{
  name        = "fleet_base",
  version     = "0.1.0",
  description = "Base fleet node setup: fleet age key, OCI registry auth, sccache env. Must run before any other taskserv. Establishes /etc/fleet/age.key so SOPS-aware components can decrypt secrets at runtime without operator involvement.",
  tags        = ["base", "sops", "age", "registry", "sccache", "fleet"],
  modes       = ["base_setup"],
  dependencies = [],
  provides    = [{ id = "fleet-base", version = "0.1", interface = "fleet-base" }],
  requires    = [
    { capability = "vm-lifecycle", kind = 'Required },
    { capability = "ssh-access",   kind = 'Required },
  ],
  conflicts_with = [],
  best_practices = ["fleet-key-per-workspace", "sops-runtime-decrypt"],
}