[{"data":1,"prerenderedAt":3511},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fadmin\u002Fnotifications":1849,"docs-surround:\u002Fadmin\u002Fnotifications":3506},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1697,"body":1851,"description":3497,"extension":3498,"links":3499,"meta":3500,"navigation":3503,"path":1698,"seo":3504,"stem":1699,"__hash__":3505},"docs\u002F09.admin\u002F08.notifications.md",{"type":1852,"value":1853,"toc":3487},"minimark",[1854,1858,1861,1869,1874,1877,2043,2425,2459,2466,2469,2482,2486,2489,2539,2550,2568,2579,2582,2628,2635,2646,2650,2657,2978,2981,3040,3047,3050,3057,3066,3069,3087,3094,3097,3114,3119,3122,3175,3181,3185,3188,3199,3214,3226,3244,3343,3356,3360,3367,3410,3463,3469,3472,3476,3483],[1855,1856,1857],"p",{},"For: cluster and tenant administrators.",[1855,1859,1860],{},"Create rules for events that people or systems must act on. Configure the destination and inspect its delivery results.",[1855,1862,1863,1864,1868],{},"An ",[1865,1866,1867],"a",{"href":270},"approval"," that nobody sees waits until its deadline denies it. Notification rules tell the right people when something waits for them: by email through your own mail relay, by a signed webhook to your own systems, or in a chat channel.",[1870,1871,1873],"h2",{"id":1872},"rules","Rules",[1855,1875,1876],{},"A tenant's admins keep its rules. A rule names events, may narrow them to agents, tools and risk classes, and sends them to targets:",[1878,1879,1885],"pre",{"className":1880,"code":1881,"filename":1882,"language":1883,"meta":1884,"style":1884},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","oz0 notify rule put payments --event approval.waiting --event approval.escalated --tool 'bank.*' \\\n  --email-team payments --email-role admin\noz0 notify rule put desk --event approval.waiting --risk destructive \\\n  --webhook https:\u002F\u002Fdesk.acme.example\u002Foz0 --secret DESK_HOOK_KEY --decide-key 3f9a1c2b7d4e\noz0 notify rule list\noz0 notify rule test payments      # one test notification to each target\noz0 notify rule delete nr-0881cb5609f6\n","Terminal","bash","",[1886,1887,1888,1937,1951,1977,1998,2010,2028],"code",{"__ignoreMap":1884},[1889,1890,1893,1896,1900,1903,1906,1909,1912,1915,1917,1920,1923,1927,1930,1933],"span",{"class":1891,"line":1892},"line",1,[1889,1894,1714],{"class":1895},"sBMFI",[1889,1897,1899],{"class":1898},"sfazB"," notify",[1889,1901,1902],{"class":1898}," rule",[1889,1904,1905],{"class":1898}," put",[1889,1907,1908],{"class":1898}," payments",[1889,1910,1911],{"class":1898}," --event",[1889,1913,1914],{"class":1898}," approval.waiting",[1889,1916,1911],{"class":1898},[1889,1918,1919],{"class":1898}," approval.escalated",[1889,1921,1922],{"class":1898}," --tool",[1889,1924,1926],{"class":1925},"sMK4o"," '",[1889,1928,1929],{"class":1898},"bank.*",[1889,1931,1932],{"class":1925},"'",[1889,1934,1936],{"class":1935},"sTEyZ"," \\\n",[1889,1938,1940,1943,1945,1948],{"class":1891,"line":1939},2,[1889,1941,1942],{"class":1898},"  --email-team",[1889,1944,1908],{"class":1898},[1889,1946,1947],{"class":1898}," --email-role",[1889,1949,1950],{"class":1898}," admin\n",[1889,1952,1954,1956,1958,1960,1962,1965,1967,1969,1972,1975],{"class":1891,"line":1953},3,[1889,1955,1714],{"class":1895},[1889,1957,1899],{"class":1898},[1889,1959,1902],{"class":1898},[1889,1961,1905],{"class":1898},[1889,1963,1964],{"class":1898}," desk",[1889,1966,1911],{"class":1898},[1889,1968,1914],{"class":1898},[1889,1970,1971],{"class":1898}," --risk",[1889,1973,1974],{"class":1898}," destructive",[1889,1976,1936],{"class":1935},[1889,1978,1980,1983,1986,1989,1992,1995],{"class":1891,"line":1979},4,[1889,1981,1982],{"class":1898},"  --webhook",[1889,1984,1985],{"class":1898}," https:\u002F\u002Fdesk.acme.example\u002Foz0",[1889,1987,1988],{"class":1898}," --secret",[1889,1990,1991],{"class":1898}," DESK_HOOK_KEY",[1889,1993,1994],{"class":1898}," --decide-key",[1889,1996,1997],{"class":1898}," 3f9a1c2b7d4e\n",[1889,1999,2001,2003,2005,2007],{"class":1891,"line":2000},5,[1889,2002,1714],{"class":1895},[1889,2004,1899],{"class":1898},[1889,2006,1902],{"class":1898},[1889,2008,2009],{"class":1898}," list\n",[1889,2011,2013,2015,2017,2019,2022,2024],{"class":1891,"line":2012},6,[1889,2014,1714],{"class":1895},[1889,2016,1899],{"class":1898},[1889,2018,1902],{"class":1898},[1889,2020,2021],{"class":1898}," test",[1889,2023,1908],{"class":1898},[1889,2025,2027],{"class":2026},"sHwdD","      # one test notification to each target\n",[1889,2029,2031,2033,2035,2037,2040],{"class":1891,"line":2030},7,[1889,2032,1714],{"class":1895},[1889,2034,1899],{"class":1898},[1889,2036,1902],{"class":1898},[1889,2038,2039],{"class":1898}," delete",[1889,2041,2042],{"class":1898}," nr-0881cb5609f6\n",[2044,2045,2046,2059],"table",{},[2047,2048,2049],"thead",{},[2050,2051,2052,2056],"tr",{},[2053,2054,2055],"th",{},"Event",[2053,2057,2058],{},"When",[2060,2061,2062,2073,2088,2098,2111,2126,2136,2151,2166,2180,2195,2209,2224,2242,2256,2270,2285,2300,2322,2337,2352,2367,2384,2394,2408],"tbody",{},[2050,2063,2064,2070],{},[2065,2066,2067],"td",{},[1886,2068,2069],{},"approval.waiting",[2065,2071,2072],{},"an approval starts waiting",[2050,2074,2075,2080],{},[2065,2076,2077],{},[1886,2078,2079],{},"approval.escalated",[2065,2081,2082,2083,2087],{},"the ",[1865,2084,2086],{"href":2085},"\u002Fagents\u002Fapprovals\u002Fconfigure#the-escalation-ladder","escalation ladder"," takes a