events
- Add shared notification-channels snippet used by both renter and host pages
- Reference the Notifications API from the webhooks guide instead of inlining curl/JSON
- Drop the duplicate top-level Notifications API nav group (now only under Endpoints)
- Harmonize signature-verification code and fix wording/naming consistency

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Adding New Notifications Documentation with Webhook workflow examples

Explains that cancelling early claws back the discount received plus
a 5% fee, and corrects the worked example's math to match.

…math

…example

Docs/reserved refund fee example

…-sdk

# Conflicts:
#	docs.json

…seams

- self-test-reference: anchors for every quick-table error family
  (reliability, auth-error, direct-ports, bandwidth, insufficient-resources,
  system-requirements) so CLI errors and support replies can deep-link
- how-to-self-test: fix 7 GiB -> 7 GB drift (CLI gate is decimal GB,
  vast.py:9549) and defer to verification-stages as the canonical gate list
- machine-errors: mark self-test-reference as canonical for nccl_failed and
  machine-not-rentable to remove duplicate retrieval targets
- installing-host-software: anchored identify-4xx section with the concrete
  root causes (fresh-key guidance per Hanran's 2026-06-16 corrections)
- hosting-overview <-> quickstart now cross-linked; quickstart gains the
  Earn step; account page sidebar renamed Account & Agreement to stop
  colliding with Reference's Hosting Agreement
- merge main: slot host/notifications into Operate with persona chips;
  reorder Verify & List so optimization-guide follows listing tasks

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…eference

- common-errors-diagnostics: the six stacked legacy anchors now land on a
  routing list that jumps to the canonical machine-errors entries
- CLI self-test snippet: link failures to Self-Test Reference / Machine
  Error Reference, closing the CLI-docs side of the deep-link loop

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/check_persona_chips.py verifies that personas: frontmatter and the
visible persona-chips div stay in sync on every authored host page
(slug->label mapping, all-four collapse to 'All host personas', order-free
membership; generated cli/sdk pages exempt). Run with:

  npm run check-persona-chips

Closes the last accepted-risk item from the CON-1518 IA audit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

REVIEW-QUESTIONS.md (GitHub-linkable, commentable in the PR diff) and a
hidden /review-questions preview page (annotatable via the review kit,
answers land in the same feedback export). Both temporary review aids,
removed before merge. Reviewers previously had no pointer from the
roadmap's '8 inputs' to the actual questions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The overlay panel footer and the /__review__/ status page now point to
/review-questions so reviewers discover the questions inside the kit,
not only via the PR description or roadmap.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cut six steps to four and 205 lines to 171. The page is about disabling
password login, so the editor instructions, the config state table, the
specific key copy and its duplicate login test, and the long explanation of
sshd -t are gone.

Step 3 is now one command that rewrites every config file that sets
PasswordAuthentication, with editing by hand kept as a short alternative.
This replaces the sed one liner, which anchored on ^PasswordAuthentication
and so skipped indented directives inside a Match block while the text told
the reader every remaining line was fixed. It also never touched
/etc/ssh/sshd_config itself.

Back up with cp -n before editing, instead of sed -i.bak. sed -i.bak
overwrites the backup on every run, so a host who ran step 3 twice silently
lost the original and the recovery section then restored files that already
said no. Recovery restores .orig and puts back the drop ins too, since
restoring only sshd_config leaves password login off.

Also flag the placeholders in step 2, and move the ordering warning next to
the step 3 commands rather than leaving it only at the top.

Verified on Ubuntu 22.04 and 24.04 containers with openssh-server: each
command run in order, password login refused afterwards, key login still
working, and the recovery path confirmed to restore access.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…-login

Add guide for disabling SSH password login

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…g-requirements

Host verification: kernel, driver, and SSH key requirements

… reference (vast-ai#934)

Hosts are responsible for keeping the kernel at the latest patch level for
their LTS release, but there was no guide for doing it. Adds a walkthrough
that queries the installed kernel metapackage rather than assuming
linux-generic, since passing a metapackage that isn't installed exits 0
while patching nothing.

