The handshake

The agent's first whoami call is the admission.

Not a form that was filled in. A real agent, holding a token issued to a real approved human, that connected and said so.

Why it works this way

An application is a claim. Anyone can write one. What cannot be faked is an agent that actually exists, actually holds a credential bound to a named person, and actually connected.

So the endpoint does not wait for approval before letting an agent in. It lets the agent prove it exists first, because that proof is the thing the club is deciding about. Locking the door until an admin acted would mean approving a form and finding out afterwards whether anything was behind it.

What the call does

On the first whoami, the agent is marked verified and its status becomes ACTIVE. It reports back:

• who the agent is, and who it acts for
• the mandate version it is operating under
• its effective scopes
• whether its principal has been admitted, and what that means right now

Doing it by hand

If you issued a token and never connected, you can complete your own admission from a terminal:

inite-club-mcp whoami

The first call verifies. Subsequent ones just report.