step",[2050,2089,2090,2095],{},[2065,2091,2092],{},[1886,2093,2094],{},"approval.expired",[2065,2096,2097],{},"the deadline denied it",[2050,2099,2100,2105],{},[2065,2101,2102],{},[1886,2103,2104],{},"question.waiting",[2065,2106,2107,2108],{},"an agent ",[1865,2109,2110],{"href":301},"asks a person",[2050,2112,2113,2118],{},[2065,2114,2115],{},[1886,2116,2117],{},"budget_request.waiting",[2065,2119,2120,2121,2125],{},"a ",[1865,2122,2124],{"href":2123},"\u002Fspend\u002Fbudgets-and-quotas\u002Frequests#ask-for-more","budget request"," waits",[2050,2127,2128,2133],{},[2065,2129,2130],{},[1886,2131,2132],{},"job.failed",[2065,2134,2135],{},"a job failed",[2050,2137,2138,2143],{},[2065,2139,2140],{},[1886,2141,2142],{},"budget.share",[2065,2144,2145,2146,2150],{},"spending reached one of the tenant's ",[1865,2147,2149],{"href":2148},"\u002Fspend\u002Fbudgets-and-quotas\u002Frequests#my-budget-and-spend-alerts","spend alerts"," of a budget (80% and 100% by default; the 100% alert says whether jobs wait and who decides)",[2050,2152,2153,2158],{},[2065,2154,2155],{},[1886,2156,2157],{},"eval.regression",[2065,2159,2160,2161,2165],{},"an ",[1865,2162,2164],{"href":2163},"\u002Fimprove\u002Fevals\u002Fregressions#scheduled-evals","eval routine"," confirmed a regression (facts only: the eval, the cases that flipped, the finding)",[2050,2167,2168,2173],{},[2065,2169,2170],{},[1886,2171,2172],{},"model.changed",[2065,2174,2120,2175,2179],{},[1865,2176,2178],{"href":2177},"\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement#model-canaries","model canary"," saw the model behind a route change",[2050,2181,2182,2187],{},[2065,2183,2184],{},[1886,2185,2186],{},"tool_rule.expiring",[2065,2188,2189,2190,2194],{},"a rule of the ",[1865,2191,2193],{"href":2192},"\u002Fgovern\u002Ftool-policy\u002Freview-changes#shadow-mode-and-ends","tool policy"," ends within a week (once per rule and end)",[2050,2196,2197,2202],{},[2065,2198,2199],{},[1886,2200,2201],{},"secret.expiring",[2065,2203,2120,2204,2208],{},[1865,2205,2207],{"href":2206},"\u002Fadmin\u002Fsecrets\u002Frotation#expiry-and-reminders","secret's expiry"," is days away: 14, 3 and 1 by default (once per secret, expiry and day); it also goes by email to the tenant's admins and whoever set the secret, and names the secret, its expiry and the days left, never a value or the setter",[2050,2210,2211,2216],{},[2065,2212,2213],{},[1886,2214,2215],{},"incident.deadline",[2065,2217,2218,2219,2223],{},"a deadline of an ",[1865,2220,2222],{"href":2221},"\u002Fgovern\u002Fincidents#reminders","incident"," is near, or passed with its stage not marked (once per reminder point); the owner and the tenant's admins get it by email whatever the rules say",[2050,2225,2226,2231],{},[2065,2227,2228],{},[1886,2229,2230],{},"plugin.vulnerable",[2065,2232,2233,2234,2237,2238,2241],{},"an installed plugin version locks a package with a ",[1865,2235,2236],{"href":499},"known vulnerability"," new to it (once per version and set of advisories; also to the owner persons of its agents, flows and tools and the tenant's admins); ",[1886,2239,2240],{},"--tool"," filters on the plugin's name",[2050,2243,2244,2249],{},[2065,2245,2246],{},[1886,2247,2248],{},"label_source.unlabelled",[2065,2250,2251,2252,2255],{},"a tool that declares a label source returned results without a level, so the tenant's default level applied (",[1865,2253,1152],{"href":2254},"\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies#label-sources-that-do-not-label","): once per function and day, also to the tool's owner person and the tenant's admins; counts per function, never per person",[2050,2257,2258,2263],{},[2065,2259,2260],{},[1886,2261,2262],{},"quality.drift",[2065,2264,2120,2265,2269],{},[1865,2266,2268],{"href":2267},"\u002Fimprove\u002Fevals\u002Fregressions#drift-which-of-the-model-the-judge-or-the-agent-changed","drift finding"," names its cause for an agent: the model behind a name, the judge on its anchors, the agent's consistency, or the plugin's version (facts only: the cause and the finding; once per finding and evidence)",[2050,2271,2272,2277],{},[2065,2273,2274],{},[1886,2275,2276],{},"model.retiring",[2065,2278,2279,2280,2284],{},"a model an agent pins ",[1865,2281,2283],{"href":2282},"\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement#when-a-model-retires","retires soon",": when the notice starts (30 days by default), at seven days and one day left, and on the date (facts: the provider, the model, the date, its successor, the days left)",[2050,2286,2287,2292],{},[2065,2288,2289],{},[1886,2290,2291],{},"spend.anomaly",[2065,2293,2294,2295,2299],{},"a day's spend was far above its usual (the ",[1865,2296,2298],{"href":2297},"\u002Fspend\u002Fcost-and-usage#spend-anomalies","spend-anomaly finding",", once per day): the day, its spend and usual, and what rose most by agent, model and plugin; never a team or a person",[2050,2301,2302,2307],{},[2065,2303,2304],{},[1886,2305,2306],{},"plugin.custody",[2065,2308,2309,2310,2314,2315,2319,2320,2241],{},"a refresh of an index finds that an installed plugin's listing ",[1865,2311,2313],{"href":2312},"\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate#a-plugin-that-moved","moved"," or that its newest version is in ",[1865,2316,2318],{"href":2317},"\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate#updates-from-new-hands","new hands"," (once per plugin and listing state; also by email to the tenant's admins): the plugin, its listing and where it moved