[{"data":1,"prerenderedAt":3443},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fadmin\u002Fcredential-injection":1849,"docs-surround:\u002Fadmin\u002Fcredential-injection":3438},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1651,"body":1851,"description":3429,"extension":3430,"links":3431,"meta":3432,"navigation":3435,"path":1652,"seo":3436,"stem":1653,"__hash__":3437},"docs\u002F09.admin\u002F03.credential-injection.md",{"type":1852,"value":1853,"toc":3410},"minimark",[1854,1858,1861,1875,1883,1888,1896,2049,2066,2209,2214,2224,2242,2249,2265,2269,2272,2370,2380,2384,2391,2516,2519,2570,2573,2597,2620,2624,2631,2740,2758,2777,2781,2785,2818,2833,2836,2844,2848,2855,2858,2861,2865,2872,2887,2891,2901,2905,3017,3020,3023,3030,3034,3037,3069,3197,3201,3204,3223,3231,3235,3238,3305,3308,3340,3358,3361,3376,3382,3386,3406],[1855,1856,1857],"p",{},"For: cluster and tenant administrators.",[1855,1859,1860],{},"Bind a credential to the host that should receive it. Check the applicable node and tool types before relying on the proxy to keep values out of a plugin process.",[1855,1862,1863,1864,1869,1870,1874],{},"A plugin's tool server gets its secrets as values: in its environment, or on a ",[1865,1866,1868],"a",{"href":1867},"\u002Fadmin\u002Fsecrets\u002Fplugin-secrets#secrets-on-a-file-descriptor","file descriptor",". Whatever runs in it, a dependency or code a model talked it into running, can then read the value and send it anywhere its ",[1865,1871,1873],{"href":1872},"\u002Fconcepts\u002Fsecurity\u002Fegress#the-egress-proxy","egress"," allows, even encoded in a URL.",[1855,1876,1877,1878,1882],{},"A credential binding keeps the value out of the process: the process holds a placeholder, and the node's egress proxy puts the real value on requests to the one host the binding names. The host gets the value, so it must be a host you trust with it: see ",[1865,1879,1881],{"href":1880},"\u002Fadmin\u002Fcredential-injection#what-a-bound-host-must-not-do","what a bound host must not do",".",[1884,1885,1887],"h2",{"id":1886},"bind-a-plugins-own-secret","Bind a plugin's own secret",[1855,1889,1890,1891,1895],{},"A plugin binds the secrets it holds in its manifest, under ",[1892,1893,1894],"code",{},"requires.inject",":",[1897,1898,1903],"pre",{"className":1899,"code":1900,"filename":1727,"language":1901,"meta":1902,"style":1902},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","requires:\n  secrets: [WEATHER_TOKEN]\n  inject:\n    WEATHER_TOKEN:\n      - host: api.weather.example\n        header: Authorization\n        format: \"Bearer {secret}\"\n        methods: [GET]\n        path_prefix: \u002Fv2\n        shape: \"wx_{32}\"\negress: [api.weather.example]\n","yaml","",[1892,1904,1905,1918,1936,1944,1952,1966,1977,1994,2009,2020,2035],{"__ignoreMap":1902},[1906,1907,1910,1914],"span",{"class":1908,"line":1909},"line",1,[1906,1911,1913],{"class":1912},"swJcz","requires",[1906,1915,1917],{"class":1916},"sMK4o",":\n",[1906,1919,1921,1924,1926,1929,1933],{"class":1908,"line":1920},2,[1906,1922,1923],{"class":1912},"  secrets",[1906,1925,1895],{"class":1916},[1906,1927,1928],{"class":1916}," [",[1906,1930,1932],{"class":1931},"sfazB","WEATHER_TOKEN",[1906,1934,1935],{"class":1916},"]\n",[1906,1937,1939,1942],{"class":1908,"line":1938},3,[1906,1940,1941],{"class":1912},"  inject",[1906,1943,1917],{"class":1916},[1906,1945,1947,1950],{"class":1908,"line":1946},4,[1906,1948,1949],{"class":1912},"    WEATHER_TOKEN",[1906,1951,1917],{"class":1916},[1906,1953,1955,1958,1961,1963],{"class":1908,"line":1954},5,[1906,1956,1957],{"class":1916},"      -",[1906,1959,1960],{"class":1912}," host",[1906,1962,1895],{"class":1916},[1906,1964,1965],{"class":1931}," api.weather.example\n",[1906,1967,1969,1972,1974],{"class":1908,"line":1968},6,[1906,1970,1971],{"class":1912},"        header",[1906,1973,1895],{"class":1916},[1906,1975,1976],{"class":1931}," Authorization\n",[1906,1978,1980,1983,1985,1988,1991],{"class":1908,"line":1979},7,[1906,1981,1982],{"class":1912},"        format",[1906,1984,1895],{"class":1916},[1906,1986,1987],{"class":1916}," \"",[1906,1989,1990],{"class":1931},"Bearer {secret}",[1906,1992,1993],{"class":1916},"\"\n",[1906,1995,1997,2000,2002,2004,2007],{"class":1908,"line":1996},8,[1906,1998,1999],{"class":1912},"        methods",[1906,2001,1895],{"class":1916},[1906,2003,1928],{"class":1916},[1906,2005,2006],{"class":1931},"GET",[1906,2008,1935],{"class":1916},[1906,2010,2012,2015,2017],{"class":1908,"line":2011},9,[1906,2013,2014],{"class":1912},"        path_prefix",[1906,2016,1895],{"class":1916},[1906,2018,2019],{"class":1931}," \u002Fv2\n",[1906,2021,2023,2026,2028,2030,2033],{"class":1908,"line":2022},10,[1906,2024,2025],{"class":1912},"        shape",[1906,2027,1895],{"class":1916},[1906,2029,1987],{"class":1916},[1906,2031,2032],{"class":1931},"wx_{32}",[1906,2034,1993],{"class":1916},[1906,2036,2038,2040,2042,2044,2047],{"class":1908,"line":2037},11,[1906,2039,1873],{"class":1912},[1906,2041,1895],{"class":1916},[1906,2043,1928],{"class":1916},[1906,2045,2046],{"class":1931},"api.weather.example",[1906,2048,1935],{"class":1916},[1855,2050,2051,2052,2054,2055,2058,2059,2062,2063,2065],{},"The server reads ",[1892,2053,1932],{}," as before and sends it as before (",[1892,2056,2057],{},"Authorization: Bearer $WEATHER_TOKEN","). What it holds is a placeholder such as ",[1892,2060,2061],{},"wx_9fK2…","; the proxy replaces it with the value on its way to ",[1892,2064,2046],{},", and