[{"data":1,"prerenderedAt":3113},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fadmin\u002Fkey-commands":1849,"docs-surround:\u002Fadmin\u002Fkey-commands":3108},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1655,"body":1851,"description":3099,"extension":3100,"links":3101,"meta":3102,"navigation":3105,"path":1656,"seo":3106,"stem":1657,"__hash__":3107},"docs\u002F09.admin\u002F04.key-commands.md",{"type":1852,"value":1853,"toc":3085},"minimark",[1854,1858,1861,1868,1876,1879,1884,1903,1975,2008,2011,2040,2044,2054,2131,2279,2304,2307,2312,2322,2452,2458,2462,2465,2646,2652,2656,2659,2780,2789,2809,2816,2819,2822,2871,2875,2878,2908,2927,2931,2937,2989,3003,3007,3021,3025,3042,3045,3050,3058,3061,3065,3081],[1855,1856,1857],"p",{},"For: cluster and tenant administrators.",[1855,1859,1860],{},"Keep an offline recovery copy before changing how the servers unwrap their keys. The protocol below lets an HSM, KMS or secret engine protect keys at rest.",[1855,1862,1863,1864,1867],{},"Every server reads the master key from a file, and every server that runs the edge role reads the secrets key from another (",[1865,1866,1358],"a",{"href":1359},"). By default these files hold the keys in plain base64, so whoever copies a server's disk, its Kubernetes Secret or a copy of the file holds the cluster.",[1855,1869,1870,1871,1875],{},"A key command changes that. The file then holds the key ",[1872,1873,1874],"em",{},"wrapped",": encrypted under a wrapping key that lives somewhere else, such as an HSM, a cloud KMS or a secrets engine. At start, the server asks the command to unwrap it. A stolen file is useless without the wrapping key, and each unwrap is a request your HSM or KMS can authorize, log and refuse.",[1855,1877,1878],{},"What it does not change: the server still holds the unwrapped key in memory while it runs, as it always did. A key command protects the key at rest, not in use.",[1880,1881,1883],"h2",{"id":1882},"how-a-server-runs-the-command","How a server runs the command",[1855,1885,1886,1887,1891,1892,1895,1896,1891,1899,1902],{},"Give the command with ",[1888,1889,1890],"code",{},"--master-key-command"," (or ",[1888,1893,1894],{},"OZ0_MASTER_KEY_COMMAND",") and ",[1888,1897,1898],{},"--secrets-key-command",[1888,1900,1901],{},"OZ0_SECRETS_KEY_COMMAND","). The server runs it:",[1904,1905,1906,1969,1972],"ul",{},[1907,1908,1909,1910,1913,1914,1913,1917,1913,1920,1923,1924,1913,1927,1913,1930,1933,1934,1913,1937,1913,1940,1943,1944,1947,1948,1951,1952,1955,1956,1959,1960,1963,1964,1968],"li",{},"without a shell, with a small environment of its own: ",[1888,1911,1912],{},"PATH",", ",[1888,1915,1916],{},"HOME",[1888,1918,1919],{},"USER",[1888,1921,1922],{},"LOGNAME",", the locale (",[1888,1925,1926],{},"LANG",[1888,1928,1929],{},"LC_ALL",[1888,1931,1932],{},"LC_CTYPE","), ",[1888,1935,1936],{},"TZ",[1888,1938,1939],{},"TMPDIR",[1888,1941,1942],{},"SSL_CERT_FILE"," and ",[1888,1945,1946],{},"SSL_CERT_DIR"," (and on Windows what a program needs to run there), plus the variables you name in ",[1888,1949,1950],{},"OZ0_KEY_COMMAND_ENV",", a comma-separated list of names or prefixes ending in ",[1888,1953,1954],{},"*",", such as ",[1888,1957,1958],{},"OZ0_KEY_COMMAND_ENV=AWS_PROFILE,AWS_REGION"," or ",[1888,1961,1962],{},"VAULT_*",". That is how a PIN, a token or cloud credentials reach it; the rest of the server's environment, its database URL among it, does not. The CA's ",[1865,1965,1967],{"href":1966},"\u002Ffleet\u002Fcluster#the-cluster-cas-key-in-an-hsm-or-a-kms","signing command"," gets the same environment;",[1907,1970,1971],{},"for at most 30 seconds per run; after that it is killed, on Linux and macOS together with any processes it started;",[1907,1973,1974],{},"once per key at every start, and once every 10 minutes to ask whether it still reaches its wrapping key.",[1855,1976,1977,1978,1981,1982,1913,1985,1913,1988,1913,1991,1913,1994,1943,1997,2000,2001,1943,2004,2007],{},"Every command that reads a key goes through it: ",[1888,1979,1980],{},"server start"," in every mode and role, ",[1888,1983,1984],{},"server init",[1888,1986,1987],{},"server restore",[1888,1989,1990],{},"server operator issue",[1888,1992,1993],{},"server provisioner issue",[1888,1995,1996],{},"server ca export-key",[1888,1998,1999],{},"forget-key",", and ",[1888,2002,2003],{},"master-key confirm-backup",[1888,2005,2006],{},"secrets-key confirm-backup",". Each takes the same flag.",[1855,2009,2010],{},"A server refuses to start when:",[1904,2012,2013,2028,2031,2034,2037],{},[1907,2014,2015,2016,2019,2020,2023,2024,2027],{},"the key file, plain or wrapped, can be read or written by other users, or written by its group (make it ",[1888,2017,2018],{},"chmod 600",", or ",[1888,2021,2022],{},"640"," for a group only the server is in, as a Kubernetes Secret mounted with ",[1888,2025,2026],{},"fsGroup"," is);",[1907,2029,2030],{},"the file is wrapped and no command is given (the message names the command that wrapped it);",[1907,2032,2033],{},"a command is given and the file is plain (wrap it first, or leave the flag out);",[1907,2035,2036],{},"the command fails or takes too long (the message says so; what the command wrote to stderr, cut short, is in the server's log, never in the message, which doctor and the database keep);",[1907,2038,2039],{},"the command answers with another key than the one the file names.",[1880,2041,2043],{"id":2042},"the-protocol","The protocol",[1855,2045,2046,2047,1959,2050,2053],{},"The command gets one argument, the verb, and reads a JSON document on stdin. Each document names the protocol, the verb, the kind of key (",[1888,2048,2049],{},"master-key",[1888,2051,2052],{},"secrets-key",") and the key's ID.",[2055,2056,2057,2073],"table",{},[2058,2059,2060],"thead",{},[2061,2062,2063,2067,2070],"tr",{},[2064,2065,2066],"th",{},"Verb",[2064,2068,2069],{},"stdin also holds",[2064,2071,2072],{},"stdout",[2074,2075,2076,2096,2116],"tbody",{},[2061,2077,2078,2084,2093],{},[2079,2080,2081],"td",{},[1888,2082,2083],{},"COMMAND unwrap",[2079,2085,2086,2088,2089,2092],{},[1888,2087,1874],{},": the document ",[1888,2090,2091],{},"wrap"," printed",[2079,2094,2095],{},"the key, 32 bytes in base64",[2061,2097,2098,2103,2113],{},[2079,2099,2100],{},[1888,2101,2102],{},"COMMAND wrap",[2079,2104,2105,2108,2109,2112],{},[1888,2106,2107],{},"key",": the key in base64; ",[1888,2110,2111],{},"previous",": the document it is moving from, when it is under a command already",[2079,2114,2115],{},"the wrapped document: a JSON object of at most 64 KiB",[2061,2117,2118,2123,2126],{},[2079,2119,2120],{},[1888,2121,2122],{},"COMMAND describe",[2079,2124,2125],{},"nothing more",[2079,2127,2128],{},[1888,2129,2130],{},"{\"holder\": \"...\", \"algorithm\": \"...\"}",[2132,2133,2139],"pre",{"className":2134,"code":2135,"filename":2136,"language":2137,"meta":2138,"style":2138},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\"protocol\": \"oz0-keycmd-v1\", \"verb\": \"unwrap\", \"kind\": \"master-key\", \"key_id\": \"mk-4f1c2a9b0e7d3365\",\n \"wrapped\": {\"key\": \"projects\u002Facme\u002Fkeys\u002Foz0-master\", \"ciphertext\": \"...\"}}\n","unwrap's stdin","json","",[1888,2140,2141,2228],{"__ignoreMap":2138},[2142,2143,2146,2150,2153,2157,2159,2162,2165,2169,2171,2174,2176,2179,2181,2183,2185,2188,2190,2192,2194,2197,2199,2201,2203,2205,2207,2209,2211,2214,2216,2218,2220,2223,2225],"span",{"class":2144,"line":2145},"line",1,[2142,2147,2149],{"class":2148},"sMK4o","{",[2142,2151,2152],{"class":2148},"\"",[2142,2154,2156],{"class":2155},"spNyl","protocol",[2142,2158,2152],{"class":2148},[2142,2160,2161],{"class":2148},":",[2142,2163,2164],{"class":2148}," \"",[2142,2166,2168],{"class":2167},"sfazB","oz0-keycmd-v1",[2142,2170,2152],{"class":2148},[2142,2172,2173],{"class":2148},",",[2142,2175,2164],{"class":2148},[2142,2177,2178],{"class":2155},"verb",[2142,2180,2152],{"class":2148},[2142,2182,2161],{"class":2148},[2142,2184,2164],{"class":2148},[2142,2186,2187],{"class":2167},"unwrap",[2142,2189,2152],{"class