or the new custody epoch; ",[1886,2321,2240],{},[2050,2323,2324,2329],{},[2065,2325,2326],{},[1886,2327,2328],{},"approval.pattern",[2065,2330,2331,2332,2336],{},"most decisions in a queue came within seconds of the card being shown (the ",[1865,2333,2335],{"href":2334},"\u002Fagents\u002Fapprovals\u002Fstatistics#approver-statistics","approval pattern finding",", once per finding): the queue (the tenant's or a team's of five people or more), the share and the number of decisions; never a person",[2050,2338,2339,2344],{},[2065,2340,2341],{},[1886,2342,2343],{},"approval.flood",[2065,2345,2346,2347,2351],{},"one job tree or one agent asked a flood of approvals (the ",[1865,2348,2350],{"href":2349},"\u002Fagents\u002Fapprovals\u002Fstatistics#load-and-floods","flood finding",", once per finding): how many, in what time, and the agent or job tree",[2050,2353,2354,2359],{},[2065,2355,2356],{},[1886,2357,2358],{},"decision.contested",[2065,2360,2361,2362,2366],{},"a person contests the ",[1865,2363,2365],{"href":2364},"\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests#decision-records-and-contests","decision record"," of an agent's job (once per contest); it also goes by email to the agent's owner person, and names the agent, the job and the contest, never the person or what they dispute",[2050,2368,2369,2374],{},[2065,2370,2371],{},[1886,2372,2373],{},"plugin.retired",[2065,2375,2376,2377,2381,2382,2241],{},"a plugin was ",[1865,2378,2380],{"href":2379},"\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove#retire","retired"," (once per retirement): its name and the reason; also by email to the owner persons of its agents, flows and tools, else their teams' admins, else the tenant's admins; ",[1886,2383,2240],{},[2050,2385,2386,2391],{},[2065,2387,2388],{},[1886,2389,2390],{},"dependency.retired",[2065,2392,2393],{},"a plugin that others depend on was retired (once per retirement): which plugin and what depends on it; also by email to the owner persons and team admins of the dependent plugins, flows and routines, else the tenant's admins",[2050,2395,2396,2401],{},[2065,2397,2398],{},[1886,2399,2400],{},"team.orphaned",[2065,2402,2403,2404],{},"a team that owns routines or inventory items has no person as a member, or no person as its admin (once per orphaning): the team, why, since when and what it owns; also by email to the tenant's admins. See ",[1865,2405,2407],{"href":2406},"\u002Fspend\u002Fbudgets-and-quotas#teams-that-nobody-answers-for","teams that nobody answers for",[2050,2409,2410,2415],{},[2065,2411,2412],{},[1886,2413,2414],{},"connection.reconnect",[2065,2416,2417,2418,2422,2423,2241],{},"a connection's provider refused to renew its token (a revoked, expired or spent refresh token), so its tools' calls get none until it is ",[1865,2419,2421],{"href":2420},"\u002Fadmin\u002Fconnections\u002Frenewal#reconnecting","connected again"," (once per refusal): the connection, its plugin and the provider's reason, never a token; also by email to the tenant's admins; ",[1886,2424,2240],{},[1855,2426,2427,2429,2430,2433,2434,2437,2438,2441,2442,2429,2445,2448,2449,2448,2452,2433,2455,2458],{},[1886,2428,2240],{}," takes ",[1886,2431,2432],{},"\u003Ctool>"," or ",[1886,2435,2436],{},"\u003Ctool>.\u003Cfunction>",", with ",[1886,2439,2440],{},"*"," for anything; ",[1886,2443,2444],{},"--risk",[1886,2446,2447],{},"read_only",", ",[1886,2450,2451],{},"destructive",[1886,2453,2454],{},"open_world",[1886,2456,2457],{},"undeclared",". The ladder's own steps reach the people the step names (the people who may decide, the agent's owner, the tenant's admins) by email, whatever the rules say, once the operator has configured email; rules add more targets and the other events.",[1855,2460,2461,2462,2465],{},"In the console, Settings, Notifications lists the tenant's rules with their latest deliveries. Add notification rule opens the form in a dialog; cancelling clears the draft, and a rejected save keeps it for correction. Each person sets the address their own notifications go to on the same tab. ",[1886,2463,2464],{},"oz0 notify rule list"," shows each rule's latest deliveries with their state, attempts and last error.",[1855,2467,2468],{},"Rules reach only the tenant's current members: someone who left the tenant, or whose account is disabled, gets nothing, even when a team or an agent's owner still names them. When the agent's owner has left, the ladder's owner step goes to the owner team's admins, then its members, then the tenant's admins, so it never reaches nobody.",[1855,2470,2471,2472,2448,2475,2448,2478,2481],{},"Operators, admins and owners of the tenant may list its rules; only its admins and owners put, delete and test them. Operators see a webhook's scheme and host only, since its URL may carry a token; admins see the whole URL they edit. Every change is in the audit trail (",[1886,2473,2474],{},"notify.rule.put",[1886,2476,2477],{},"notify.rule.delete",[1886,2479,2480],{},"notify.rule.test",").",[1870,2483,2485],{"id":2484},"email","Email",[1855,2487,2488],{},"Email goes through an SMTP relay the operator configures for the cluster, and is off until then:",[1878,2490,2492],{"className":1880,"code":2491,"filename":1882,"language":1883,"meta":1884,"style":1884},"orchestrator-zero server start --smtp-addr smtp.acme.example:587 --smtp-from oz0@acme.example \\\n  --smtp-user oz0 --smtp-password-file \u002Fetc\u002Foz0\u002Fsmtp-password --smtp-tls