only there.",[2067,2068,2069,2081],"table",{},[2070,2071,2072],"thead",{},[2073,2074,2075,2079],"tr",{},[2076,2077,2078],"th",{},"Field",[2076,2080],{},[2082,2083,2084,2099,2109,2130,2143,2156,2174],"tbody",{},[2073,2085,2086,2092],{},[2087,2088,2089],"td",{},[1892,2090,2091],{},"host",[2087,2093,2094,2095,1882],{},"A host name or a wildcard for one additional label, also allowed by plugin egress. See ",[1865,2096,2098],{"href":2097},"#host-patterns-and-public-suffixes","host patterns and public suffixes",[2073,2100,2101,2106],{},[2087,2102,2103],{},[1892,2104,2105],{},"port",[2087,2107,2108],{},"443 unless set",[2073,2110,2111,2120],{},[2087,2112,2113,2116,2117],{},[1892,2114,2115],{},"header"," and ",[1892,2118,2119],{},"format",[2087,2121,2122,2123,2126,2127,2129],{},"The header the value goes in, and its value with ",[1892,2124,2125],{},"{secret}"," once (default ",[1892,2128,2125],{},"). Connection headers (Host, Content-Length, Transfer-Encoding, …) cannot be set",[2073,2131,2132,2137],{},[2087,2133,2134],{},[1892,2135,2136],{},"basic_user",[2087,2138,2139,2140,2142],{},"Basic authentication as this user, with the value as the password (instead of ",[1892,2141,2115],{},")",[2073,2144,2145,2150],{},[2087,2146,2147],{},[1892,2148,2149],{},"query",[2087,2151,2152,2153,2155],{},"A query parameter (instead of ",[1892,2154,2115],{},"); lint warns, since servers and proxies log URLs",[2073,2157,2158,2167],{},[2087,2159,2160,2163,2164],{},[1892,2161,2162],{},"methods",", ",[1892,2165,2166],{},"path_prefix",[2087,2168,2169,2170,2173],{},"Narrow the requests the value goes on; a ",[1892,2171,2172],{},"*"," in the prefix matches within one path segment",[2073,2175,2176,2181],{},[2087,2177,2178],{},[1892,2179,2180],{},"shape",[2087,2182,2183,2184,2187,2188,2191,2192,2195,2196,2163,2199,2163,2202,2205,2206],{},"What the placeholder looks like, for a tool that checks a token's format before it sends it: letters, digits and ",[1892,2185,2186],{},"- . _ ~"," around one random part ",[1892,2189,2190],{},"{N}"," or ",[1892,2193,2194],{},"{N:hex}"," (also ",[1892,2197,2198],{},"lower",[1892,2200,2201],{},"upper",[1892,2203,2204],{},"base32",") of at least 128 random bits. Default ",[1892,2207,2208],{},"oz0ph_\u003CNAME>_{26:base32}",[2210,2211,2213],"h3",{"id":2212},"host-patterns-and-public-suffixes","Host patterns and public suffixes",[1855,2215,2216,2217,2220,2221,2223],{},"Use a host name, or ",[1892,2218,2219],{},"*.domain"," for exactly one label more. Addresses are refused. It must also be in the plugin's ",[1892,2222,1873],{},": a binding allows no host by itself.",[1855,2225,2226,2227,2163,2230,2233,2234,2237,2238,2241],{},"A wildcard over a public suffix (",[1892,2228,2229],{},"*.github.io",[1892,2231,2232],{},"*.co.uk",") is refused, and a wildcard never covers a host that is a public suffix beneath its domain or under one (",[1892,2235,2236],{},"*.amazonaws.com"," does not cover ",[1892,2239,2240],{},"s3.amazonaws.com","): such a host belongs to whoever registered it.",[1855,2243,2244,2245,2248],{},"SigV4 signing is the exception, since it sends only a signature for the very host: ",[1892,2246,2247],{},"*.s3.eu-north-1.amazonaws.com"," covers its buckets.",[1855,2250,2251,2254,2255,2259,2260,2264],{},[1892,2252,2253],{},"plugin lint"," refuses a binding of a secret the plugin's processes do not hold, of a ",[1865,2256,2258],{"href":2257},"\u002Fadmin\u002Fsecrets\u002Fsettings#settings-are-not-secrets","setting",", of a host outside its egress or an address. For a ",[1865,2261,2263],{"href":2262},"\u002Fadmin\u002Fcredential-injection#remote-tools","remote tool",", it warns when no binding names the tool's own server (it would get a placeholder there that nothing redeems), and when one request would carry two bindings' placeholders.",[1884,2266,2268],{"id":2267},"bind-a-tenant-secret","Bind a tenant secret",[1855,2270,2271],{},"A tenant admin binds any of the tenant's secrets, for every plugin whose processes get it:",[1897,2273,2277],{"className":2274,"code":2275,"language":2276,"meta":1902,"style":1902},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","oz0 tenant credential bind acme GITHUB_TOKEN --host api.github.com --header Authorization \\\n  --format 'token {secret}' --shape 'ghp_{36}'\noz0 tenant credential list acme\noz0 tenant credential unbind acme cb-4ade67ca80f44f15\n","bash",[1892,2278,2279,2315,2340,2354],{"__ignoreMap":1902},[1906,2280,2281,2284,2287,2290,2293,2296,2299,2302,2305,2308,2311],{"class":1908,"line":1909},[1906,2282,1714],{"class":2283},"sBMFI",[1906,2285,2286],{"class":1931}," tenant",[1906,2288,2289],{"class":1931}," credential",[1906,2291,2292],{"class":1931}," bind",[1906,2294,2295],{"class":1931}," acme",[1906,2297,2298],{"class":1931}," GITHUB_TOKEN",[1906,2300,2301],{"class":1931}," --host",[1906,2303,2304],{"class":1931}," api.github.com",[1906,2306,2307],{"class":1931}," --header",[1906,2309,2310],{"class":1931}," Authorization",[1906,2312,2314],{"class":2313},"sTEyZ"," \\\n",[1906,2316,2317,2320,2323,2326,2329,2332,2334,2337],{"class":1908,"line":1920},[1906,2318,2319],{"class":1931},"  --format",[1906,2321,2322],{"class":1916}," '",[1906,2324,2325],{"class":1931},"token {secret}",[1906,2327,2328],{"class":1916},"'",[1906,2330,2331],{"class":1931}," --shape",[1906,2333,2322],{"class":1916},[1906,2335,2336],{"class":1931},"ghp_{36}",[1906,2338,2339],{"class":1916},"'\n",[1906,2341,2342,2344,2346,2348,2351],{"class":1908,"line":1938},[1906,2343,1714],{"class":2283},[1906,2345,2286],{"class":1931},[1906,2347,2289],{"class":1931},[1906,2349,2350],{"class":1931}," list",[1906,2352,2353],{"class":1931}," acme\n",[1906,2355,2356,2358,2360,2362,2365,2367],{"class":1908,"line":1946},[1906,2357,1714],{"class":2283},[1906,2359,2286],{"class":1931},[1906,2361,2289],{"class":1931},[1906,2363,2364],{"class":1931}," unbind",[1906,2366,2295],{"class":1931},[1906,2368,2369],{"class":1931}," cb-4ade67ca80f44f15\n",[1855,2371,2372,2373,2116,2376,2379],{},"Operators list bindings; admins bind and unbind; the audit log records ",[1892,2374,2375],{},"credential.bound",[1892,2377,2378],{},"credential.unbound"," with names and hosts, never a value. Processes pick a change up at their next start (the node restarts its runtime, as for a rotated secret).",[1884,2381,2383],{"id":2382},"bind-a-connections-token","Bind a connection's token",[1855,2385,2386,2387,2390],{},"A ",[1865,2388,2389],{"href":1660},"connection","'s token comes with each call rather than to the process at its start, so it is bound by the connection's name. In the plugin's manifest:",[1897,2392,2394],{"className":1899,"code":2393,"filename":1727,"language":1901,"meta":1902,"style":1902},"requires:\n  inject:\n    github:                      # the connection's name, not a secret's\n      - host: api.github.com\n        header: Authorization\n        format: \"token {secret}\"\n        shape: \"ghs_{36}\"\negress: [api.github.com]\nconnections:\n  - name: github\n    tools: [gh]\n    # ...\n",[1892,2395,2396,2402,2408,2419,2430,2438,2450,2463,2476,2483,2496,2510],{"__ignoreMap":1902},[1906,2397,2398,2400],{"class":1908,"line":1909},[1906,2399,1913],{"class":1912},[1906,2401,1917],{"class":1916},[1906,2403,2404,2406],{"class":1908,"line":1920},[1906,2405,1941],{"class":1912},[1906,2407,1917],{"class":1916},[1906,2409,2410,2413,2415],{"class":1908,"line":1938},[1906,2411,2412],{"class":1912},"    github",[1906,2414,1895],{"class":1916},[1906,2416,2418],{"class":2417},"sHwdD","                      # the connection's name, not a secret's\n",[1906,2420,2421,2423,2425,2427],{"class":1908,"line":1946},[1906,2422,1957],{"class":1916},[1906,2424,1960],{"class":1912},[1906,2426,1895],{"class":1916},[1906,2428,2429],{"class":1931}," api.github.com\n",[1906,2431,2432,2434,2436],{"class":1908,"line":1954},[1906,2433,1971],{"class":1912},[1906,2435,1895],{"class":1916},[1906,2437,1976],{"class":1931},[1906,2439,2440,2442,2444,2446,2448],{"class":1908,"line":1968},[1906,2441,1982],{"class":1912},[1906,2443,1895],{"class":1916},[1906,2445,1987],{"class":1916},[1906,2447,2325],{"class":1931},[1906,2449,1993],{"class":1916},[1906,2451,2452,2454,2456,2458,2461],{"class":1908,"line":1979},[1906,2453,2025],{"class":1912},[1906,2455,1895],{"class":1916},[1906,2457,1987],{"class":1916},[1906,2459,2460],{"class":1931},"ghs_{36}",[1906,2462,1993],{"class":1916},[1906,2464,2465,2467,2469,2471,2474],{"class":1908,"line":1996},[1906,2466,1873],{"class":1912},[1906,2468,1895],{"class":1916},[1906,2470,1928],{"class":1916},[1906,2472,2473],{"class":1931},"api.github.com",[1906,2475,1935],{"class":1916},[1906,2477,2478,2481],{"class":1908,"line":2011},[1906,2479,2480],{"class":1912},"connections",[1906,2482,1917],{"class":1916},[1906,2484,2485,2488,2491,2493],{"class":1908,"line":2022},[1906,2486,2487],{"class":1916},"  -",[1906,2489,2490],{"class":1912}," name",[1906,2492,1895],{"class":1916},[1906,2494,2495],{"class":1931}," github\n",[1906,2497,2498,2501,2503,2505,2508],{"class":1908,"line":2037},[1906,2499,2500],{"class":1912},"    tools",[1906,2502,1895],{"class":1916},[1906,2504,1928],{"class":1916},[1906,2506,2507],{"class":1931},"gh",[1906,2509,1935],{"class":1916},[1906,2511,2513],{"class":1908,"line":2512},12,[1906,2514,2515],{"class":2417},"    # ...\n",[1855,2517,2518],{},"or as a tenant admin, for a connection an installed plugin declares:",[1897,2520,2522],{"className":2274,"code":2521,"language":2276,"meta":1902,"style":1902},"oz0 tenant credential bind acme --connection github --host api.github.com --header Authorization \\\n  --format 'token {secret}' --shape 'ghs_{36}'\n",[1892,2523,2524,2552],{"__ignoreMap":1902},[1906,2525,2526,2528,2530,2532,2534,2536,2539,2542,2544,2546,2548,2550],{"class":1908,"line":1909},[1906,2527,1714],{"class":2283},[1906,2529,2286],{"class":1931},[1906,2531,2289],{"class":1931},[1906,2533,2292],{"class":1931},[1906,2535,2295],{"class":1931},[1906,2537,2538],{"class":1931}," --connection",[1906,2540,2541],{"class":1931}," github",[1906,2543,2301],{"class":1931},[1906,2545,2304],{"class":1931},[1906,2547,2307],{"class":1931},[1906,2549,2310],{"class":1931},[1906,2551,2314],{"class":2313},[1906,2553,2554,2556,2558,2560,2562,2564,2566,2568],{"class":1908,"line":1920},[1906,2555,2319],{"class":1931},[1906,2557,2322],{"class":1916},[1906,2559,2325],{"class":1931},[1906,2561,2328],{"class":1916},[1906,2563,2331],{"class":1931},[1906,2565,2322],{"class":1916},[1906,2567,2460],{"class":1931},[1906,2569,2339],{"class":1916},[1855,2571,2572],{},"Each covered call then gets a sealed token:",[2574,2575,2576,2584,2587,2594],"ul",{},[2577,2578,2579,2580,2583],"li",{},"Every node makes a sealing key when it starts (HPKE: ML-KEM-768 with X25519, or with P-256 in the ",[1865,2581,2582],{"href":1488},"FIPS flavour",", and AES-256-GCM) and publishes its public half; the private half stays in the memory of the node's supervisor.",[2577,2585,2586],{},"The edge mints the call's token as before, makes