[{"data":1,"prerenderedAt":3704},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fbuild\u002Fplugins\u002Fgithub":1849,"docs-surround:\u002Fbuild\u002Fplugins\u002Fgithub":3699},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":493,"body":1851,"description":3690,"extension":3691,"links":3692,"meta":3693,"navigation":3696,"path":494,"seo":3697,"stem":495,"__hash__":3698},"docs\u002F04.build\u002F01.plugins\u002F20.github.md",{"type":1852,"value":1853,"toc":3676},"minimark",[1854,1858,1874,1904,1909,1912,1932,1966,1974,1979,1992,2032,2035,2039,2053,2056,2093,2101,2108,2120,2145,2154,2186,2206,2218,2230,2234,2244,2661,2665,2693,2705,2720,2727,2734,2744,2748,2784,2884,2887,2901,2905,2912,2921,2935,2945,2948,2952,2972,2986,3001,3014,3059,3062,3066,3078,3144,3272,3275,3279,3328,3335,3395,3403,3568,3583,3587,3612,3622,3661,3672],[1855,1856,1857],"p",{},"For: plugin authors.",[1855,1859,1860,1861,1865,1866,1869,1870,1873],{},"Use ",[1862,1863,1864],"code",{},"ai.oz0\u002Fgithub"," to give agents access to GitHub repositories, issues and pull requests. It is the project's first verified first-party plugin, maintained with the engine in ",[1862,1867,1868],{},"plugins\u002Fgithub",". Its manifest name is ",[1862,1871,1872],{},"github",". It provides:",[1875,1876,1877,1885,1892,1898],"ul",{},[1878,1879,1880,1881,1884],"li",{},"one tool, ",[1862,1882,1883],{},"oz0_github",", with GitHub's reads and writes, each with input and output schemas and honest annotations;",[1878,1886,1887,1888,1891],{},"an agent, ",[1862,1889,1890],{},"oz0-github",", that other plugins hand their GitHub work to, so the token, the approvals and the rules live in one place;",[1878,1893,1894,1895,1897],{},"an event source, ",[1862,1896,1872],{},", that turns GitHub's webhooks into events routines and flows fire on and jobs wait for;",[1878,1899,1900,1901,1903],{},"a connection, ",[1862,1902,1872],{},": a GitHub App of your own on your organization, which an admin connects in two clicks, after which every call gets a token minted for that call alone. Until then, calls use a token you set.",[1905,1906,1908],"h2",{"id":1907},"install-it","Install it",[1855,1910,1911],{},"Reading the plugin's source or using the Git install below currently requires access to the private repository. Public source downloads are coming soon.",[1855,1913,1914,1915,1917,1918,1921,1922,1927,1928,1931],{},"Its agent ",[1862,1916,1890],{}," asks for the tenant's ",[1862,1919,1920],{},"default"," ",[1923,1924,1926],"a",{"href":1925},"\u002Fspend\u002Fmodels-and-keys\u002Faliases#the-standard-aliases","model alias"," with tools, never a vendor's model, so it runs on whichever provider the tenant set up first; map it elsewhere with ",[1862,1929,1930],{},"oz0 model alias set default \u003Cprovider>\u002F\u003Cmodel>",".",[1933,1934,1940],"pre",{"className":1935,"code":1936,"filename":1937,"language":1938,"meta":1939,"style":1939},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","oz0 plugin install https:\u002F\u002Fgithub.com\u002Forchestrator-zero\u002Forchestrator-zero --path plugins\u002Fgithub\n","Terminal","bash","",[1862,1941,1942],{"__ignoreMap":1939},[1943,1944,1947,1950,1954,1957,1960,1963],"span",{"class":1945,"line":1946},"line",1,[1943,1948,1714],{"class":1949},"sBMFI",[1943,1951,1953],{"class":1952},"sfazB"," plugin",[1943,1955,1956],{"class":1952}," install",[1943,1958,1959],{"class":1952}," https:\u002F\u002Fgithub.com\u002Forchestrator-zero\u002Forchestrator-zero",[1943,1961,1962],{"class":1952}," --path",[1943,1964,1965],{"class":1952}," plugins\u002Fgithub\n",[1855,1967,1968,1969,1973],{},"It ships no eval, so the install has no ",[1923,1970,1972],{"href":1971},"\u002Fimprove\u002Fevals\u002Fquality-gates#quality-gates","quality gate"," and calls neither GitHub nor a model: its agent is a delegate that does what the agent handing it work asks, and the plugin's tests check its functions against a fake GitHub. Then give it a way into GitHub, in either of two ways.",[1975,1976,1978],"h3",{"id":1977},"with-a-token","With a token",[1855,1980,1981,1982,1988,1989,1931],{},"The quickest start: a ",[1923,1983,1987],{"href":1984,"rel":1985},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fauthentication\u002Fkeeping-your-account-and-data-secure\u002Fmanaging-your-personal-access-tokens",[1986],"nofollow","fine-grained personal access token"," with access to the repositories your agents work on, as the tenant secret ",[1862,1990,1991],{},"GITHUB_TOKEN",[1933,1993,1995],{"className":1935,"code":1994,"filename":1937,"language":1938,"meta":1939,"style":1939},"printf %s \"$GITHUB_TOKEN\" | oz0 secret set GITHUB_TOKEN\n",[1862,1996,1997],{"__ignoreMap":1939},[1943,1998,1999,2003,2006,2010,2014,2017,2020,2023,2026,2029],{"class":1945,"line":1946},[1943,2000,2002],{"class":2001},"s2Zo4","printf",[1943,2004,2005],{"class":1952}," %s",[1943,2007,2009],{"class":2008},"sMK4o"," \"",[1943,2011,2013],{"class":2012},"sTEyZ","$GITHUB_TOKEN",[1943,2015,2016],{"class":2008},"\"",[1943,2018,2019],{"class":2008}," |",[1943,2021,2022],{"class":1949}," oz0",[1943,2024,2025],{"class":1952}," secret",[1943,2027,2028],{"class":1952}," set",[1943,2030,2031],{"class":1952}," GITHUB_TOKEN\n",[1855,2033,2034],{},"Only the edge reads it: each call gets it from the edge, in the call itself, and the plugin's processes never hold it in their environment. It is one person's rights for every call, though, so move to the app when you can.",[1975,2036,2038],{"id":2037},"with-a-github-app-connect","With a GitHub App (Connect)",[1855,2040,2041,2042,2044,2045,2048,2049,2052],{},"Create your own app, about two minutes. An admin opens Credentials, Connections in the console, picks ",[1862,2043,1872],{},", fills in the organization, and clicks Connect. The app's name defaults to your tenant's name plus ",[1862,2046,2047],{},"-oz0"," (the tenant's name shortened to fit GitHub's 34 characters); app names are unique across GitHub, so give another one (",[1862,2050,2051],{},"app_name",") or change it on GitHub's page if it is taken. GitHub asks twice: to create the app from the manifest the edge made, and where to install it.",[1855,2054,2055],{},"The manifest already has everything else: the webhook URL (your edge's event source for the plugin), the permissions and the events the plugin declares, and the edge's callback as the redirect and setup URL, so you only confirm. The browser comes back to the Connections tab, and the connection says connected. From the CLI:",[1933,2057,2059],{"className":1935,"code":2058,"filename":1937,"language":1938,"meta":1939,"style":1939},"oz0 connection start github --param owner=acme --open\noz0 connection list\n",[1862,2060,2061,2083],{"__ignoreMap":1939},[1943,2062,2063,2065,2068,2071,2074,2077,2080],{"class":1945,"line":1946},[1943,2064,1714],{"class":1949},[1943,2066,2067],{"class":1952}," connection",[1943,2069,2070],{"class":1952}," start",[1943,2072,2073],{"class":1952}," github",[1943,2075,2076],{"class":1952}," --param",[1943,2078,2079],{"class":1952}," owner=acme",[1943,2081,2082],{"class":1952}," --open\n",[1943,2084,2086,2088,2090],{"class":1945,"line":2085},2,[1943,2087,1714],{"class":1949},[1943,2089,2067],{"class":1952},[1943,2091,2092],{"class":1952}," list\n",[1855,2094,2095,2096,2100],{},"If it does not work: see ",[1923,2097,2099],{"href":2098},"\u002Fadmin\u002Fconnections\u002Ftroubleshooting#troubleshooting","troubleshooting"," (a personal account instead of an organization, a name that is taken, webhooks GitHub cannot deliver).",[1855,2102,2103,2104,2107],{},"What happens, and where each part ends up, is on ",[1923,2105,2106],{"href":1660},"Connections",". In short: the app's private key and its webhook secret go to the edge and are sealed as tenant secrets that management cannot open; each call then gets an installation token minted on the edge, for the one repository the call names and only the permissions its function needs, and good for an hour at most. The app's webhooks go to the plugin's event source, signed with the secret the connection saved, so nothing more is needed for events.",[1855,2109,2110,2111,2114,2115,2119],{},"For GitHub Enterprise Server, set the addresses first, then connect (the app's key and tokens go only to the API address they were made for, so moving a connected connection to another server means connecting it again from its first step with ",[1862,2112,2113],{},"--replace","; see ",[1923,2116,2118],{"href":2117},"\u002Fadmin\u002Fconnections\u002Fdestinations#where-credentials-go","where credentials go","):",[1933,2121,2123],{"className":1935,"code":2122,"filename":1937,"language":1938,"meta":1939,"style":1939},"oz0 connection set github --param web_url=https:\u002F\u002Fgithub.acme.se --param