starttls\n",[1886,2493,2494,2519],{"__ignoreMap":1884},[1889,2495,2496,2499,2502,2505,2508,2511,2514,2517],{"class":1891,"line":1892},[1889,2497,2498],{"class":1895},"orchestrator-zero",[1889,2500,2501],{"class":1898}," server",[1889,2503,2504],{"class":1898}," start",[1889,2506,2507],{"class":1898}," --smtp-addr",[1889,2509,2510],{"class":1898}," smtp.acme.example:587",[1889,2512,2513],{"class":1898}," --smtp-from",[1889,2515,2516],{"class":1898}," oz0@acme.example",[1889,2518,1936],{"class":1935},[1889,2520,2521,2524,2527,2530,2533,2536],{"class":1891,"line":1939},[1889,2522,2523],{"class":1898},"  --smtp-user",[1889,2525,2526],{"class":1898}," oz0",[1889,2528,2529],{"class":1898}," --smtp-password-file",[1889,2531,2532],{"class":1898}," \u002Fetc\u002Foz0\u002Fsmtp-password",[1889,2534,2535],{"class":1898}," --smtp-tls",[1889,2537,2538],{"class":1898}," starttls\n",[1855,2540,2541,2542,2545,2546,2549],{},"Mail always goes over TLS: STARTTLS (port 587, the default) or TLS from the start (",[1886,2543,2544],{},"--smtp-tls tls",", port 465), and the relay's certificate is verified (",[1886,2547,2548],{},"--smtp-ca-file"," for a relay with a private CA). The password comes from a file, never a flag. The edge sends the mail; nodes never do.",[1855,2551,2552,2553,2555,2556,2559,2560,2563,2564,2567],{},"The same relay also carries the mail agents send when a tenant installs ",[1865,2554,595],{"href":596},": the edge sends it too, only to the tenant's own mail domains unless the tenant allows others, with the AI label, and records each message. It goes from ",[1886,2557,2558],{},"--smtp-from"," unless the operator lists the tenant's sender's domain for that tenant with ",[1886,2561,2562],{},"--smtp-sender-domains \u003Ctenant>=\u003Cdomain>"," (repeatable); otherwise the tenant's sender is its ",[1886,2565,2566],{},"Reply-To",". A notification's mail is not changed by it.",[1855,2569,2570,2571,2574,2575,2578],{},"A person gets mail at the address their identity provider gives when they sign in, or the one they set themselves (Settings, Notifications, or ",[1886,2572,2573],{},"oz0 notify address ana@acme.example","; ",[1886,2576,2577],{},"-"," removes it). A password account has none until its person sets one. Rules name people by role, team or account name, never by address.",[1855,2580,2581],{},"A notification carries the event's facts: the tenant, the agent and its version, the tool, the job's link, the deadline and the ladder's step. It never carries a link or a code that decides anything: the person opens OZ and decides there. It never carries the call's arguments unless the tenant's admins turn that on:",[1878,2583,2585],{"className":1880,"code":2584,"filename":1882,"language":1883,"meta":1884,"style":1884},"oz0 tenant notify-content acme arguments --reason \"the payments desk decides from email\"\noz0 tenant notify-content acme facts\n",[1886,2586,2587,2615],{"__ignoreMap":1884},[1889,2588,2589,2591,2594,2597,2600,2603,2606,2609,2612],{"class":1891,"line":1892},[1889,2590,1714],{"class":1895},[1889,2592,2593],{"class":1898}," tenant",[1889,2595,2596],{"class":1898}," notify-content",[1889,2598,2599],{"class":1898}," acme",[1889,2601,2602],{"class":1898}," arguments",[1889,2604,2605],{"class":1898}," --reason",[1889,2607,2608],{"class":1925}," \"",[1889,2610,2611],{"class":1898},"the payments desk decides from email",[1889,2613,2614],{"class":1925},"\"\n",[1889,2616,2617,2619,2621,2623,2625],{"class":1891,"line":1939},[1889,2618,1714],{"class":1895},[1889,2620,2593],{"class":1898},[1889,2622,2596],{"class":1898},[1889,2624,2599],{"class":1898},[1889,2626,2627],{"class":1898}," facts\n",[1855,2629,2630,2631,2634],{},"Even then, an email carries the arguments only to a person who could read them in OZ: one who holds the content permission in the tenant, for a job that is not a turn of someone else's private ",[1865,2632,2633],{"href":252},"chat",". Everyone else gets the facts. This is checked when the mail is sent, so a person who lost the permission before a retry gets the facts too. A webhook carries the arguments when the tenant's setting says so, since its admins chose the endpoint. Chat channel targets carry facts.",[1855,2636,2637,2638,2641,2642,2645],{},"Arguments can hold personal data, which then leaves OZ to the mail relay and to every webhook endpoint. Whether a tenant may send them there is a legal question for your organisation; OZ keeps facts only unless an admin decides otherwise, records who did and why (",[1886,2639,2640],{},"tenant.notify_content","), and treats it as a setting that loosens oversight. Text an agent wrote carries the tenant's ",[1865,2643,2644],{"href":1113},"AI label",".",[1870,2647,2649],{"id":2648},"webhooks","Webhooks",[1855,2651,2652,2653,2656],{},"A webhook target gets a JSON ",[1886,2654,2655],{},"POST"," for each event:",[1878,2658,2662],{"className":2659,"code":2660,"language":2661,"meta":1884,"style":1884},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"type\": \"approval.escalated\",\n  \"tenant\": \"acme\",\n  \"agent\": \"payer\",\n  \"tool\": \"bank.pay\",\n  \"job\": \"job-1e71252a-...\",\n  \"job_url\": \"https:\u002F\u002Foz.acme.example\u002Ft\u002Facme\u002Fjobs\u002Fjob-1e71252a-...