a placeholder in the binding's shape, and seals both to the node that makes the call, with the node, the tenant, the connection, the call, the hosts the connection's bindings name and an expiry (the token's own, an hour at most).",[2577,2588,2589,2590,2593],{},"The call's ",[1892,2591,2592],{},"_meta[\"oz0\u002Fconnections\"]"," carries the placeholder; the tool sends it as it sent the token. The sealed blob goes to the call's egress proxy, outside every tree the tool sees, for as long as the call runs.",[2577,2595,2596],{},"The proxy has the supervisor open the blob and puts the token on requests to the listed hosts only, and scrubs it from the answers. A blob copied to another node does not open there, an expired one does not open at all, one handed to another call is refused, and once the call ended its placeholder is worth nothing.",[1855,2598,2599,2600,2603,2604,2607,2608,2611,2612,2615,2616,2619],{},"The audit log records the use as ",[1892,2601,2602],{},"credential.injected"," with the secret named ",[1892,2605,2606],{},"OZ0_CONNECTION_\u003CNAME>"," (",[1892,2609,2610],{},"OZ0_CONNECTION_GITHUB","). A call whose server runs under the binding never gets the token in plaintext: an edge or a node that cannot seal it (a node binary from before this, a Windows node) makes the call fail with a reason, and a node that cannot open sealed tokens does not start the server. A binding of a connection's own secrets (",[1892,2613,2614],{},"GITHUB_APP_TOKEN",", a fallback such as ",[1892,2617,2618],{},"GITHUB_TOKEN",") is refused with the connection's name to bind instead.",[1884,2621,2623],{"id":2622},"sign-aws-requests","Sign AWS requests",[1855,2625,2386,2626,2630],{},[1865,2627,2629],{"href":2628},"\u002Ffleet\u002Fcloud-federation#in-a-plugin","federated"," AWS connection's token is a session STS issued for the agent: an\naccess key ID, a secret and a session token, which an AWS API never takes as a header value. Its binding signs\ninstead:",[1897,2632,2634],{"className":1899,"code":2633,"filename":1727,"language":1901,"meta":1902,"style":1902},"requires:\n  inject:\n    aws:                          # the federated connection's name\n      - host: \"*.s3.eu-north-1.amazonaws.com\"\n        sigv4: {service: s3, region: eu-north-1}\n      - host: bedrock-runtime.eu-north-1.amazonaws.com\n        sigv4: {service: bedrock, region: eu-north-1}\n",[1892,2635,2636,2642,2648,2658,2672,2704,2715],{"__ignoreMap":1902},[1906,2637,2638,2640],{"class":1908,"line":1909},[1906,2639,1913],{"class":1912},[1906,2641,1917],{"class":1916},[1906,2643,2644,2646],{"class":1908,"line":1920},[1906,2645,1941],{"class":1912},[1906,2647,1917],{"class":1916},[1906,2649,2650,2653,2655],{"class":1908,"line":1938},[1906,2651,2652],{"class":1912},"    aws",[1906,2654,1895],{"class":1916},[1906,2656,2657],{"class":2417},"                          # the federated connection's name\n",[1906,2659,2660,2662,2664,2666,2668,2670],{"class":1908,"line":1946},[1906,2661,1957],{"class":1916},[1906,2663,1960],{"class":1912},[1906,2665,1895],{"class":1916},[1906,2667,1987],{"class":1916},[1906,2669,2247],{"class":1931},[1906,2671,1993],{"class":1916},[1906,2673,2674,2677,2679,2682,2685,2687,2690,2693,2696,2698,2701],{"class":1908,"line":1954},[1906,2675,2676],{"class":1912},"        sigv4",[1906,2678,1895],{"class":1916},[1906,2680,2681],{"class":1916}," {",[1906,2683,2684],{"class":1912},"service",[1906,2686,1895],{"class":1916},[1906,2688,2689],{"class":1931}," s3",[1906,2691,2692],{"class":1916},",",[1906,2694,2695],{"class":1912}," region",[1906,2697,1895],{"class":1916},[1906,2699,2700],{"class":1931}," eu-north-1",[1906,2702,2703],{"class":1916},"}\n",[1906,2705,2706,2708,2710,2712],{"class":1908,"line":1968},[1906,2707,1957],{"class":1916},[1906,2709,1960],{"class":1912},[1906,2711,1895],{"class":1916},[1906,2713,2714],{"class":1931}," bedrock-runtime.eu-north-1.amazonaws.com\n",[1906,2716,2717,2719,2721,2723,2725,2727,2730,2732,2734,2736,2738],{"class":1908,"line":1979},[1906,2718,2676],{"class":1912},[1906,2720,1895],{"class":1916},[1906,2722,2681],{"class":1916},[1906,2724,2684],{"class":1912},[1906,2726,1895],{"class":1916},[1906,2728,2729],{"class":1931}," bedrock",[1906,2731,2692],{"class":1916},[1906,2733,2695],{"class":1912},[1906,2735,1895],{"class":1916},[1906,2737,2700],{"class":1931},[1906,2739,2703],{"class":1916},[1855,2741,2742,2743,2746,2747,2163,2750,2753,2754,2757],{},"The tool gives its AWS SDK the call's placeholder as the access key ID, any secret access key and no session token.\nThe proxy recognises the placeholder in the signature's ",[1892,2744,2745],{},"Credential=",", takes the SDK's ",[1892,2748,2749],{},"Authorization",[1892,2751,2752],{},"X-Amz-Date","\nand ",[1892,2755,2756],{},"X-Amz-Security-Token"," off, and signs the request again with the session for the binding's service and region,\nover the path exactly as it is sent. Only a connection's binding may sign; a tenant secret cannot.",[1855,2759,2760,2761,2764,2765,2768,2769,2772,2773,2776],{},"The body's hash: the proxy keeps the SDK's ",[1892,2762,2763],{},"x-amz-content-sha256"," when it is a SHA-256, ",[1892,2766,2767],{},"UNSIGNED-PAYLOAD"," or\n",[1892,2770,2771],{},"STREAMING-UNSIGNED-PAYLOAD-TRAILER"," (S3 checks the body against it; other services hash what they receive), and\nhashes a body of up to 16 MiB itself when the SDK declared nothing. Uploads that sign every chunk with the SDK's own\nkey (",[1892,2774,2775],{},"STREAMING-AWS4-HMAC-SHA256-PAYLOAD",") are