api_url=https:\u002F\u002Fgithub.acme.se\u002Fapi\u002Fv3\n",[1862,2124,2125],{"__ignoreMap":1939},[1943,2126,2127,2129,2131,2133,2135,2137,2140,2142],{"class":1945,"line":1946},[1943,2128,1714],{"class":1949},[1943,2130,2067],{"class":1952},[1943,2132,2028],{"class":1952},[1943,2134,2073],{"class":1952},[1943,2136,2076],{"class":1952},[1943,2138,2139],{"class":1952}," web_url=https:\u002F\u002Fgithub.acme.se",[1943,2141,2076],{"class":1952},[1943,2143,2144],{"class":1952}," api_url=https:\u002F\u002Fgithub.acme.se\u002Fapi\u002Fv3\n",[1855,2146,2147,2148,2150,2151,1931],{},"A fallback ",[1862,2149,1991],{}," goes to a server other than github.com only once it is bound to its host, as someone who may set secrets sets it: ",[1862,2152,2153],{},"oz0 secret set GITHUB_TOKEN --host github.acme.se",[1855,2155,2156,2157,2161,2162,2165,2166,2169,2170,2173,2174,2177,2178,2181,2182,2185],{},"and add the host to the tenant's ",[1923,2158,2160],{"href":2159},"\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers#sandboxes","egress list",", since the plugin's own list names only ",[1862,2163,2164],{},"api.github.com"," and ",[1862,2167,2168],{},"codeload.github.com",". A server with subdomain isolation serves archives from a host of its own, ",[1862,2171,2172],{},"codeload.\u003Chost>"," (",[1862,2175,2176],{},"codeload.github.acme.se"," here): add that one too, or ",[1862,2179,2180],{},"download_archive"," fails in jobs an outside event started. A server on a private network also needs a cluster admin to list that network for the edge's own requests (",[1862,2183,2184],{},"server start --connect-allow-net 10.20.0.0\u002F16","): the edge reaches only public addresses for a connection otherwise.",[1855,2187,2188,2189,2192,2193,2196,2197,2200,2201,2203,2204,1931],{},"A personal account. To register the app on your own GitHub account instead of an organization, choose account: user (",[1862,2190,2191],{},"--param account=user",", no ",[1862,2194,2195],{},"owner","; the organization's page answers 404 for a personal account): GitHub registers it on the account you are signed in with, at ",[1862,2198,2199],{},"\u002Fsettings\u002Fapps\u002Fnew",", and the install step is the same. A tenant has one ",[1862,2202,1872],{}," connection, on an organization or on a user: moving from one to the other registers a new app and needs ",[1862,2205,2113],{},[1855,2207,2208,2209,2212,2213,2217],{},"Once the app is installed, the connection runs ",[1862,2210,2211],{},"oz0_github.check_installation"," as a tool job of its own: it lists the repositories the installation may use, with the new token, so the Connections tab shows at once whether the app sees what you meant it to (",[1923,2214,2216],{"href":2215},"\u002Fadmin\u002Fconnections#after-connecting","after connecting",").",[1855,2219,2220,2221,2173,2224,2227,2228,1931],{},"To install the app on another organization, connect again from step ",[1862,2222,2223],{},"install",[1862,2225,2226],{},"connection start github --from-step install",", the console's default for a connected app): the app keeps working until the new installation is done. Registering a new app replaces the old one at once and needs ",[1862,2229,2113],{},[1905,2231,2233],{"id":2232},"the-functions","The functions",[1855,2235,2236,2237,2240,2241,1931],{},"Every function names a repository as ",[1862,2238,2239],{},"repo: owner\u002Fname",", and an issue or a pull request by ",[1862,2242,2243],{},"number",[2245,2246,2247,2266],"table",{},[2248,2249,2250],"thead",{},[2251,2252,2253,2257,2260,2263],"tr",{},[2254,2255,2256],"th",{},"Function",[2254,2258,2259],{},"Does",[2254,2261,2262],{},"Annotations",[2254,2264,2265],{},"Token's permissions",[2267,2268,2269,2286,2305,2323,2345,2363,2391,2405,2420,2449,2485,2500,2520,2537,2553,2576,2593,2612,2627,2642],"tbody",{},[2251,2270,2271,2277,2280,2283],{},[2272,2273,2274],"td",{},[1862,2275,2276],{},"get_repository",[2272,2278,2279],{},"A repository: description, default branch, visibility",[2272,2281,2282],{},"read-only",[2272,2284,2285],{},"metadata: read",[2251,2287,2288,2297,2300,2302],{},[2272,2289,2290,2293,2294],{},[1862,2291,2292],{},"list_issues",", ",[1862,2295,2296],{},"get_issue",[2272,2298,2299],{},"Issues, without pull requests; one with its body",[2272,2301,2282],{},[2272,2303,2304],{},"issues: read",[2251,2306,2307,2315,2318,2320],{},[2272,2308,2309,2293,2312],{},[1862,2310,2311],{},"list_pull_requests",[1862,2313,2314],{},"get_pull_request",[2272,2316,2317],{},"Pull requests; one with its head and base (ref and SHA), draft, mergeable",[2272,2319,2282],{},[2272,2321,2322],{},"pull_requests: read",[2251,2324,2325,2333,2341,2343],{},[2272,2326,2327,2293,2330],{},[1862,2328,2329],{},"get_pull_request_diff",[1862,2331,2332],{},"list_pull_request_files",[2272,2334,2335,2336,2340],{},"The