":2148},[2142,2191,2173],{"class":2148},[2142,2193,2164],{"class":2148},[2142,2195,2196],{"class":2155},"kind",[2142,2198,2152],{"class":2148},[2142,2200,2161],{"class":2148},[2142,2202,2164],{"class":2148},[2142,2204,2049],{"class":2167},[2142,2206,2152],{"class":2148},[2142,2208,2173],{"class":2148},[2142,2210,2164],{"class":2148},[2142,2212,2213],{"class":2155},"key_id",[2142,2215,2152],{"class":2148},[2142,2217,2161],{"class":2148},[2142,2219,2164],{"class":2148},[2142,2221,2222],{"class":2167},"mk-4f1c2a9b0e7d3365",[2142,2224,2152],{"class":2148},[2142,2226,2227],{"class":2148},",\n",[2142,2229,2231,2233,2235,2237,2239,2242,2244,2247,2249,2251,2253,2256,2258,2260,2262,2265,2267,2269,2271,2274,2276],{"class":2144,"line":2230},2,[2142,2232,2164],{"class":2148},[2142,2234,1874],{"class":2155},[2142,2236,2152],{"class":2148},[2142,2238,2161],{"class":2148},[2142,2240,2241],{"class":2148}," {",[2142,2243,2152],{"class":2148},[2142,2245,2107],{"class":2246},"sBMFI",[2142,2248,2152],{"class":2148},[2142,2250,2161],{"class":2148},[2142,2252,2164],{"class":2148},[2142,2254,2255],{"class":2167},"projects\u002Facme\u002Fkeys\u002Foz0-master",[2142,2257,2152],{"class":2148},[2142,2259,2173],{"class":2148},[2142,2261,2164],{"class":2148},[2142,2263,2264],{"class":2246},"ciphertext",[2142,2266,2152],{"class":2148},[2142,2268,2161],{"class":2148},[2142,2270,2164],{"class":2148},[2142,2272,2273],{"class":2167},"...",[2142,2275,2152],{"class":2148},[2142,2277,2278],{"class":2148},"}}\n",[1904,2280,2281,2284,2297],{},[1907,2282,2283],{},"unwrap runs at every start. Print the key and nothing else on stdout; never print it on stderr, which goes to the server's log.",[1907,2285,2286,2287,1959,2290,2293,2294,2296],{},"wrap runs only when you move a key under the command, rotate its wrapping key, or make a new key with ",[1888,2288,2289],{},"server init --master-key-command",[1888,2291,2292],{},"secrets-key create --command",". What the document holds is up to the command: the server stores it as it is and hands it back to ",[1888,2295,2187],{},".",[1907,2298,2299,2300,2303],{},"describe says what holds the wrapping key, such as a KMS key's name or a token's label, and what wraps with it, such as ",[1888,2301,2302],{},"AES-256-GCM",". Never a secret. Exit non-zero when the wrapping key cannot be reached: doctor shows it.",[1855,2305,2306],{},"Bind each wrapped key to its kind and ID, for example as a KMS's encryption context or as AES-GCM's associated data, so that a master key's document can never be unwrapped as the secrets key. The server checks the key's ID after every unwrap anyway.",[2308,2309,2311],"h3",{"id":2310},"writing-your-own","Writing your own",[1855,2313,2314,2315,1943,2318,2321],{},"A key command is a few lines around your HSM's or KMS's tool or SDK. A sketch in Python, where ",[1888,2316,2317],{},"encrypt",[1888,2319,2320],{},"decrypt"," stand for the calls your wrapping key's holder offers:",[2132,2323,2328],{"className":2324,"code":2325,"filename":2326,"language":2327,"meta":2138,"style":2138},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","#!\u002Fusr\u002Fbin\u002Fenv python3\nimport base64, json, sys\n\n\ndef encrypt(plaintext: bytes, context: bytes) -> dict: ...  # your HSM or KMS\ndef decrypt(document: dict, context: bytes) -> bytes: ...\n\n\nreq = json.load(sys.stdin)\nif req[\"protocol\"] != \"oz0-keycmd-v1\":\n    sys.exit(\"unknown protocol\")\ncontext = f\"{req['kind']}\u002F{req.get('key_id', '')}\".encode()\nverb = sys.argv[1]\nif verb == \"describe\":\n    print(json.dumps({\"holder\": \"my-kms key oz0-root\", \"algorithm\": \"AES-256-GCM\"}))\nelif verb == \"wrap\":\n    print(json.dumps(encrypt(base64.b64decode(req[\"key\"]), context)))\nelif verb == \"unwrap\":\n    print(base64.b64encode(decrypt(req[\"wrapped\"], context)).decode())\nelse:\n    sys.exit(f\"unknown verb {verb}\")\n","key-command","python",[1888,2329,2330,2335,2340,2347,2352,2358,2364,2369,2374,2380,2386,2392,2398,2404,2410,2416,2422,2428,2434,2440,2446],{"__ignoreMap":2138},[2142,2331,2332],{"class":2144,"line":2145},[2142,2333,2334],{},"#!