refused with a reason: configure the SDK for unsigned payloads with a\ntrailing checksum, which current SDKs use over HTTPS by default. The answer is scrubbed of the access key ID, the secret\nand the session token.",[1884,2778,2780],{"id":2779},"what-the-proxy-does","What the proxy does",[2210,2782,2784],{"id":2783},"tls-and-host-identity","TLS and host identity",[1855,2786,2787,2788,2163,2791,2163,2794,2163,2797,2163,2800,2163,2803,2116,2806,2809,2810,2813,2814,2817],{},"The proxy terminates TLS only for bound hosts. Every other host keeps its blind tunnel. For a bound host the proxy presents a certificate from a CA of its own, made for each sandbox and kept in memory, which may sign only for the bound hosts. The process trusts it through ",[1892,2789,2790],{},"SSL_CERT_FILE",[1892,2792,2793],{},"REQUESTS_CA_BUNDLE",[1892,2795,2796],{},"CURL_CA_BUNDLE",[1892,2798,2799],{},"GIT_SSL_CAINFO",[1892,2801,2802],{},"AWS_CA_BUNDLE",[1892,2804,2805],{},"DENO_CERT",[1892,2807,2808],{},"PIP_CERT",", which name a bundle of the node's roots and the CA, and ",[1892,2811,2812],{},"NODE_EXTRA_CA_CERTS",", which names the CA (",[1892,2815,2816],{},"NODE_USE_ENV_PROXY=1"," is set for Node.js). A container gets the bundle over its image's root files.",[1855,2819,2820,2821,2824,2825,2828,2829,2832],{},"The proxy checks the request first: the TLS server name must be the bound host, and so must every request's authority inside the tunnel (the ",[1892,2822,2823],{},"Host"," header, HTTP\u002F2's ",[1892,2826,2827],{},":authority"," or an absolute URL's host), port included; one that names another host is refused as ",[1892,2830,2831],{},"request_authority_mismatch",", and the request goes on with the tunnel's own host, never the client's header.",[1855,2834,2835],{},"A tunnel the proxy does not terminate (every host without a binding) gets only the server-name check: what is inside it stays encrypted.",[1855,2837,2838,2839,2843],{},"A request that carries one of the tenant's secrets is refused (",[1865,2840,2842],{"href":2841},"\u002Fadmin\u002Fsecrets\u002Fplugin-secrets#what-is-scanned","what is scanned","), and so is every request while the node's copy of the fingerprints is missing or cannot be read; a path-scoped binding takes only a canonical path, forwarded exactly as checked.",[2210,2845,2847],{"id":2846},"placeholder-placement-and-response-scrubbing","Placeholder placement and response scrubbing",[1855,2849,2850,2851,2854],{},"The proxy puts the value only where the binding says, when the request carries the placeholder there; the binding's format replaces what the client sent. A placeholder anywhere else (the URL, another header, the body, another method or path), or in any plain-HTTP request, refuses the request with an egress denial of kind ",[1892,2852,2853],{},"placeholder",", which the job shows like any other denial.",[1855,2856,2857],{},"The proxy scrubs the value from the answer: an API that echoes the credential in a header's value or name, the body or a trailer hands the process the placeholder again. The value's raw form, its base64, hex and percent-encoded forms are replaced; a call's token stays on that list until it expires, after its call ended.",[1855,2859,2860],{},"One proxy keeps at most 256 different tokens this way, those of running calls and of calls that ended together, and calls of one connection that share a token count once. A call that would pass the bound goes without its token, so the host refuses it, and the proxy logs why; it gets the token when the first of them expires.",[2210,2862,2864],{"id":2863},"responses-and-protocol-changes","Responses and protocol changes",[1855,2866,2867,2868,2871],{},"The proxy passes on final answers only. An interim answer (100, 102, 103) is not forwarded, whatever it holds; a client that sent ",[1892,2869,2870],{},"Expect: 100-continue"," gets its 100 from the proxy. A failure is a page of the proxy's own with a fixed reason, never a quote of what the server sent, and the proxy's log keeps the same fixed reason. Each request goes to the host on a connection of its own, one TLS handshake each, and what a server sends outside an answer is never read, so nothing can repeat it.",[1855,2873,2874,2875,2878,2879,2882,2883,2886],{},"The proxy refuses a switch of protocols: a request to a bound host that asks for one (",[1892,2876,2877],{},"Upgrade",", so WebSocket and h2c; ",[1892,2880,2881],{},"CONNECT"," inside the tunnel; HTTP\u002F2's preface) is refused before anything goes out, with or without a placeholder, and an answer that switches anyway is refused too. Either is an egress denial of kind ",[1892,2884,2885],{},"protocol_switch",", and the process reads why. A stream is what the proxy cannot scrub, so a host that needs an upgrade cannot have a binding: leave it unbound and let the tool hold the secret, or use its HTTP API.",[2210,2888,2890],{"id":2889},"audit-records","Audit records",[1855,2892,2893,2894,2896,2897,2900],{},"The proxy records uses as ",[1892,2895,2602],{}," in the audit log: which binding (its ID, or ",[1892,2898,2899],{},"plugin:\u003CSECRET>[n]"," for a manifest's), which secret, which host and path prefix, once per job and binding, also for a server that serves many jobs.",[1884,2902,2904],{"id":2903},"where-it-applies","Where it applies",[2067,2906,2907,2916],{},[2070,2908,2909],{},[2073,2910,2911,2914],{},[2076,2912,2913],{},"Where the server