unified diff (cut at 120 000 characters, or ",[1923,2337,2339],{"href":2338},"\u002Fbuild\u002Fplugins\u002Fgithub#long-files-and-diffs","fitted to a budget","), the changed files",[2272,2342,2282],{},[2272,2344,2322],{},[2251,2346,2347,2352,2358,2360],{},[2272,2348,2349],{},[1862,2350,2351],{},"get_file",[2272,2353,2354,2355,2357],{},"A file's text at a ref (cut at 100 000 characters, or ",[1923,2356,2339],{"href":2338},")",[2272,2359,2282],{},[2272,2361,2362],{},"contents: read",[2251,2364,2365,2370,2386,2388],{},[2272,2366,2367],{},[1862,2368,2369],{},"list_checks",[2272,2371,2372,2373,2293,2376,2293,2379,2382,2383],{},"A ref's check runs and statuses, and their combined state: ",[1862,2374,2375],{},"success",[1862,2377,2378],{},"failure",[1862,2380,2381],{},"pending"," or ",[1862,2384,2385],{},"none",[2272,2387,2282],{},[2272,2389,2390],{},"checks: read, statuses: read",[2251,2392,2393,2398,2401,2403],{},[2272,2394,2395],{},[1862,2396,2397],{},"list_comments",[2272,2399,2400],{},"Comments on an issue or a pull request",[2272,2402,2282],{},[2272,2404,2304],{},[2251,2406,2407,2412,2415,2417],{},[2272,2408,2409],{},[1862,2410,2411],{},"search",[2272,2413,2414],{},"Issues and pull requests, code or repositories, in GitHub's search syntax",[2272,2416,2282],{},[2272,2418,2419],{},"every repository",[2251,2421,2422,2426,2445,2447],{},[2272,2423,2424],{},[1862,2425,2180],{},[2272,2427,2428,2429,2432,2433,2436,2437,2440,2441,2444],{},"The repository's code at one commit (",[1862,2430,2431],{},"sha",", the full 40 characters), as a file for another function, such as ",[1923,2434,2435],{"href":530},"pr-reviewer","'s ",[1862,2438,2439],{},"run_tests",": the bytes go to the edge, the answer names them ",[1862,2442,2443],{},"oz0-file:sha256:\u003Chex>"," (at most 32 MiB)",[2272,2446,2282],{},[2272,2448,2362],{},[2251,2450,2451,2456,2481,2483],{},[2272,2452,2453],{},[1862,2454,2455],{},"resolve_ref",[2272,2457,2458,2459,2382,2462,2465,2466,2468,2469,2471,2472,2476,2477,2480],{},"The full SHA of the commit a branch, a tag (",[1862,2460,2461],{},"heads\u002F\u003Cname>",[1862,2463,2464],{},"tags\u002F\u003Cname>"," to say which; an annotated tag is followed to its commit) or a commit names now, and which kind it is: the ",[1862,2467,2431],{}," that ",[1862,2470,2180],{}," and a ",[1923,2473,2475],{"href":2474},"\u002Fgovern\u002Freviewed-changes\u002Fchangesets#changesets","reviewed changeset","'s base take; the default branch when ",[1862,2478,2479],{},"ref"," is empty",[2272,2482,2282],{},[2272,2484,2362],{},[2251,2486,2487,2492,2495,2497],{},[2272,2488,2489],{},[1862,2490,2491],{},"check_installation",[2272,2493,2494],{},"The repositories the GitHub App's installation may use; the connection runs it after connecting",[2272,2496,2282],{},[2272,2498,2499],{},"metadata: read, every repository",[2251,2501,2502,2507,2514,2517],{},[2272,2503,2504],{},[1862,2505,2506],{},"create_issue",[2272,2508,2509,2510,2513],{},"Opens an issue; ",[1862,2511,2512],{},"idempotency_key"," writes it once",[2272,2515,2516],{},"writes, asks by default",[2272,2518,2519],{},"issues: write",[2251,2521,2522,2527,2532,2534],{},[2272,2523,2524],{},[1862,2525,2526],{},"comment",[2272,2528,2529,2530,2513],{},"Comments on an issue or a pull request; ",[1862,2531,2512],{},[2272,2533,2516],{},[2272,2535,2536],{},"issues, pull_requests: write",[2251,2538,2539,2544,2547,2550],{},[2272,2540,2541],{},[1862,2542,2543],{},"create_pull_request",[2272,2545,2546],{},"Opens a pull request; again for the same head and base, answers the open one",[2272,2548,2549],{},"writes, idempotent, asks by default",[2272,2551,2552],{},"pull_requests: write",[2251,2554,2555,2560,2572,2574],{},[2272,2556,2557],{},[1862,2558,2559],{},"review_pull_request",[2272,2561,2562,2293,2565,2382,2568,2571],{},[1862,2563,2564],{},"COMMENT",[1862,2566,2567],{},"APPROVE",[1862,2569,2570],{},"REQUEST_CHANGES",", with comments on lines",[2272,2573,2516],{},[2272,2575,2552],{},[2251,2577,2578,2586,2589,2591],{},[2272,2579,2580,2293,2583],{},[1862,2581,2582],{},"add_labels",[1862,2584,2585],{},"remove_label",[2272,2587,2588],{},"Labels",[2272,2590,2549],{},[2272,2592,2536],{},[2251,2594,2595,2600,2606,2609],{},[2272,2596,2597],{},[1862,2598,2599],{},"merge_pull_request",[2272,2601,2602,2603,2605],{},"Merges at the head ",[1862,2604,2431],{}," it names (GitHub refuses if the branch moved)",[2272,2607,2608],{},"destructive, always