\u002Fusr\u002Fbin\u002Fenv python3\n",[2142,2336,2337],{"class":2144,"line":2230},[2142,2338,2339],{},"import base64, json, sys\n",[2142,2341,2343],{"class":2144,"line":2342},3,[2142,2344,2346],{"emptyLinePlaceholder":2345},true,"\n",[2142,2348,2350],{"class":2144,"line":2349},4,[2142,2351,2346],{"emptyLinePlaceholder":2345},[2142,2353,2355],{"class":2144,"line":2354},5,[2142,2356,2357],{},"def encrypt(plaintext: bytes, context: bytes) -> dict: ...  # your HSM or KMS\n",[2142,2359,2361],{"class":2144,"line":2360},6,[2142,2362,2363],{},"def decrypt(document: dict, context: bytes) -> bytes: ...\n",[2142,2365,2367],{"class":2144,"line":2366},7,[2142,2368,2346],{"emptyLinePlaceholder":2345},[2142,2370,2372],{"class":2144,"line":2371},8,[2142,2373,2346],{"emptyLinePlaceholder":2345},[2142,2375,2377],{"class":2144,"line":2376},9,[2142,2378,2379],{},"req = json.load(sys.stdin)\n",[2142,2381,2383],{"class":2144,"line":2382},10,[2142,2384,2385],{},"if req[\"protocol\"] != \"oz0-keycmd-v1\":\n",[2142,2387,2389],{"class":2144,"line":2388},11,[2142,2390,2391],{},"    sys.exit(\"unknown protocol\")\n",[2142,2393,2395],{"class":2144,"line":2394},12,[2142,2396,2397],{},"context = f\"{req['kind']}\u002F{req.get('key_id', '')}\".encode()\n",[2142,2399,2401],{"class":2144,"line":2400},13,[2142,2402,2403],{},"verb = sys.argv[1]\n",[2142,2405,2407],{"class":2144,"line":2406},14,[2142,2408,2409],{},"if verb == \"describe\":\n",[2142,2411,2413],{"class":2144,"line":2412},15,[2142,2414,2415],{},"    print(json.dumps({\"holder\": \"my-kms key oz0-root\", \"algorithm\": \"AES-256-GCM\"}))\n",[2142,2417,2419],{"class":2144,"line":2418},16,[2142,2420,2421],{},"elif verb == \"wrap\":\n",[2142,2423,2425],{"class":2144,"line":2424},17,[2142,2426,2427],{},"    print(json.dumps(encrypt(base64.b64decode(req[\"key\"]), context)))\n",[2142,2429,2431],{"class":2144,"line":2430},18,[2142,2432,2433],{},"elif verb == \"unwrap\":\n",[2142,2435,2437],{"class":2144,"line":2436},19,[2142,2438,2439],{},"    print(base64.b64encode(decrypt(req[\"wrapped\"], context)).decode())\n",[2142,2441,2443],{"class":2144,"line":2442},20,[2142,2444,2445],{},"else:\n",[2142,2447,2449],{"class":2144,"line":2448},21,[2142,2450,2451],{},"    sys.exit(f\"unknown verb {verb}\")\n",[1855,2453,2454,2457],{},[1888,2455,2456],{},"scripts\u002Ffakekeycmd"," in the repository is a complete one for tests: it wraps with AES-256-GCM under a key in a plain file, which is fine for a test and pointless for anything else.",[1880,2459,2461],{"id":2460},"the-key-file","The key file",[1855,2463,2464],{},"A wrapped key file is a JSON document with a header and the command's document:",[2132,2466,2469],{"className":2134,"code":2467,"filename":2468,"language":2137,"meta":2138,"style":2138},"{\n  \"format\": \"oz0-wrapped-key-v1\",\n  \"kind\": \"master-key\",\n  \"key_id\": \"mk-4f1c2a9b0e7d3365\",\n  \"command\": \"\u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command\",\n  \"holder\": \"my-kms key oz0-root\",\n  \"algorithm\": \"AES-256-GCM\",\n  \"wrapped_at\": \"2026-10-09T12:00:00Z\",\n  \"wrapped\": {\"...\": \"what the command printed\"}\n}\n","master.key",[1888,2470,2471,2476,2497,2515,2533,2553,2573,2592,2612,2642],{"__ignoreMap":2138},[2142,2472,2473],{"class":2144,"line":2145},[2142,2474,2475],{"class":2148},"{\n",[2142,2477,2478,2481,2484,2486,2488,2490,2493,2495],{"class":2144,"line":2230},[2142,2479,2480],{"class":2148},"  \"",[2142,2482,2483],{"class":2155},"format",[2142,2485,2152],{"class":2148},[2142,2487,2161],{"class":2148},[2142,2489,2164],{"class":2148},[2142,2491,2492],{"class":2167},"oz0-wrapped-key-v1",[2142,2494,2152],{"class":2148},[2142,2496,2227],{"class":2148},[2142,2498,2499,2501,2503,2505,2507,2509,2511,2513],{"class":2144,"line":2342},[2142,2500,2480],{"class":2148},[2142,2502,2196],{"class":2155},[2142,2504,2152],{"class":2148},[2142,2506,2161],{"class":2148},[2142,2508,2164],{"class":2148},[2142,2510,2049],{"class":2167},[2142,2512,2152],{"class":2148},[2142,2514,2227],{"class":2148},[2142,2516,2517,2519,2521,2523,2525,2527,2529,2531],{"class":2144,"line":2349},[2142,2518,2480],{"class":2148},[2142,2520,2213],{"class":2155},[2142,2522,2152],{"class":2148},[2142,2524,2161],{"class":2148},[2142,2526,2164],{"class":2148},[2142,2528,2222],{"class":2167},[2142,2530,2152],{"class":2148},[2142,2532,2227],{"class":2148},[2142,2534,2535,2537,2540,2542,2544,2546,2549,2551],{"class":2144,"line":2354},[2142,2536,2480],{"class":2148},[2142,2538,2539],{"class":2155},"command",[2142,2541,2152],{"class":2148},[2142,2543,2161],{"class":2148},[2142,2545,2164],{"class":2148},[2142,2547,2548],{"class":2167},"\u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command",[2142,2550,2152],{"class":2148},[2142,2552,2227],{"class":2148},[2142,2554,2555,2557,2560,2562,2564,2566,2569,2571],{"class":2144,"line":2360},[2142,2556,2480],{"class":2148},[2142,2558,2559],{"class":2155},"holder",[2142,2561,2152],{"class":2148},[2142,2563,2161],{"class":2148},[2142,2565,2164],{"class":2148},[2142,2567,2568],{"class":2167},"my-kms key oz0-root",[2142,2570,2152],{"class":2148},[2142,2572,2227],{"class":2148},[2142,2574,2575,2577,2580,2582,2584,2586,2588,2590],{"class":2144,"line":2366},[2142,2576,2480],{"class":2148},[2142,2578,2579],{"class":2155},"algorithm",[2142,2581,2152],{"class":2148},[2142,2583,2161],{"class":2148},[2142,2585,2164],{"class":2148},[2142,2587,2302],{"class":2167},[2142,2589,2152],{"class":2148},[2142,2591,2227],{"class":2148},[2142,2593,2594,2596,2599,2601,2603,2605,2608,2610],{"class":2144,"line":2371},[2142,2595,2480],{"class":2148},[2142,2597,2598],{"class":2155},"wrapped_at",[2142,2600,2152],{"class":2148},[2142,2602,2161],{"class":2148},[2142,2604,2164],{"class":2148},[2142,2606,2607],{"class":2167},"2026-10-09T12:00:00Z",[2142,2609,2152],{"class":2148},[2142,2611,2227],{"class":2148},[2142,2613,2614,2616,2618,2620,2622,2624,2626,2628,2630,2632,2634,2637,2639],{"class":2144,"line":2376},[2142,2615,2480],{"class":2148},[2142,2617,1874],{"class":2155},[2142,2619,2152],{"class":2148},[2142,2621,2161],{"class":2148},[2142,2623,2241],{"class":2148},[2142,2625,2152],{"class":2148},[2142,2627,2273],{"class":2246},[2142,2629,2152],{"class":2148},[2142,2631,2161],{"class":2148},[2142,2633,2164],{"class":2148},[2142,2635,2636],{"class":2167},"what the command printed",[2142,2638,2152],{"class":2148},[2142,2640,2641],{"class":2148},"}\n",[2142,2643,2644],{"class":2144,"line":2382},[2142,2645,2641],{"class":2148},[1855,2647,2648,2649,2651],{},"The key ID names the key without revealing it. ",[1888,2650,2539],{}," says which command wrapped the key; the server never runs a command named in a file, only the one you give it.",[1880,2653,2655],{"id":2654},"move-a-clusters-keys-under-a-command","Move a cluster's keys under a command",[1855,2657,2658],{},"On a server's machine, with the key file the servers use:",[2132,2660,2665],{"className":2661,"code":2662,"filename":2663,"language":2664,"meta":2138,"style":2138},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 1. Wrap the key. The plain file is kept as master.key.plain, and the round trip is checked first.\noz0 server master-key wrap --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command \\\n  --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster.key\n# 2. Copy the wrapped file to every server, and restart each with the command.\noz0 server start --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster.key \\\n  --master-key-command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command ...\n# 3. Once they run, shred the plain copy. You are asked again for the offline copy.\noz0 server master-key wrap --forget-plain --confirm-backup --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command \\\n  --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster.key --note \"safe 2, envelope 7\"\n","Terminal","bash",[1888,2666,2667,2673,2696,2704,2709,2726,2736,2741,2763],{"__ignoreMap":2138},[2142,2668,2669],{"class":2144,"line":2145},[2142,2670,2672],{"class":2671},"sHwdD","# 1. Wrap the key. The plain file is kept as master.key.plain, and the round trip is checked first.