> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tetryx.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Runner Enrollment

> How runners obtain credentials to connect to the Lynx platform

<Warning>
  Runner enrollment is not yet implemented. This page describes the planned model.
</Warning>

## Enrollment flow

When enrollment is live, connecting a new runner will follow this flow:

1. Install `lynx-runner` on your hardware or cluster
2. Start the runner with a bootstrap credential (provided by Tetryx during onboarding)
3. The runner exchanges the bootstrap credential for short-lived connection credentials
4. The runner connects to the Lynx platform and begins polling for jobs
5. Credentials refresh automatically — no restarts required

## Bootstrap options

| Environment     | Bootstrap method                            |
| --------------- | ------------------------------------------- |
| Kubernetes      | Kubernetes service account token            |
| Bare metal / VM | x509 client certificate or enrollment token |
| Any             | One-time enrollment token issued by Tetryx  |

## Credential lifetime

* Credentials are short-lived (minutes to hours, not months)
* Runners refresh credentials automatically before expiry
* Revoked runners are denied refresh and disconnected cleanly

## Revoking a runner

If a runner is compromised or decommissioned, contact Tetryx to revoke its credentials. The runner will be unable to reconnect once revoked.

## Capability-based access

Runner credentials are scoped to the capabilities you declare at enrollment. A CPU-only runner will not be issued credentials to pick up GPU-only jobs, and vice versa. This is enforced at the platform level, not just by convention.