asks",[2272,2610,2611],{},"contents, pull_requests: write",[2251,2613,2614,2619,2622,2625],{},[2272,2615,2616],{},[1862,2617,2618],{},"close",[2272,2620,2621],{},"Closes an issue or a pull request without merging",[2272,2623,2624],{},"destructive, asks by default",[2272,2626,2536],{},[2251,2628,2629,2634,2637,2639],{},[2272,2630,2631],{},[1862,2632,2633],{},"delete_branch",[2272,2635,2636],{},"Deletes a branch, such as a merged head",[2272,2638,2624],{},[2272,2640,2641],{},"contents: write",[2251,2643,2644,2649,2656,2659],{},[2272,2645,2646],{},[1862,2647,2648],{},"push_changes",[2272,2650,2651,2652,1931],{},"Applies an approved patch as one commit on its own branch and opens a draft pull request. See ",[1923,2653,2655],{"href":2654},"#applying-a-reviewed-changeset","checks and provenance",[2272,2657,2658],{},"writes, idempotent, always asks (a changes approval stands for it)",[2272,2660,2611],{},[1975,2662,2664],{"id":2663},"applying-a-reviewed-changeset","Applying a reviewed changeset",[1855,2666,2667,2669,2670,2672,2673,2293,2676,2293,2679,2682,2683,2686,2687,2689,2690,2692],{},[1862,2668,2648],{}," applies a ",[1923,2671,2475],{"href":1091},"'s patch (",[1862,2674,2675],{},"repository",[1862,2677,2678],{},"base",[1862,2680,2681],{},"patch"," as an ",[1862,2684,2685],{},"oz0-file",") onto its base commit as one commit on a branch of its own, then opens a draft pull request. It refuses a patch that does not fit the base or whose bytes differ from its name. A ",[1862,2688,2678],{}," of ",[1862,2691,1920],{}," means the default branch's tip, which a rollback uses.",[1855,2694,2695,2696,2700,2701,2704],{},"For an agent's changeset, it writes ",[1923,2697,2699],{"href":2698},"\u002Fgovern\u002Freviewed-changes\u002Fchangesets#where-a-change-came-from","where the change came from"," as the commit's ",[1862,2702,2703],{},"OZ-"," trailers and a section of the pull request's body. These come from the platform's records, never the function's arguments.",[1855,2706,2707,2709,2710,2712,2713,2716,2717,2719],{},[1862,2708,2180],{}," sends the token on the API's request only: GitHub answers with a redirect to the archive's own host (",[1862,2711,2168],{},", which the plugin's egress names; on GitHub Enterprise Server ",[1862,2714,2715],{},"\u003Chost>\u002F_codeload",", or ",[1862,2718,2172],{}," with subdomain isolation), whose link carries a short-lived token of its own. A pull request from a fork downloads from the base repository at its head commit, which GitHub keeps there too, so it needs no access to the fork.",[1855,2721,2722,2723,2217],{},"The bytes never reach a model or a job's history: the runtime keeps them on the edge, by their digest, and hands them to the function that names the file as a file of its own on the node (",[1923,2724,2726],{"href":2725},"\u002Freference\u002Fplugin-manifest\u002Ftools#files-between-tools","files between tools",[1855,2728,2729,2730,2733],{},"Every function reaches GitHub, so all are open-world for the ",[1923,2731,2732],{"href":1049},"tool policy",". What a function answers from GitHub, titles, bodies, comments, diffs and files, was written by someone outside: the agents that read it are told it is data, not instructions.",[1855,2735,2736,2737,2293,2740,2743],{},"What an agent writes for people, an issue's body, a comment, a pull request's description, a review and each of its line comments, starts with a small line that carries the tenant's ",[1923,2738,2739],{"href":1113},"AI label",[1862,2741,2742],{},"\u003Csub>[AI agent]\u003C\u002Fsub>"," unless you word it otherwise; with the label turned off it has none.",[1975,2745,2747],{"id":2746},"long-files-and-diffs","Long files and diffs",[1855,2749,2750,2751,2165,2753,2755,2756,2760,2761,2764,2765,2382,2768,2771,2772,2775,2776,2779,2780,2783],{},"From version 1.2.0 ",[1862,2752,2351],{},[1862,2754,2329],{}," follow the convention of\n",[1923,2757,2759],{"href":2758},"\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files#results-that-fit-a-budget","results that fit a budget",": with ",[1862,2762,2763],{},"budget"," (tokens), ",[1862,2766,2767],{},"view",[1862,2769,2770],{},"query","\nthey answer with the biggest view that fits, and a ",[1862,2773,2774],{},"fit"," field (also in the result's ",[1862,2777,2778],{},"_meta"," under ",[1862,2781,2782],{},"oz0\u002Ffit",") that\nnames the view, the sizes and what was left