\n",[2142,2674,2675,2677,2680,2683,2686,2689,2692],{"class":2144,"line":2230},[2142,2676,1714],{"class":2246},[2142,2678,2679],{"class":2167}," server",[2142,2681,2682],{"class":2167}," master-key",[2142,2684,2685],{"class":2167}," wrap",[2142,2687,2688],{"class":2167}," --command",[2142,2690,2691],{"class":2167}," \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command",[2142,2693,2695],{"class":2694},"sTEyZ"," \\\n",[2142,2697,2698,2701],{"class":2144,"line":2342},[2142,2699,2700],{"class":2167},"  --master-key-file",[2142,2702,2703],{"class":2167}," \u002Fetc\u002Forchestrator-zero\u002Fmaster.key\n",[2142,2705,2706],{"class":2144,"line":2349},[2142,2707,2708],{"class":2671},"# 2. Copy the wrapped file to every server, and restart each with the command.\n",[2142,2710,2711,2713,2715,2718,2721,2724],{"class":2144,"line":2354},[2142,2712,1714],{"class":2246},[2142,2714,2679],{"class":2167},[2142,2716,2717],{"class":2167}," start",[2142,2719,2720],{"class":2167}," --master-key-file",[2142,2722,2723],{"class":2167}," \u002Fetc\u002Forchestrator-zero\u002Fmaster.key",[2142,2725,2695],{"class":2694},[2142,2727,2728,2731,2733],{"class":2144,"line":2360},[2142,2729,2730],{"class":2167},"  --master-key-command",[2142,2732,2691],{"class":2167},[2142,2734,2735],{"class":2167}," ...\n",[2142,2737,2738],{"class":2144,"line":2366},[2142,2739,2740],{"class":2671},"# 3. Once they run, shred the plain copy. You are asked again for the offline copy.\n",[2142,2742,2743,2745,2747,2749,2751,2754,2757,2759,2761],{"class":2144,"line":2371},[2142,2744,1714],{"class":2246},[2142,2746,2679],{"class":2167},[2142,2748,2682],{"class":2167},[2142,2750,2685],{"class":2167},[2142,2752,2753],{"class":2167}," --forget-plain",[2142,2755,2756],{"class":2167}," --confirm-backup",[2142,2758,2688],{"class":2167},[2142,2760,2691],{"class":2167},[2142,2762,2695],{"class":2694},[2142,2764,2765,2767,2769,2772,2774,2777],{"class":2144,"line":2376},[2142,2766,2700],{"class":2167},[2142,2768,2723],{"class":2167},[2142,2770,2771],{"class":2167}," --note",[2142,2773,2164],{"class":2148},[2142,2775,2776],{"class":2167},"safe 2, envelope 7",[2142,2778,2779],{"class":2148},"\"\n",[1855,2781,2782,2783,1943,2786,2788],{},"The secrets key moves the same way with ",[1888,2784,2785],{},"oz0 server secrets-key wrap --secrets-key-file ...",[1888,2787,1898],{}," on the edges.",[1855,2790,2791,2792,1913,2795,1959,2798,2801,2802,1913,2805,2808],{},"With the database (",[1888,2793,2794],{},"OZ0_DB",[1888,2796,2797],{},"--db-file",[1888,2799,2800],{},"--dev",") each step checks the key against the cluster (the master key must unseal it; the secrets key must be the one the cluster seals to) and writes an audit entry: ",[1888,2803,2804],{},"key.wrapped",[1888,2806,2807],{},"key.plain_forgotten",". An edge apart from management has no database: there the commands run without it, and say so.",[1855,2810,2811,2812,2815],{},"Until step 3, every server that starts through the command finds the plain copy beside its key file, says so in its log, and ",[1888,2813,2814],{},"oz0 doctor","'s key source check warns with the step that shreds it.",[1855,2817,2818],{},"Overwriting a file does not erase it everywhere: on SSDs and copy-on-write file systems the old blocks can survive. Treat a machine that held the plain file as having held the key.",[1855,2820,2821],{},"A new cluster can start wrapped, so the key is never on disk in the clear:",[2132,2823,2825],{"className":2661,"code":2824,"filename":2663,"language":2664,"meta":2138,"style":2138},"oz0 server init --master-key-out \u002Fetc\u002Forchestrator-zero\u002Fmaster.key --master-key-command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command ...