runs",[2076,2915],{},[2082,2917,2918,2926,2941,2952,2960,2977,2985,3003],{},[2073,2919,2920,2923],{},[2087,2921,2922],{},"Sandbox tier 1, a container",[2087,2924,2925],{},"The sandbox's own egress proxy intercepts; the process has no other way out",[2073,2927,2928,2934],{},[2087,2929,2930,2931,2142],{},"A plugin sandbox on the host's network (",[1892,2932,2933],{},"--plugin-sandbox auto",[2087,2935,2936,2937,2940],{},"A proxy of the process's own on the node's loopback, with a token only its environment holds. Nothing forces the process through it: a client that ignores ",[1892,2938,2939],{},"HTTPS_PROXY"," reaches the host with the placeholder, which fails. The sandbox hides the node's other processes, so the value is out of reach",[2073,2942,2943,2949],{},[2087,2944,2945,2946],{},"Tier 0, ",[1892,2947,2948],{},"sandbox: host",[2087,2950,2951],{},"The same proxy, and the value is out of the process's environment, files and logs, which keeps it from accidental leaks. It is not a boundary against a malicious plugin: the process runs as the node's user and can read other processes of that user (the runtime's environment, and where ptrace is allowed, the proxy's memory). Use sandbox tier 1 or a container where that matters",[2073,2953,2954,2957],{},[2087,2955,2956],{},"A Windows node, a node binary from before this",[2087,2958,2959],{},"The server does not start, rather than start with the value",[2073,2961,2962,2974],{},[2087,2963,2964,2965,2191,2968,2607,2971,2142],{},"A tool with ",[1892,2966,2967],{},"isolation: microvm",[1892,2969,2970],{},"isolation: remote",[1865,2972,2973],{"href":1280},"tier 2",[2087,2975,2976],{},"The server does not start: a microVM's runner takes no bindings yet, and a remote sandbox's traffic never passes the node's proxy",[2073,2978,2979,2982],{},[2087,2980,2981],{},"A harness session",[2087,2983,2984],{},"Its sandbox's egress proxy intercepts, as for a server in tier 1; at tier 0, a proxy on loopback as above. The session's processes hold the placeholder; a terminal or a verify script it starts holds no value either",[2073,2986,2987,2995],{},[2087,2988,2386,2989,2607,2992,2142],{},[1865,2990,2991],{"href":915},"remote harness",[1892,2993,2994],{},"protocol: remote",[2087,2996,2997,2998,3002],{},"Nothing is injected: the harness sends its plugin's secrets to its provider itself, so each session's request carries every secret of its plugin as a value, bound or not. An ",[1865,2999,3001],{"href":3000},"\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a#outside-a2a-agents","outside agent","'s session gets only the one secret its auth names, also as a value",[2073,3004,3005,3011],{},[2087,3006,3007,3008,2142],{},"A remote tool (",[1892,3009,3010],{},"url",[2087,3012,3013,3014,2142],{},"The node's runtime is its client: its MCP traffic goes through a proxy of its own on the node's loopback (",[1865,3015,3016],{"href":2262},"in this guide",[1855,3018,3019],{},"A Windows node injects nothing: its harness sessions and remote tools get the value itself, and its remote tools a bound connection's token itself. A Linux or macOS node binary that cannot inject does not start a session or a remote tool under a binding, rather than hand it the value.",[1855,3021,3022],{},"Clients that pin certificates or bring their own roots (Java, some Rust clients) fail on bound hosts, and only there. HTTP\u002F2 is not offered on intercepted connections; clients fall back to HTTP\u002F1.1. WebSocket and other upgrades do not work on a bound host (above).",[1855,3024,3025,3026,3029],{},"A node operator whose bound hosts sit behind a TLS-inspecting company proxy names its roots with ",[1892,3027,3028],{},"OZ0_EGRESS_UPSTREAM_ROOTS=\u003Cfile>"," in the node's environment.",[1884,3031,3033],{"id":3032},"remote-tools","Remote tools",[1855,3035,3036],{},"A remote tool's server is somewhere else, and the node's runtime is the client that sends it each MCP request. Under a binding, the runtime starts the node binary's credential proxy for the tool on loopback, sends the tool's traffic through it (trusting only the node's roots and the proxy's own CA), and puts placeholders where values were:",[2574,3038,3039,3049,3063],{},[2577,3040,3041,3042,2607,3045,3048],{},"A bound secret in the tool's ",[1892,3043,3044],{},"headers",[1892,3046,3047],{},"X-Api-Key: ${API_KEY}",") is sent as its placeholder, and the proxy puts the value on, on the binding's host, port, methods and path only. Bind the secret to the server's own host for it to work there.",[2577,3050,3051,3052,3055,3056,3059,3060,3062],{},"A bound connection is asked for sealed, as for a local server. When one of the connection's bindings names the server's own host and port, the call carries the placeholder in that binding's header (or as Basic authentication), for that call only, and nothing of the token in its body's ",[1892,3053,3054],{},"_meta","; the proxy opens the call's sealed blob and puts the token there.",[3057,3058],"br",{},"A remote server that takes a connection's token reads it from that header. A connection bound only to other hosts gives the server the placeholder in ",[1892,3061,3054],{},", which nothing redeems: the call fails rather than hand the token to a host it was not bound to.",[2577,3064,3065,3066,3068],{},"One request carries one binding's placeholder. A remote tool whose header sends a bound secret to its server and whose bound connection's token goes there too would carry two, which the proxy refuses; ",[1892,3067,2253],{}," warns. A query-parameter binding cannot