\",\n  \"approval\": \"a-5ccd30628bdc\",\n  \"step\": 2,\n  \"steps\": 3,\n  \"to\": \"owner\",\n  \"level\": \"L2\",\n  \"requested_at\": \"2026-10-08T21:01:29Z\",\n  \"deadline\": \"2026-10-09T21:01:29Z\",\n  \"at\": \"2026-10-09T09:01:29Z\",\n  \"decide\": \"decide in OZ (oz0 approval approve|deny), or with an API key through the runtime API's DecideApproval; poll ListApprovals for the outcome\"\n}\n","json",[1886,2663,2664,2669,2693,2713,2733,2753,2773,2793,2813,2831,2848,2869,2890,2911,2932,2953,2972],{"__ignoreMap":1884},[1889,2665,2666],{"class":1891,"line":1892},[1889,2667,2668],{"class":1925},"{\n",[1889,2670,2671,2674,2678,2681,2684,2686,2688,2690],{"class":1891,"line":1939},[1889,2672,2673],{"class":1925},"  \"",[1889,2675,2677],{"class":2676},"spNyl","type",[1889,2679,2680],{"class":1925},"\"",[1889,2682,2683],{"class":1925},":",[1889,2685,2608],{"class":1925},[1889,2687,2079],{"class":1898},[1889,2689,2680],{"class":1925},[1889,2691,2692],{"class":1925},",\n",[1889,2694,2695,2697,2700,2702,2704,2706,2709,2711],{"class":1891,"line":1953},[1889,2696,2673],{"class":1925},[1889,2698,2699],{"class":2676},"tenant",[1889,2701,2680],{"class":1925},[1889,2703,2683],{"class":1925},[1889,2705,2608],{"class":1925},[1889,2707,2708],{"class":1898},"acme",[1889,2710,2680],{"class":1925},[1889,2712,2692],{"class":1925},[1889,2714,2715,2717,2720,2722,2724,2726,2729,2731],{"class":1891,"line":1979},[1889,2716,2673],{"class":1925},[1889,2718,2719],{"class":2676},"agent",[1889,2721,2680],{"class":1925},[1889,2723,2683],{"class":1925},[1889,2725,2608],{"class":1925},[1889,2727,2728],{"class":1898},"payer",[1889,2730,2680],{"class":1925},[1889,2732,2692],{"class":1925},[1889,2734,2735,2737,2740,2742,2744,2746,2749,2751],{"class":1891,"line":2000},[1889,2736,2673],{"class":1925},[1889,2738,2739],{"class":2676},"tool",[1889,2741,2680],{"class":1925},[1889,2743,2683],{"class":1925},[1889,2745,2608],{"class":1925},[1889,2747,2748],{"class":1898},"bank.pay",[1889,2750,2680],{"class":1925},[1889,2752,2692],{"class":1925},[1889,2754,2755,2757,2760,2762,2764,2766,2769,2771],{"class":1891,"line":2012},[1889,2756,2673],{"class":1925},[1889,2758,2759],{"class":2676},"job",[1889,2761,2680],{"class":1925},[1889,2763,2683],{"class":1925},[1889,2765,2608],{"class":1925},[1889,2767,2768],{"class":1898},"job-1e71252a-...",[1889,2770,2680],{"class":1925},[1889,2772,2692],{"class":1925},[1889,2774,2775,2777,2780,2782,2784,2786,2789,2791],{"class":1891,"line":2030},[1889,2776,2673],{"class":1925},[1889,2778,2779],{"class":2676},"job_url",[1889,2781,2680],{"class":1925},[1889,2783,2683],{"class":1925},[1889,2785,2608],{"class":1925},[1889,2787,2788],{"class":1898},"https:\u002F\u002Foz.acme.example\u002Ft\u002Facme\u002Fjobs\u002Fjob-1e71252a-...",[1889,2790,2680],{"class":1925},[1889,2792,2692],{"class":1925},[1889,2794,2796,2798,2800,2802,2804,2806,2809,2811],{"class":1891,"line":2795},8,[1889,2797,2673],{"class":1925},[1889,2799,1867],{"class":2676},[1889,2801,2680],{"class":1925},[1889,2803,2683],{"class":1925},[1889,2805,2608],{"class":1925},[1889,2807,2808],{"class":1898},"a-5ccd30628bdc",[1889,2810,2680],{"class":1925},[1889,2812,2692],{"class":1925},[1889,2814,2816,2818,2821,2823,2825,2829],{"class":1891,"line":2815},9,[1889,2817,2673],{"class":1925},[1889,2819,2820],{"class":2676},"step",[1889,2822,2680],{"class":1925},[1889,2824,2683],{"class":1925},[1889,2826,2828],{"class":2827},"sbssI"," 2",[1889,2830,2692],{"class":1925},[1889,2832,2834,2836,2839,2841,2843,2846],{"class":1891,"line":2833},10,[1889,2835,2673],{"class":1925},[1889,2837,2838],{"class":2676},"steps",[1889,2840,2680],{"class":1925},[1889,2842,2683],{"class":1925},[1889,2844,2845],{"class":2827}," 3",[1889,2847,2692],{"class":1925},[1889,2849,2851,2853,2856,2858,2860,2862,2865,2867],{"class":1891,"line":2850},11,[1889,2852,2673],{"class":1925},[1889,2854,2855],{"class":2676},"to",[1889,2857,2680],{"class":1925},[1889,2859,2683],{"class":1925},[1889,2861,2608],{"class":1925},[1889,2863,2864],{"class":1898},"owner",[1889,2866,2680],{"class":1925},[1889,2868,2692],{"class":1925},[1889,2870,2872,2874,2877,2879,2881,2883,2886,2888],{"class":1891,"line":2871},12,[1889,2873,2673],{"class":1925},[1889,2875,2876],{"class":2676},"level",[1889,2878,2680],{"class":1925},[1889,2880,2683],{"class":1925},[1889,2882,2608],{"class":1925},[1889,2884,2885],{"class":1898},"L2",[1889,2887,2680],{"class":1925},[1889,2889,2692],{"class":1925},[1889,2891,2893,2895,2898,2900,2902,2904,2907,2909],{"class":1891,"line":2892},13,[1889,2894,2673],{"class":1925},[1889,2896,2897],{"class":2676},"requested_at",[1889,2899,2680],{"class":1925},[1889,2901,2683],{"class":1925},[1889,2903,2608],{"class":1925},[1889,2905,2906],{"class":1898},"2026-10-08T21:01:29Z",[1889,2908,2680],{"class":1925},[1889,2910,2692],{"class":1925},[1889,2912,2914,2916,2919,2921,2923,2925,2928,2930],{"class":1891,"line":2913},14,[1889,2915,2673],{"class":1925},[1889,2917,2918],{"class":2676},"deadline",[1889,2920,2680],{"class":1925},[1889,2922,2683],{"class":1925},[1889,2924,2608],{"class":1925},[1889,2926,2927],{"class":1898},"2026-10-09T21:01:29Z",[1889,2929,2680],{"class":1925},[1889,2931,2692],{"class":1925},[1889,2933,2935,2937,2940,2942,2944,2946,2949,2951],{"class":1891,"line":2934},15,[1889,2936,2673],{"class":1925},[1889,2938,2939],{"class":2676},"at",[1889,2941,2680],{"class":1925},[1889,2943,2683],{"class":1925},[1889,2945,2608],{"class":1925},[1889,2947,2948],{"class":1898},"2026-10-09T09:01:29Z",[1889,2950,2680],{"class":1925},[1889,2952,2692],{"class":1925},[1889,2954,2956,2958,2961,2963,2965,2967,2970],{"class":1891,"line":2955},16,[1889,2957,2673],{"class":1925},[1889,2959,2960],{"class":2676},"decide",[1889,2962,2680],{"class":1925},[1889,2964,2683],{"class":1925},[1889,2966,2608],{"class":1925},[1889,2968,2969],{"class":1898},"decide