\noz0 server secrets-key create --out \u002Fetc\u002Forchestrator-zero\u002Fsecrets.key --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command\n",[1888,2826,2827,2848],{"__ignoreMap":2138},[2142,2828,2829,2831,2833,2836,2839,2841,2844,2846],{"class":2144,"line":2145},[2142,2830,1714],{"class":2246},[2142,2832,2679],{"class":2167},[2142,2834,2835],{"class":2167}," init",[2142,2837,2838],{"class":2167}," --master-key-out",[2142,2840,2723],{"class":2167},[2142,2842,2843],{"class":2167}," --master-key-command",[2142,2845,2691],{"class":2167},[2142,2847,2735],{"class":2167},[2142,2849,2850,2852,2854,2857,2860,2863,2866,2868],{"class":2144,"line":2230},[2142,2851,1714],{"class":2246},[2142,2853,2679],{"class":2167},[2142,2855,2856],{"class":2167}," secrets-key",[2142,2858,2859],{"class":2167}," create",[2142,2861,2862],{"class":2167}," --out",[2142,2864,2865],{"class":2167}," \u002Fetc\u002Forchestrator-zero\u002Fsecrets.key",[2142,2867,2688],{"class":2167},[2142,2869,2870],{"class":2167}," \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command\n",[1880,2872,2874],{"id":2873},"rotate-the-wrapping-key","Rotate the wrapping key",[1855,2876,2877],{},"A new KMS key, a new key version, a new alias, new credentials or a new endpoint: rewrap.",[2132,2879,2881],{"className":2661,"code":2880,"filename":2663,"language":2664,"meta":2138,"style":2138},"oz0 server master-key wrap --rewrap --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command \\\n  --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster.key\n",[1888,2882,2883,2902],{"__ignoreMap":2138},[2142,2884,2885,2887,2889,2891,2893,2896,2898,2900],{"class":2144,"line":2145},[2142,2886,1714],{"class":2246},[2142,2888,2679],{"class":2167},[2142,2890,2682],{"class":2167},[2142,2892,2685],{"class":2167},[2142,2894,2895],{"class":2167}," --rewrap",[2142,2897,2688],{"class":2167},[2142,2899,2691],{"class":2167},[2142,2901,2695],{"class":2694},[2142,2903,2904,2906],{"class":2144,"line":2230},[2142,2905,2700],{"class":2167},[2142,2907,2703],{"class":2167},[1855,2909,2910,2911,2914,2915,2918,2919,2922,2923,2926],{},"It unwraps through ",[1888,2912,2913],{},"--from-command"," (by default ",[1888,2916,2917],{},"--command","), wraps the same key again, checks the round trip, keeps the old document as ",[1888,2920,2921],{},"master.key.prev"," and writes the new one in place (",[1888,2924,2925],{},"key.rewrapped"," in the audit log). The key itself does not change, so nothing sealed under it changes, and your backup confirmations stay valid. Copy the new file to every server; servers that still have the old one keep working as long as the old wrapping key can unwrap it.",[1880,2928,2930],{"id":2929},"the-way-out","The way out",[1855,2932,2933,2936],{},[1888,2934,2935],{},"unwrap-to-file"," moves a key back to a plain file, so the command, and whatever holds its wrapping key, can be taken away:",[2132,2938,2940],{"className":2661,"code":2939,"filename":2663,"language":2664,"meta":2138,"style":2138},"oz0 server master-key unwrap-to-file --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command \\\n  --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster.key\noz0 server secrets-key unwrap-to-file --command \u002Fusr\u002Flocal\u002Fbin\u002Foz0-key-command \\\n  --secrets-key-file \u002Fetc\u002Forchestrator-zero\u002Fsecrets.key\n",[1888,2941,2942,2959,2965,2981],{"__ignoreMap":2138},[2142,2943,2944,2946,2948,2950,2953,2955,2957],{"class":2144,"line":2145},[2142,2945,1714],{"class":2246},[2142,2947,2679],{"class":2167},[2142,2949,2682],{"class":2167},[2142,2951,2952],{"class":2167}," unwrap-to-file",[2142,2954,2688],{"class":2167},[2142,2956,2691],{"class":2167},[2142,2958,2695],{"class":2694},[2142,2960,2961,2963],{"class":2144,"line":2230},[2142,2962,2700],{"class":2167},[2142,2964,2703],{"class":2167},[2142,2966,2967,2969,2971,2973,2975,2977,2979],{"class":2144,"line":2342},[2142,2968,1714],{"class":2246},[2142,2970,2679],{"class":2167},[2142,2972,2856],{"class":2167},[2142,2974,2952],{"class":2167},[2142,2976,2688],{"class":2167},[2142,2978,2691],{"class":2167},[2142,2980,2695],{"class":2694},[2142,2982,2983,2986],{"class":2144,"line":2349},[2142,2984,2985],{"class":2167},"  --secrets-key-file",[2142,2987,2988],{"class":2167}," \u002Fetc\u002Forchestrator-zero\u002Fsecrets.key\n",[1855,2990,2991,2992,2995,2996,2999,3000,3002],{},"It unwraps once more and writes the plain key, mode 0600, in place of the wrapped file, which is kept as ",[1888,2993,2994],{},"master.key.wrapped","; or at ",[1888,2997,2998],{},"--out",", which must not exist. Then start the servers without the command. It needs only ",[1888,3001,2187],{}," from the command.",[1880,3004,3006],{"id":3005},"keep-an-offline-copy","Keep an offline copy",[1855,3008,3009,3010,3013,3014,3017,3018,2296],{},"The ",[1865,3011,3012],{"href":1401},"offline copy of the master key"," is still your last way back: if the wrapping key is lost, a wrapped file cannot be opened. If you made the key under a command and never had it in plain, write one copy to offline media with ",[1888,3015,3016],{},"unwrap-to-file --out",", then record it with ",[1888,3019,3020],{},"oz0 server master-key confirm-backup",[1880,3022,3024],{"id":3023},"kubernetes","Kubernetes",[1855,3026,3027,3028,3031,3032,1913,3035,3038,3039,2296],{},"The chart takes ",[1888,3029,3030],{},"masterKey.command"," and, with ",[1888,3033,3034],{},"roles.separate",[1888,3036,3037],{},"roles.edge.secretsKey.command",". The Secrets then hold the wrapped files, and the command must be in the server image or on a volume, like ",[1888,3040,3041],{},"caSigner.command",[1880,3043,1266],{"id":3044},"doctor",[1855,3046,3047,3049],{},[1888,3048,2814],{}," has two checks:",[1904,3051,3052,3055],{},[1907,3053,3054],{},"master key source: which running servers read the master key from a plain file and which through a key command, with what the command says holds its wrapping key;",[1907,3056,3057],{},"secrets key source: the same for the edges' secrets key.",[1855,3059,3060],{},"Each warns when a server's last unwrap failed (recorded when the server could reach the database) or when its command could not reach the wrapping key at its last check. A server whose command stops answering keeps running on the key it unwrapped, but will not start again until the command answers. The fix says how to move the key back to a plain file.",[1880,3062,3064],{"id":3063},"next","Next",[1904,3066,3067,3072,3077],{},[1907,3068,3069,3071],{},[1865,3070,1243],{"href":1244},": the cluster CA's signing command, the same idea for the CA's key",[1907,3073,3074],{},[1865,3075,3076],{"href":1401},"Upgrades, backups and restores",[1907,3078,3079],{},[1865,3080,1266],{"href":1267},[3082,3083,3084],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":2138,"searchDepth":2230,"depth":2230,"links":3086},[3087,3088,3091,3092,3093,3094,3095,3096,3097,3098],{"id":1882,"depth":2230,"text":1883},{"id":2042,"depth":2230,"text":2043,"children":3089},[3090],{"id":2310,"depth":2342,"text":2311},{"id":2460,"depth":2230,"text":2461},{"id":2654,"depth":2230,"text":2655},{"id":2873,"depth":2230,"text":2874},{"id":2929,"depth":2230,"text":2930},{"id":3005,"depth":2230,"text":3006},{"id":3023,"depth":2230,"text":3024},{"id":3044,"depth":2230,"text":1266},{"id":3063,"depth":2230,"text":3064},"Keep the master key and the secrets key wrapped on disk, with the key that unwraps them in an HSM or a KMS, and move them back to plain files.","md",null,{"audience":3103,"doc_type":3104},"cluster and tenant administrators","how-to",{"icon":1629},{"title":1655,"description":3099},"vhmtzNt-K8bXAw9_JD1hDe6EbHjBcK9jhbczvW8dOD0",[3109,3111],{"title":1651,"path":1652,"stem":1653,"description":3110,"icon":1629,"children":-1},"Bind a secret to the host it goes to: plugin processes hold a placeholder, and the node's egress proxy puts the value on requests to that host only. Secrets in a model's arguments, filled in after the policy.",{"title":1659,"path":1660,"stem":1661,"description":3112,"icon":782,"children":-1},"Complete the connection flow and check the resulting identity and access.",1794442929459]