out.",[2245,2785,2786,2801],{},[2248,2787,2788],{},[2251,2789,2790,2793,2797],{},[2254,2791,2792],{},"View",[2254,2794,2795],{},[1862,2796,2329],{},[2254,2798,2799],{},[1862,2800,2351],{},[2267,2802,2803,2816,2854,2871],{},[2251,2804,2805,2810,2813],{},[2272,2806,2807],{},[1862,2808,2809],{},"full",[2272,2811,2812],{},"The whole diff",[2272,2814,2815],{},"The whole file",[2251,2817,2818,2823,2832],{},[2272,2819,2820],{},[1862,2821,2822],{},"section",[2272,2824,2825,2826,2828,2829],{},"The hunks of the files ",[1862,2827,2770],{}," names (a path, the end of one, or a part of one), or one hunk: ",[1862,2830,2831],{},"src\u002Fapp.py#2",[2272,2833,2834,2835,2293,2838,2293,2841,2293,2844,2293,2847,2850,2851],{},"The part under a Markdown heading, a top-level definition by name (",[1862,2836,2837],{},"def",[1862,2839,2840],{},"class",[1862,2842,2843],{},"func",[1862,2845,2846],{},"fn",[1862,2848,2849],{},"type"," and the like), or a range of lines such as ",[1862,2852,2853],{},"120-180",[2251,2855,2856,2861,2868],{},[2272,2857,2858],{},[1862,2859,2860],{},"summary",[2272,2862,2863,2864,2867],{},"Each file with its added and deleted lines, and each hunk's ",[1862,2865,2866],{},"@@"," line",[2272,2869,2870],{},"Each heading with its first sentence, or each top-level definition with its lines",[2251,2872,2873,2878,2881],{},[2272,2874,2875],{},[1862,2876,2877],{},"stub",[2272,2879,2880],{},"How many files and lines changed, and the files",[2272,2882,2883],{},"The file's size and outline",[1855,2885,2886],{},"Sections hold whole hunks, whole parts and whole lines only: a hunk too big for the budget is not cut, and the answer says how big it is. The runtime gives an agent's call a budget when its model leaves it out (at most 8,000 tokens, less when the agent's context is filling up), so a large pull request reaches the model as its file list and hunks first.",[1855,2888,2889,2890,2893,2894,2293,2896,2165,2898,2900],{},"A fitted answer holds at most 50,000 tokens whatever the budget, at most 8 characters for each token of the budget, and no more characters than the answer without the arguments (100,000 for a file, 120,000 for a diff); past a bound, ",[1862,2891,2892],{},"truncated"," is set and the answer is a smaller view. Without ",[1862,2895,2767],{},[1862,2897,2763],{},[1862,2899,2770],{}," the two functions answer as before.",[1975,2902,2904],{"id":2903},"approvals-and-the-plugins-rules","Approvals and the plugin's rules",[1855,2906,2907,2908,2911],{},"Every write asks a person in the ",[1923,2909,2910],{"href":270},"approvals inbox"," by default, whichever agent calls it:",[2913,2914,2916,2165,2918,2920],"h4",{"id":2915},"merge_pull_request-and-push_changes-always-ask",[1862,2917,2599],{},[1862,2919,2648],{}," always ask",[1855,2922,2923,2924,2927,2928,2930,2931,2934],{},"Both functions set ",[1862,2925,2926],{},"requires_approval",". A merge lands on a branch others build from, and ",[1862,2929,2648],{}," runs after a ",[1923,2932,2933],{"href":1091},"changes approval",", which stands for it.",[1855,2936,2937,2939,2940,2944],{},[1862,2938,2648],{}," refuses, before it writes anything, a patch that touches a plugin's tests or rules without the second approval they need, a patch that touches CODEOWNERS or a CI workflow unless that approval names exactly those files, and a patch of a plugin's files the platform did not check (",[1923,2941,2943],{"href":2942},"\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths#protected-paths","protected paths","); a person's own change, such as a rollback a person asked for, passes.",[1855,2946,2947],{},"The install screen shows them as \"Ask, set by the plugin\", with no switch; only a tenant's refusal stops them sooner.",[2913,2949,2951],{"id":2950},"the-other-writes-ask-through-the-plugins-suggested-policy","The other writes ask through the plugin's suggested policy",[1855,2953,2954,2955,2293,2957,2293,2959,2293,2961,2293,2963,2293,2965,2293,2967,2165,2969,2971],{},"The suggested policy uses the reason \"the plugin asks before it writes\" for ",[1862,2956,2506],{},[1862,2958,2526],{},[1862,2960,2543],{},[1862,2962,2559],{},[1862,2964,2582],{},[1862,2966,2585],{},[1862,2968,2618],{},[1862,2970,2633],{},". The install writes them as rules of the tenant's tool policy, marked as the plugin's, after the tenant's own rules.",[1855,2973,2974,2975,2173,2978,2981,2982,2165,2984,2217],{},"An admin who trusts an agent's GitHub writes switches them, with a reason: ",[1862,2976,2977],{},"oz0 plugin policy github --set write=allow --reason \"the triage agent labels and comments\"",[1862,2979,2980],{},"destructive=allow"," for ",[1862,2983,2618],{},[1862,2985,2633],{},[1855,2987,2988,2989,2165,2991,2993,2994,2996,2997,2217],{},"From 1.4.0; up to 1.3.0, ",[1862,2990,2618],{},[1862,2992,2633],{}," were under ",[1862,2995,2926],{},", and an update from one of those keeps asking about them until an admin switches them (",[1923,2998,3000],{"href":2999},"\u002Ffleet\u002Fupgrades\u002Fpolicy-changes#verified-plugins-writes-ask-by-default-through-the-plugins-suggested-policy","Upgrades",[1855,3002,3003,3004,1921,3006,3009,3010,3013],{},"The writes that stay in the repository say so in their listing (",[1862,3005,2778],{},[1862,3007,3008],{},"oz0\u002Fclass: write","), so the install screen\nshows them as Write rather than Sends out once installed from the official index. Before any write, the plugin's own\nhook, ",[1862,3011,3012],{},"oz0_github.policy",", checks what no person should have to:",[1875,3015,3016,3019,3048],{},[1878,3017,3018],{},"a merge names the head commit it merges, so what was approved is what lands;",[1878,3020,3021,3022,2293,3025,2293,3028,2293,3031,2293,3034,2293,3037,2293,3040,3043,3044,3047],{},"protected branches (",[1862,3023,3024],{},"main",[1862,3026,3027],{},"master",[1862,3029,3030],{},"develop",[1862,3032,3033],{},"trunk",[1862,3035,3036],{},"release\u002F*",[1862,3038,3039],{},"releases\u002F*",[1862,3041,3042],{},"gh-pages",", and the patterns in the tool's setting ",[1862,3045,3046],{},"GITHUB_PROTECTED_BRANCHES",") are never deleted from here;",[1878,3049,3050,3051,3054,3055,3058],{},"with ",[1862,3052,3053],{},"GITHUB_ALLOWED_REPOS"," set (such as ",[1862,3056,3057],{},"acme\u002F*","), writes stay in those repositories.",[1855,3060,3061],{},"A denied call is not made, and the agent reads why. Hooks fail closed: one that does not answer in 2 seconds denies.",[1905,3063,3065],{"id":3064},"the-agent-other-plugins-use","The agent other plugins use",[1855,3067,3068,3070,3071,3074,3075,2119],{},[1862,3069,1890],{}," reads before it writes, merges only the head it read, and answers with the links GitHub gave back. Another plugin's agent hands it a task instead of calling GitHub itself, and declares it in its plugin's ",[1862,3072,3073],{},"uses"," (see ",[1923,3076,3077],{"href":323},"Install and update",[1933,3079,3083],{"className":3080,"code":3081,"filename":1727,"language":3082,"meta":1939,"style":1939},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","uses:\n  github:\n    version: \">=1.0, \u003C2\"\n    source: hub:ai.oz0\u002Fgithub\n    agents: [oz0-github]\n","yaml",[1862,3084,3085,3093,3100,3117,3128],{"__ignoreMap":1939},[1943,3086,3087,3090],{"class":1945,"line":1946},[1943,3088,3073],{"class":3089},"swJcz",[1943,3091,3092],{"class":2008},":\n",[1943,3094,3095,3098],{"class":1945,"line":2085},[1943,3096,3097],{"class":3089},"  github",[1943,3099,3092],{"class":2008},[1943,3101,3103,3106,3109,3111,3114],{"class":1945,"line":3102},3,[1943,3104,3105],{"class":3089},"    version",[1943,3107,3108],{"class":2008},":",[1943,3110,2009],{"class":2008},[1943,3112,3113],{"class":1952},">=1.0, \u003C2",[1943,3115,3116],{"class":2008},"\"\n",[1943,3118,3120,3123,3125],{"class":1945,"line":3119},4,[1943,3121,3122],{"class":3089},"    source",[1943,3124,3108],{"class":2008},[1943,3126,3127],{"class":1952}," hub:ai.oz0\u002Fgithub\n",[1943,3129,3131,3134,3136,3139,3141],{"class":1945,"line":3130},5,[1943,3132,3133],{"class":3089},"    agents",[1943,3135,3108],{"class":2008},[1943,3137,3138],{"class":2008}," [",[1943,3140,1890],{"class":1952},[1943,3142,3143],{"class":2008},"]\n",[1933,3145,3148],{"className":3080,"code":3146,"filename":3147,"language":3082,"meta":1939,"style":1939},"name: acme-release-notes\ndescription: Writes release notes from the merged pull requests.\nruntime: pydantic-ai\nmodel:\n  primary: anthropic\u002Fclaude-sonnet-5-5\ninstructions: prompts\u002Frelease-notes.md\ninput: text\noutput: text\ntools: [oz.delegate]\ndelegation:\n  allow: [github\u002Foz0-github]   # github's agent, by its address\n","agents\u002Frelease-notes.yaml",[1862,3149,3150,3160,3170,3180,3187,3197,3208,3219,3229,3244,3252],{"__ignoreMap":1939},[1943,3151,3152,3155,3157],{"class":1945,"line":1946},[1943,3153,3154],{"class":3089},"name",[1943,3156,3108],{"class":2008},[1943,3158,3159],{"class":1952}," acme-release-notes\n",[1943,3161,3162,3165,3167],{"class":1945,"line":2085},[1943,3163,3164],{"class":3089},"description",[1943,3166,3108],{"class":2008},[1943,3168,3169],{"class":1952}," Writes release notes from the merged pull requests.