D4 — First-run wizard that presents the ceremony rather than skipping it

[eaitbrahim]

PRD §B4.

The problem

First run today is ~10 CLI invocations plus hand-edited YAML (docs/go-live-runbook.md): keel init/migrate, edit config.yaml, assets attest, assets attest-instrument, subscription attest, withdrawals attest, promote a rule through the ladder, run one confirm-mode cycle, verify the fill against the exchange UI, then optionally autonomy on.

What can and cannot be automated

Mechanical — automate: config creation from template, DB creation and migration, credential capture, first candle fetch.

Human judgement — present, never decide: every Shariah attestation is a human-supplied classification with a required source, and an unsourced attestation is refused exactly like a missing one (compliance/screen.py:84-127). The wizard collects and records them; it must not default them.

Outside keel entirely — cannot automate: disabling Coinbase USDC Rewards and Alpaca stock-lending/cash-sweep interest, done in the venue's own dashboard because that interest is riba and no rail can observe it (docs/operator-runbook.md:25-50, 590-602). The wizard can show a checklist and require acknowledgement; it cannot verify.

Scope

• Detect missing state → run the wizard.
• Credentials via the OS keychain (keyring wraps macOS Keychain and Windows Credential Manager), not a plaintext .env. Keep .env supported for existing deployments.
• Migrations run idempotently on every start, not only first run, so upgrades self-heal.
• Default to paper mode. Hummingbot's paper trading needs no exchange API keys at all, which makes it the only thing a new user can do first — the strongest safety default in the category, and the right one for a tool whose measured result is that no rule family is net-positive.

Acceptance

• A user with no prior state reaches a working paper deployment without typing a command.
• No attestation is ever recorded without a human-entered source.
• Reaching live mode requires passing every gate the runbook lists, in order, with the venue-side checklist explicitly acknowledged.