reach a remote tool's calls (the runtime opens its stream once), so such a call is not made.",[1897,3070,3072],{"className":1899,"code":3071,"filename":1727,"language":1901,"meta":1902,"style":1902},"tools:\n  - id: tracker\n    url: https:\u002F\u002Fmcp.tracker.example\u002Fmcp\n    headers: {X-Api-Key: \"${TRACKER_KEY}\"}\nrequires:\n  secrets: [TRACKER_KEY]\n  inject:\n    TRACKER_KEY:\n      - {host: mcp.tracker.example, header: X-Api-Key}\negress: [mcp.tracker.example]\n",[1892,3073,3074,3081,3093,3103,3127,3133,3146,3152,3159,3184],{"__ignoreMap":1902},[1906,3075,3076,3079],{"class":1908,"line":1909},[1906,3077,3078],{"class":1912},"tools",[1906,3080,1917],{"class":1916},[1906,3082,3083,3085,3088,3090],{"class":1908,"line":1920},[1906,3084,2487],{"class":1916},[1906,3086,3087],{"class":1912}," id",[1906,3089,1895],{"class":1916},[1906,3091,3092],{"class":1931}," tracker\n",[1906,3094,3095,3098,3100],{"class":1908,"line":1938},[1906,3096,3097],{"class":1912},"    url",[1906,3099,1895],{"class":1916},[1906,3101,3102],{"class":1931}," https:\u002F\u002Fmcp.tracker.example\u002Fmcp\n",[1906,3104,3105,3108,3110,3112,3115,3117,3119,3122,3125],{"class":1908,"line":1946},[1906,3106,3107],{"class":1912},"    headers",[1906,3109,1895],{"class":1916},[1906,3111,2681],{"class":1916},[1906,3113,3114],{"class":1912},"X-Api-Key",[1906,3116,1895],{"class":1916},[1906,3118,1987],{"class":1916},[1906,3120,3121],{"class":1931},"${TRACKER_KEY}",[1906,3123,3124],{"class":1916},"\"",[1906,3126,2703],{"class":1916},[1906,3128,3129,3131],{"class":1908,"line":1954},[1906,3130,1913],{"class":1912},[1906,3132,1917],{"class":1916},[1906,3134,3135,3137,3139,3141,3144],{"class":1908,"line":1968},[1906,3136,1923],{"class":1912},[1906,3138,1895],{"class":1916},[1906,3140,1928],{"class":1916},[1906,3142,3143],{"class":1931},"TRACKER_KEY",[1906,3145,1935],{"class":1916},[1906,3147,3148,3150],{"class":1908,"line":1979},[1906,3149,1941],{"class":1912},[1906,3151,1917],{"class":1916},[1906,3153,3154,3157],{"class":1908,"line":1996},[1906,3155,3156],{"class":1912},"    TRACKER_KEY",[1906,3158,1917],{"class":1916},[1906,3160,3161,3163,3165,3167,3169,3172,3174,3177,3179,3182],{"class":1908,"line":2011},[1906,3162,1957],{"class":1916},[1906,3164,2681],{"class":1916},[1906,3166,2091],{"class":1912},[1906,3168,1895],{"class":1916},[1906,3170,3171],{"class":1931}," mcp.tracker.example",[1906,3173,2692],{"class":1916},[1906,3175,3176],{"class":1912}," header",[1906,3178,1895],{"class":1916},[1906,3180,3181],{"class":1931}," X-Api-Key",[1906,3183,2703],{"class":1916},[1906,3185,3186,3188,3190,3192,3195],{"class":1908,"line":2022},[1906,3187,1873],{"class":1912},[1906,3189,1895],{"class":1916},[1906,3191,1928],{"class":1916},[1906,3193,3194],{"class":1931},"mcp.tracker.example",[1906,3196,1935],{"class":1916},[1884,3198,3200],{"id":3199},"what-a-bound-host-must-not-do","What a bound host must not do",[1855,3202,3203],{},"The process never holds the value, and the proxy keeps it out of everything the process reads from the bound host in a form the proxy knows. That is a promise about what the proxy can compare, not about what a server can do with a value it was given. The scrub finds the value as it was sent and in its common encodings. It cannot find a value the server has changed:",[2574,3205,3206,3213,3220],{},[2577,3207,3208,3209,3212],{},"JSON that escapes the value's characters (",[1892,3210,3211],{},"\\u0061","), a value in another letter case, or one compressed or encrypted inside a body;",[2577,3214,3215,3216,3219],{},"a value divided in pieces, across two headers, two ",[1892,3217,3218],{},"Range"," answers or two requests;",[2577,3221,3222],{},"a value the server keeps and hands back on a port or a host the binding does not name, which the proxy does not read.",[1855,3224,3225,3226,2116,3228,3230],{},"Any scrubber that compares text has these limits. The rule that follows: bind a secret only to a host you trust not to transform the credential and hand it back. A host that does so, by malice or by a debug endpoint that dumps requests, gives whatever process can ask it the value, and that process can send it to any host on its allowlist. Keep a bound host's egress entry to that host's API, keep ",[1892,3227,2166],{},[1892,3229,2162],{}," narrow, and prefer a credential that the host can scope and that you can revoke.",[1884,3232,3234],{"id":3233},"secrets-in-a-models-arguments","Secrets in a model's arguments",[1855,3236,3237],{},"Some tools take a secret as an argument: a deploy tool's environment, a generic HTTP tool's header. A tool marks those arguments in its manifest, by function and JSON pointer:",[1897,3239,3241],{"className":1899,"code":3240,"filename":1727,"language":1901,"meta":1902,"style":1902},"tools:\n  - id: deploy\n    mcp: [python, -m, deploy.server]\n    secret_arguments:\n      run: [\u002Fenv\u002FAPI_KEY]\n",[1892,3242,3243,3249,3260,3284,3291],{"__ignoreMap":1902},[1906,3244,3245,3247],{"class":1908,"line":1909},[1906,3246,3078],{"class":1912},[1906,3248,1917],{"class":1916},[1906,3250,3251,3253,3255,3257],{"class":1908,"line":1920},[1906,3252,2487],{"class":1916},[1906,3254,3087],{"class":1912},[1906,3256,1895],{"class":1916},[1906,3258,3259],{"class":1931}," deploy\n",[1906,3261,3262,3265,3267,3269,3272,3274,3277,3279,3282],{"class":1908,"line":1938},[1906,3263,3264],{"class":1912},"    