in OZ (oz0 approval approve|deny), or with an API key through the runtime API's DecideApproval; poll ListApprovals for the outcome",[1889,2971,2614],{"class":1925},[1889,2973,2975],{"class":1891,"line":2974},17,[1889,2976,2977],{"class":1925},"}\n",[1855,2979,2980],{},"Its headers:",[2044,2982,2983,2993],{},[2047,2984,2985],{},[2050,2986,2987,2990],{},[2053,2988,2989],{},"Header",[2053,2991,2992],{},"What",[2060,2994,2995,3008,3018,3030],{},[2050,2996,2997,3002],{},[2065,2998,2999],{},[1886,3000,3001],{},"X-Oz0-Signature",[2065,3003,3004,3007],{},[1886,3005,3006],{},"sha256="," and the hex HMAC-SHA256 of the timestamp, a dot and the body, with the target's secret",[2050,3009,3010,3015],{},[2065,3011,3012],{},[1886,3013,3014],{},"X-Oz0-Timestamp",[2065,3016,3017],{},"seconds since 1970, the time the delivery was signed",[2050,3019,3020,3025],{},[2065,3021,3022],{},[1886,3023,3024],{},"X-Oz0-Event",[2065,3026,3027,3028],{},"the event, such as ",[1886,3029,2069],{},[2050,3031,3032,3037],{},[2065,3033,3034],{},[1886,3035,3036],{},"Idempotency-Key",[2065,3038,3039],{},"the same on every attempt of one delivery: act on it once",[1855,3041,3042,3043,3046],{},"The secret is a tenant secret, sealed for the edges, set as a signing key bound to the webhook's host (",[1886,3044,3045],{},"oz0 secret set DESK_HOOK_KEY --host desk.acme.example --signing","); the rule names it, never its value.",[1855,3048,3049],{},"A rule may name only such a key: another secret of the tenant (a password, a token, a signing key for another host) is refused when the rule is set, and the edge refuses to sign with it at every delivery, so whoever may manage notifications learns nothing of a secret from a signature.",[1855,3051,3052,3053,3056],{},"The refusal when the rule is set comes only to someone who may read the tenant's secrets (",[1886,3054,3055],{},"secrets.read","), and so does the approval of a rule that waits for another admin: anyone else gets the same answer whether the key is set or not, a warning that says what the key must be, and the edge's check at every delivery still holds.",[1855,3058,3059,3060,3062,3063,2645],{},"What the rule's deliveries say afterwards is just as neutral: a delivery whose key cannot be used records one error, \"nothing is signed with tenant secret NAME for HOST\", whether the key is missing, is not a signing key or is bound to another host, and is tried again like any other failure; the edge's log says which it was, and someone with ",[1886,3061,3055],{}," sees the key and its hosts with ",[1886,3064,3065],{},"oz0 secret list",[1855,3067,3068],{},"A signing key is never sent to any host itself.",[1855,3070,3071,3072,3074,3075,3078,3079,3082,3083,3086],{},"A delivery that fails is tried again at 30 seconds, 1, 2, 4 and 8 minutes, six attempts in all, each kept on the delivery (",[1886,3073,2464],{},"). A ",[1886,3076,3077],{},"4xx"," other than ",[1886,3080,3081],{},"408"," and ",[1886,3084,3085],{},"429"," is final. Redirects are not followed.",[1855,3088,3089,3090,3093],{},"Webhooks go to public addresses. A private, loopback or link-local address is refused unless the operator allows its network (",[1886,3091,3092],{},"orchestrator-zero server start --notify-allow-net 10.20.0.0\u002F16","), which is how a webhook to your own intranet works.",[1855,3095,3096],{},"Deliveries share the edge's connections: at most eight at once to one receiver, two kept open between deliveries, each closed after 30 seconds idle. A receiver that holds its connections open costs the edge no more than that.",[1855,3098,3099,3100,3103,3104,3107,3108,3110,3111,3113],{},"Use ",[1886,3101,3102],{},"https:\u002F\u002F",". Over plain ",[1886,3105,3106],{},"http:\u002F\u002F"," the request, its signature and any arguments travel unencrypted, so the edges post to an ",[1886,3109,3106],{}," URL only on a network the operator allows (or on a dev server). Putting a rule with an ",[1886,3112,3106],{}," URL still works, and the CLI and the console warn about it.",[3115,3116,3118],"h3",{"id":3117},"verify-a-delivery","Verify a delivery",[1855,3120,3121],{},"Check the signature before you read anything in the body, compare it in constant time, and refuse a timestamp more than five minutes from your clock:",[1878,3123,3128],{"className":3124,"code":3125,"filename":3126,"language":3127,"meta":1884,"style":1884},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import hashlib, hmac, time\n\n\ndef verify(secret: bytes, headers, body: bytes) -> bool:\n    ts = headers.get(\"X-Oz0-Timestamp\", \"\")\n    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:\n        return False\n    want = \"sha256=\" + hmac.new(secret, ts.encode() + b\".\" + body, hashlib.sha256).hexdigest()\n    return hmac.compare_digest(want, headers.get(\"X-Oz0-Signature\", \"\"))\n","receiver.py","python",[1886,3129,3130,3135,3141,3145,3150,3155,3160,3165,3170],{"__ignoreMap":1884},[1889,3131,3132],{"class":1891,"line":1892},[1889,3133,3134],{},"import hashlib, hmac, time\n",[1889,3136,3137],{"class":1891,"line":1939},[1889,3138,3140],{"emptyLinePlaceholder":3139},true,"\n",[1889,3142,3143],{"class":1891,"line":1953},[1889,3144,3140],{"emptyLinePlaceholder":3139},[1889,3146,3147],{"class":1891,"line":1979},[1889,3148,3149],{},"def verify(secret: bytes, headers, body: bytes) -> bool:\n",[1889,3151,3152],{"class":1891,"line":2000},[1889,3153,3154],{},"    ts = headers.get(\"X-Oz0-Timestamp\", \"\")\n",[1889,3156,3157],{"class":1891,"line":2012},[1889,3158,3159],{},"    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:\n",[1889,3161,3162],{"class":1891,"line":2030},[1889,3163,3164],{},"        return False\n",[1889,3166,3167],{"class":1891,"line":2795},[1889,3168,3169],{},"    want = \"sha256=\" + hmac.new(secret, ts.encode() + b\".