Covers the maintenance window and reboot requirements, verifying the new
kernel actually booted, and recovery when GRUB boots the old kernel or the
machine doesn't come back.

Adds a Maintenance nav group for the page and links it from the kernel
patching requirement in the verification stages.

A reboot stops the instances running on a machine; it does not destroy them.
The warnings overstated the impact. The maintenance window guidance stands,
since a stop still interrupts renter workloads.

Step 1 picked one metapackage with `sort | tail -1`. Lexical order selects
`linux-generic-hwe-22.04-edge` over `linux-generic-hwe-22.04`, and `sort -V`
picks it too, so switching sorts is not a fix. The two are separate stacks with
their own image and headers rather than one superseding the other, so patching
a single name leaves the other on its old kernel. Steps 1 through 5 now carry
every installed metapackage and upgrade them together, which also makes the
sort consistent with the `sort -V` already used on /boot.

The GRUB diagnosis read only /etc/default/grub. grub-mkconfig sources that file
first and then /etc/default/grub.d/*.cfg, so a drop-in wins and the grep can
report a value that is not in effect. Resolve GRUB_DEFAULT the way
grub-mkconfig does, and point at the file that sets it before editing.

The backup used a plain `cp`, so a second run overwrote the original with the
already-edited file. Take it only when one is not there.

Absence of the new kernel from `update-grub` output was described as something
`update-grub` fixes, but that output is from the run just made. Send the
operator to check /boot instead, and stop them short of a reboot that would
reproduce the failure.

Hosts that already keep every package current can patch the kernel with
apt-get upgrade rather than the targeted metapackage steps, and that route also
works on non-generic flavours where step 1 matches nothing.

--with-new-pkgs carries the whole thing. A kernel upgrade pulls in new
versioned packages, and apt-get(8) is explicit that plain upgrade will not
install packages that are not already present, so it holds the kernel back and
the machine reboots onto the kernel it was already running. The same page notes
--with-new-pkgs never removes a package, which is what makes it safe to
recommend over dist-upgrade.

The path is labelled as a full system upgrade rather than a kernel one, and
says what accepting it means: everything with an update available moves in the
same window, service restarts included, so a machine that misbehaves afterwards
has the whole upgrade behind it rather than one change.

Carries the verification one-liner, since nvidia-smi cannot stand in for it.
A machine that booted the old kernel still has the DKMS module built for that
kernel, so every GPU is listed on a machine that never took the patch.

Scopes the intro and the opening note, which promised the guide left the rest
of the system alone.

linux-aws and linux-lowlatency were the wrong examples for a bare-metal GPU
fleet: the aws and azure flavours are cloud-image kernels. linux-oem-22.04
ships on certified OEM hardware and linux-nvidia is the NVIDIA flavour, both of
which exist within the two Ubuntu releases the platform supports.

The page was eight flat h2 sections, so the two routes it offers were not
distinguishable from the steps within them and the right-hand contents list was
eight ungrouped entries. It now has three top-level sections: the full system
upgrade, the kernel-only upgrade with its five steps nested beneath it, and
recovery.

Recovery stays top level rather than nesting under the kernel-only steps.
Both paths end in a reboot and either can hit these failures, so nesting it
would imply it only applies to the numbered steps.

The intro names both paths, and prose that referred to "the numbered steps"
now names the section it means. Anchors are unchanged, since they derive from
heading text rather than level.

The warning leaned on `24 not upgraded` from step 3 of the kernel-only path,
which the reader has not reached yet, and named Docker, containerd and libvirt
as packages the upgrade would move. Some of those are held on a host machine,
so the claim was not reliable.

States the scale generally instead, and asks the reader to take the path only
if they know what it changes and can repair the machine themselves.

Add host guide for upgrading the kernel

Disabling SSH password login is a hardening task a host does once, not a
response to a broken machine, so it sits better beside the kernel upgrade
guide than next to Offline Machine.

Nav only. The URL comes from the file path, so the page keeps its address and
the link to it from verification-stages still resolves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Move the SSH password login guide under Maintenance