mcp",[1906,3266,1895],{"class":1916},[1906,3268,1928],{"class":1916},[1906,3270,3271],{"class":1931},"python",[1906,3273,2692],{"class":1916},[1906,3275,3276],{"class":1931}," -m",[1906,3278,2692],{"class":1916},[1906,3280,3281],{"class":1931}," deploy.server",[1906,3283,1935],{"class":1916},[1906,3285,3286,3289],{"class":1908,"line":1946},[1906,3287,3288],{"class":1912},"    secret_arguments",[1906,3290,1917],{"class":1916},[1906,3292,3293,3296,3298,3300,3303],{"class":1908,"line":1954},[1906,3294,3295],{"class":1912},"      run",[1906,3297,1895],{"class":1916},[1906,3299,1928],{"class":1916},[1906,3301,3302],{"class":1931},"\u002Fenv\u002FAPI_KEY",[1906,3304,1935],{"class":1916},[1855,3306,3307],{},"and a tenant admin binds a secret to one of them:",[1897,3309,3311],{"className":2274,"code":3310,"language":2276,"meta":1902,"style":1902},"oz0 tenant credential bind acme DEPLOY_KEY --function deploy.run --argument \u002Fenv\u002FAPI_KEY\n",[1892,3312,3313],{"__ignoreMap":1902},[1906,3314,3315,3317,3319,3321,3323,3325,3328,3331,3334,3337],{"class":1908,"line":1909},[1906,3316,1714],{"class":2283},[1906,3318,2286],{"class":1931},[1906,3320,2289],{"class":1931},[1906,3322,2292],{"class":1931},[1906,3324,2295],{"class":1931},[1906,3326,3327],{"class":1931}," DEPLOY_KEY",[1906,3329,3330],{"class":1931}," --function",[1906,3332,3333],{"class":1931}," deploy.run",[1906,3335,3336],{"class":1931}," --argument",[1906,3338,3339],{"class":1931}," \u002Fenv\u002FAPI_KEY\n",[1855,3341,3342,3343,3346,3347,3350,3351,3354,3355,3357],{},"The model writes ",[1892,3344,3345],{},"{{secret:DEPLOY_KEY}}"," there. The node fills the value in inside the call, after the ",[1865,3348,3349],{"href":1049},"tool policy",", the ",[1865,3352,3353],{"href":270},"approvals"," and the hooks, and replaces the value, in any common encoding, with ",[1892,3356,3345],{}," in the result and in an error the call raises; a file the tool returns that holds the value is dropped.",[1855,3359,3360],{},"The job's history, its trace and the approval show what the model wrote. A placeholder anywhere else (another argument, another secret, a secret that is not set) stops the call before it is made, and the model reads which function, which argument and which secret, never a value. A secret a connection, a model provider or a plugin source reads stays on the edge and cannot be bound to an argument.",[1855,3362,3363,3364,3368,3369,3371,3372,3375],{},"A tool in a ",[1865,3365,3367],{"href":3366},"\u002Ffleet\u002Fsandbox-tier-2\u002Fremote#remote-sandboxes","remote sandbox"," gets no argument bindings: its calls leave the node with their arguments, so ",[1892,3370,2253],{}," refuses ",[1892,3373,3374],{},"secret_arguments"," on it, and a call to it that holds a placeholder is not made.",[1855,3377,3378,3379,3381],{},"An argument binding belongs to the installed plugin that marks the argument when you bind it: binding an argument no installed plugin marks is refused, and removing the plugin removes its argument bindings (the audit log records ",[1892,3380,2378],{},"), so another plugin that later takes the tool's ID does not get the value.",[1884,3383,3385],{"id":3384},"not-yet","Not yet",[2574,3387,3388,3394,3397,3400,3403],{},[2577,3389,3390,3391,3393],{},"Windows nodes inject nothing (above); on tier 0 and ",[1892,3392,2948],{}," the placeholder guards against accidents, not a malicious plugin.",[2577,3395,3396],{},"A remote harness's sessions get their plugin's secrets as values (above): a binding of the plugin's secret does not keep it from the harness's code.",[2577,3398,3399],{},"A harness session gets no connection's token: a connection's token is minted for one call, and a session's own tools are not calls the platform makes.",[2577,3401,3402],{},"Substitution in request bodies, HTTP\u002F2, WebSocket and other upgrades on a bound host, and a Java truststore.",[2577,3404,3405],{},"SigV4 presigned URLs and chunk-signed uploads: a sigv4 binding signs the Authorization header only.",[3407,3408,3409],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":1902,"searchDepth":1920,"depth":1920,"links":3411},[3412,3415,3416,3417,3418,3424,3425,3426,3427,3428],{"id":1886,"depth":1920,"text":1887,"children":3413},[3414],{"id":2212,"depth":1938,"text":2213},{"id":2267,"depth":1920,"text":2268},{"id":2382,"depth":1920,"text":2383},{"id":2622,"depth":1920,"text":2623},{"id":2779,"depth":1920,"text":2780,"children":3419},[3420,3421,3422,3423],{"id":2783,"depth":1938,"text":2784},{"id":2846,"depth":1938,"text":2847},{"id":2863,"depth":1938,"text":2864},{"id":2889,"depth":1938,"text":2890},{"id":2903,"depth":1920,"text":2904},{"id":3032,"depth":1920,"text":3033},{"id":3199,"depth":1920,"text":3200},{"id":3233,"depth":1920,"text":3234},{"id":3384,"depth":1920,"text":3385},"Bind a secret to the host it goes to: plugin processes hold a placeholder, and the node's egress proxy puts the value on requests to that host only. Secrets in a model's arguments, filled in after the policy.","md",null,{"audience":3433,"doc_type":3434},"cluster and tenant administrators","how-to",{"icon":1629},{"title":1651,"description":3429},"v9i1KZjZ3PR5uKhsC4Qem7N70OvK9oJWolhrI1iL8hU",[3439,3441],{"title":1647,"path":1648,"stem":1649,"description":3440,"children":-1},"Use settings for addresses, backend names and switches that administrators may read.",{"title":1655,"path":1656,"stem":1657,"description":3442,"icon":1629,"children":-1},"Keep the master key and the secrets key wrapped on disk, with the key that unwraps them in an HSM or a KMS, and move them back to plain files.",1794442960194]