\" + body, hashlib.sha256).hexdigest()\n",[1889,3171,3172],{"class":1891,"line":2815},[1889,3173,3174],{},"    return hmac.compare_digest(want, headers.get(\"X-Oz0-Signature\", \"\"))\n",[1855,3176,3177,3178,3180],{},"Keep the ",[1886,3179,3036],{},"s you acted on for at least the replay window, and skip one you saw.",[3115,3182,3184],{"id":3183},"decide-from-your-system-submit-and-poll","Decide from your system: submit and poll",[1855,3186,3187],{},"A webhook tells your system that an approval waits; it never carries a way to decide.",[1855,3189,3190,3191,3194,3195,3198],{},"Your system decides like any other caller, through the ",[1865,3192,3193],{"href":853},"runtime API"," with an ",[1865,3196,3197],{"href":1682},"API key"," whose role may decide (operator or above), and then polls for the outcome.",[1855,3200,3201,3202,3205,3206,3209,3210,3213],{},"A key decides only the approvals it is named for, so the webhook target names the key its receiver decides with: ",[1886,3203,3204],{},"--decide-key"," takes the key's ID (the 12 hex digits after ",[1886,3207,3208],{},"oz0_",", as ",[1886,3211,3212],{},"oz0 apikey list"," shows them).",[1855,3215,3216,3217,3220,3221,3225],{},"That key may then decide the approvals this target was sent (a delivery that is waiting, was sent, or failed and is tried again; not one the edge gave up on or refused, which may never have reached the receiver), for as long as the target names it and goes to the same address; any other key is refused with ",[1886,3218,3219],{},"403",", and so is this one for approvals the target was not sent, unless the approval's ",[1865,3222,3224],{"href":3223},"\u002Fagents\u002Fapprovals\u002Fconfigure#who-decides","deciders"," name it.",[1855,3227,3228,3229,3232,3233,3236,3237,2429,3240,3243],{},"Naming a key, sending it other approvals or moving its webhook is a ",[1865,3230,3231],{"href":1091},"reviewed change"," (",[1886,3234,3235],{},"notify_decide_keys","): ",[1886,3238,3239],{},"oz0 notify rule put",[1886,3241,3242],{},"--reason"," then, and with four eyes on it waits for another admin.",[1878,3245,3247],{"className":1880,"code":3246,"filename":1882,"language":1883,"meta":1884,"style":1884},"curl -sS https:\u002F\u002Fedge.acme.example:7443\u002Foz0.runtime.v1.RuntimeService\u002FDecideApproval \\\n  -H \"Authorization: Bearer $OZ0_API_KEY\" -H 'Content-Type: application\u002Fjson' \\\n  -d '{\"job\": \"job-1e71252a-...\", \"id\": \"a-5ccd30628bdc\", \"approve\": true, \"comment\": \"the desk approves\"}'\ncurl -sS https:\u002F\u002Fedge.acme.example:7443\u002Foz0.runtime.v1.RuntimeService\u002FListApprovals \\\n  -H \"Authorization: Bearer $OZ0_API_KEY\" -H 'Content-Type: application\u002Fjson' -d '{\"job\": \"job-1e71252a-...\"}'\n",[1886,3248,3249,3262,3289,3302,3313],{"__ignoreMap":1884},[1889,3250,3251,3254,3257,3260],{"class":1891,"line":1892},[1889,3252,3253],{"class":1895},"curl",[1889,3255,3256],{"class":1898}," -sS",[1889,3258,3259],{"class":1898}," https:\u002F\u002Fedge.acme.example:7443\u002Foz0.runtime.v1.RuntimeService\u002FDecideApproval",[1889,3261,1936],{"class":1935},[1889,3263,3264,3267,3269,3272,3275,3277,3280,3282,3285,3287],{"class":1891,"line":1939},[1889,3265,3266],{"class":1898},"  -H",[1889,3268,2608],{"class":1925},[1889,3270,3271],{"class":1898},"Authorization: Bearer ",[1889,3273,3274],{"class":1935},"$OZ0_API_KEY",[1889,3276,2680],{"class":1925},[1889,3278,3279],{"class":1898}," -H",[1889,3281,1926],{"class":1925},[1889,3283,3284],{"class":1898},"Content-Type: application\u002Fjson",[1889,3286,1932],{"class":1925},[1889,3288,1936],{"class":1935},[1889,3290,3291,3294,3296,3299],{"class":1891,"line":1953},[1889,3292,3293],{"class":1898},"  -d",[1889,3295,1926],{"class":1925},[1889,3297,3298],{"class":1898},"{\"job\": \"job-1e71252a-...\", \"id\": \"a-5ccd30628bdc\", \"approve\": true, \"comment\": \"the desk approves\"}",[1889,3300,3301],{"class":1925},"'\n",[1889,3303,3304,3306,3308,3311],{"class":1891,"line":1979},[1889,3305,3253],{"class":1895},[1889,3307,3256],{"class":1898},[1889,3309,3310],{"class":1898}," https:\u002F\u002Fedge.acme.example:7443\u002Foz0.runtime.v1.RuntimeService\u002FListApprovals",[1889,3312,1936],{"class":1935},[1889,3314,3315,3317,3319,3321,3323,3325,3327,3329,3331,3333,3336,3338,3341],{"class":1891,"line":2000},[1889,3316,3266],{"class":1898},[1889,3318,2608],{"class":1925},[1889,3320,3271],{"class":1898},[1889,3322,3274],{"class":1935},[1889,3324,2680],{"class":1925},[1889,3326,3279],{"class":1898},[1889,3328,1926],{"class":1925},[1889,3330,3284],{"class":1898},[1889,3332,1932],{"class":1925},[1889,3334,3335],{"class":1898}," -d",[1889,3337,1926],{"class":1925},[1889,3339,3340],{"class":1898},"{\"job\": \"job-1e71252a-...\"}",[1889,3342,3301],{"class":1925},[1855,3344,3345,3346,3348,3349,3352,3353,2481],{},"The decision is recorded as the key's, under the same rules as a person's: the approval's ",[1865,3347,3224],{"href":270},", the content permission for an edit, and the audit trail, whose ",[1886,3350,3351],{},"run.approval.decide"," entry says which rule named the key (",[1886,3354,3355],{},"key_named_by",[1870,3357,3359],{"id":3358},"chat-channels","Chat channels",[1855,3361,3362,3363,3366],{},"A rule may post to a ",[1865,3364,3365],{"href":930},"chat channel"," of the tenant: Microsoft Teams, Slack or Discord. Two kinds\nof target, which one rule may mix:",[3368,3369,3370,3386],"ul",{},[3371,3372,3373,3374,3377,3378,3381,3382,3385],"li",{},"A room, ",[1886,3375,3376],{},"--channel \u003Cchannel>:\u003Croom>",", such as ",[1886,3379,3380],{},"--channel \"teams:19:ops@thread.tacv2\"",". For Teams the room must be\none the bot has heard from (mention it there once), since Teams names where replies go in each message. The edge\nkeeps the room while rules post to it or people mention the bot there, and forgets it after 30 days of neither;\nmention the bot there again then.",[3383,3384],"br",{},"The room's readers are people the platform does not know, so the post carries the event's facts only: the agent, the function,\nthe level, the deadline and the link to the job, never the call's arguments, its marked fields' values, or a\nquestion's words.",[3371,3387,3388,3389,2448,3392,2692,3395,3398,3399,3403,3404,3406,3407,3409],{},"People in their personal chats with the bot, ",[1886,3390,3391],{},"--channel-person teams:ana",[1886,3393,3394],{},"--channel-team teams:payments",[1886,3396,3397],{},"--channel-role teams:admin",": each current member of the tenant it names who ",[1865,3400,3402],{"href":3401},"\u002Fbuild\u002Fapps\u002Fchat-channels#link-your-own-chat-identity","linked their chat\nidentity"," gets it in their one-to-one chat with the bot: the Teams\npersonal chat, the Slack direct message to the app or the Discord DM with the bot they last wrote in.",[3383,3405],{},"A slash command\nnever names that chat, even one that links them, since the room it is typed in is one others read: someone who linked\nwith a command is reached once they write to the bot directly.",[3383,3408],{},"A person who holds the content permission and may read\nthe job's chat sees the call's details on the card (and Edit and approve); anyone else gets the facts. Someone\nwith no such chat is left out of the delivery and counted, never named.",[1878,3411,3413],{"className":1880,"code":3412,"filename":1882,"language":1883,"meta":1884,"style":1884},"oz0 notify rule put approvals-to-teams --event approval.waiting --event job.failed --agent support-triage \\\n  --channel \"teams:19:ops@thread.tacv2\" --channel-team teams:support-leads\n",[1886,3414,3415,3445],{"__ignoreMap":1884},[1889,3416,3417,3419,3421,3423,3425,3428,3430,3432,3434,3437,3440,3443],{"class":1891,"line":1892},[1889,3418,1714],{"class":1895},[1889,3420,1899],{"class":1898},[1889,3422,1902],{"class":1898},[1889,3424,1905],{"class":1898},[1889,3426,3427],{"class":1898}," approvals-to-teams",[1889,3429,1911],{"class":1898},[1889,3431,1914],{"class":1898},[1889,3433,1911],{"class":1898},[1889,3435,3436],{"class":1898}," job.failed",[1889,3438,3439],{"class":1898}," --agent",[1889,3441,3442],{"class":1898}," support-triage",[1889,3444,1936],{"class":1935},[1889,3446,3447,3450,3452,3455,3457,3460],{"class":1891,"line":1939},[1889,3448,3449],{"class":1898},"  --channel",[1889,3451,2608],{"class":1925},[1889,3453,3454],{"class":1898},"teams:19:ops@thread.tacv2",[1889,3456,2680],{"class":1925},[1889,3458,3459],{"class":1898}," --channel-team",[1889,3461,3462],{"class":1898}," teams:support-leads\n",[1855,3464,3465,3466,3468],{},"A waiting approval or question comes as the channel's card, with its buttons, and is decided from it as from any\nthread: by the clicker's mapped account, which must be allowed to decide it (the operator role, the approval's\n",[1865,3467,3224],{"href":270},", never the starter under four eyes), and only on the card the platform posted.",[1855,3470,3471],{},"A job that failed or a budget's share comes as a message. Each delivery posts once however often the notifier tries it; a post the\nchat system rate-limits, or that no node of the plugin took, is made again after its wait, as a thread's posts are.",[1870,3473,3475],{"id":3474},"what-is-counted","What is counted",[1855,3477,3478,3479,3482],{},"A notification names who was notified in its delivery rows and counts people by kind in the audit trail (",[1886,3480,3481],{},"run.approval.escalated"," says \"3 people who may decide\", never who). Nothing counts or lists notifications or decisions per person.",[3484,3485,3486],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":1884,"searchDepth":1939,"depth":1939,"links":3488},[3489,3490,3491,3495,3496],{"id":1872,"depth":1939,"text":1873},{"id":2484,"depth":1939,"text":2485},{"id":2648,"depth":1939,"text":2649,"children":3492},[3493,3494],{"id":3117,"depth":1953,"text":3118},{"id":3183,"depth":1953,"text":3184},{"id":3358,"depth":1939,"text":3359},{"id":3474,"depth":1939,"text":3475},"Tell people and systems when an approval waits, escalates or expires, by email, a signed webhook or a chat channel.","md",null,{"audience":3501,"doc_type":3502},"cluster and tenant administrators","how-to",{"icon":1700},{"title":1697,"description":3497},"KQap1ZX5M1AJb9_SjPAlwdVhZ6soz-uVZgF_L8FTq38",[3507,3509],{"title":1693,"path":1694,"stem":1695,"description":3508,"icon":1691,"children":-1},"Look up export files, manifest fields and table inclusion rules.",{"title":1702,"path":1703,"stem":1704,"description":3510,"children":-1},"Use these pages for command syntax, fields and limits. The Build and Fleet guides explain how to complete the corresponding tasks.",1794442958934]