\n",[1943,3171,3172,3175,3177],{"class":1945,"line":3102},[1943,3173,3174],{"class":3089},"runtime",[1943,3176,3108],{"class":2008},[1943,3178,3179],{"class":1952}," pydantic-ai\n",[1943,3181,3182,3185],{"class":1945,"line":3119},[1943,3183,3184],{"class":3089},"model",[1943,3186,3092],{"class":2008},[1943,3188,3189,3192,3194],{"class":1945,"line":3130},[1943,3190,3191],{"class":3089},"  primary",[1943,3193,3108],{"class":2008},[1943,3195,3196],{"class":1952}," anthropic\u002Fclaude-sonnet-5-5\n",[1943,3198,3200,3203,3205],{"class":1945,"line":3199},6,[1943,3201,3202],{"class":3089},"instructions",[1943,3204,3108],{"class":2008},[1943,3206,3207],{"class":1952}," prompts\u002Frelease-notes.md\n",[1943,3209,3211,3214,3216],{"class":1945,"line":3210},7,[1943,3212,3213],{"class":3089},"input",[1943,3215,3108],{"class":2008},[1943,3217,3218],{"class":1952}," text\n",[1943,3220,3222,3225,3227],{"class":1945,"line":3221},8,[1943,3223,3224],{"class":3089},"output",[1943,3226,3108],{"class":2008},[1943,3228,3218],{"class":1952},[1943,3230,3232,3235,3237,3239,3242],{"class":1945,"line":3231},9,[1943,3233,3234],{"class":3089},"tools",[1943,3236,3108],{"class":2008},[1943,3238,3138],{"class":2008},[1943,3240,3241],{"class":1952},"oz.delegate",[1943,3243,3143],{"class":2008},[1943,3245,3247,3250],{"class":1945,"line":3246},10,[1943,3248,3249],{"class":3089},"delegation",[1943,3251,3092],{"class":2008},[1943,3253,3255,3258,3260,3262,3265,3268],{"class":1945,"line":3254},11,[1943,3256,3257],{"class":3089},"  allow",[1943,3259,3108],{"class":2008},[1943,3261,3138],{"class":2008},[1943,3263,3264],{"class":1952},"github\u002Foz0-github",[1943,3266,3267],{"class":2008},"]",[1943,3269,3271],{"class":3270},"sHwdD","   # github's agent, by its address\n",[1855,3273,3274],{},"The token, the approvals and the hook then apply to that work too, and the other plugin needs no GitHub secret at all.",[1905,3276,3278],{"id":3277},"events","Events",[1855,3280,3281,3282,3284,3285,3288,3289,3292,3293,3296,3297,2293,3300,2293,3303,2293,3306,2293,3309,2165,3312,3315,3316,3319,3320,3323,3324,3327],{},"The source ",[1862,3283,1872],{}," takes GitHub's webhook deliveries at ",[1862,3286,3287],{},"https:\u002F\u002F\u003Cedge>\u002Fevents\u002F\u003Ctenant>\u002Fgithub",", checks each one's ",[1862,3290,3291],{},"X-Hub-Signature-256"," with the tenant secret ",[1862,3294,3295],{},"GITHUB_WEBHOOK_SECRET",", and turns it into events of the types ",[1862,3298,3299],{},"pull_request",[1862,3301,3302],{},"pull_request_review",[1862,3304,3305],{},"check_suite",[1862,3307,3308],{},"workflow_run",[1862,3310,3311],{},"issue_comment",[1862,3313,3314],{},"push",", with subjects such as ",[1862,3317,3318],{},"octo\u002Fdemo#12"," (a pull request or an issue) and ",[1862,3321,3322],{},"octo\u002Fdemo@main"," (a push). See ",[1923,3325,3326],{"href":763},"Event sources"," for what an event carries.",[1855,3329,3330,3331,3334],{},"With the GitHub App, the app's webhooks already go there with the right secret, which its connection saved. With a token, add a webhook to the repository (content type ",[1862,3332,3333],{},"application\u002Fjson",") and set the same secret on both sides, in the tenant as a signing key bound to the edge's address GitHub posts to:",[1933,3336,3338],{"className":1935,"code":3337,"filename":1937,"language":1938,"meta":1939,"style":1939},"openssl rand -hex 32 | tee \u002Fdev\u002Fstderr | oz0 secret set GITHUB_WEBHOOK_SECRET --signing --host \u003Cedge>:7443\n",[1862,3339,3340],{"__ignoreMap":1939},[1943,3341,3342,3345,3348,3351,3355,3357,3360,3363,3365,3367,3369,3371,3374,3377,3380,3383,3386,3389,3392],{"class":1945,"line":1946},[1943,3343,3344],{"class":1949},"openssl",[1943,3346,3347],{"class":1952}," rand",[1943,3349,3350],{"class":1952}," -hex",[1943,3352,3354],{"class":3353},"sbssI"," 32",[1943,3356,2019],{"class":2008},[1943,3358,3359],{"class":1949}," tee",[1943,3361,3362],{"class":1952}," \u002Fdev\u002Fstderr",[1943,3364,2019],{"class":2008},[1943,3366,2022],{"class":1949},[1943,3368,2025],{"class":1952},[1943,3370,2028],{"class":1952},[1943,3372,3373],{"class":1952}," GITHUB_WEBHOOK_SECRET",[1943,3375,3376],{"class":1952}," --signing",[1943,3378,3379],{"class":1952}," --host",[1943,3381,3382],{"class":2008}," \u003C",[1943,3384,3385],{"class":1952},"edg",[1943,3387,3388],{"class":2012},"e",[1943,3390,3391],{"class":2008},">",[1943,3393,3394],{"class":1952},":7443\n",[1855,3396,3397,3398,3402],{},"A ",[1923,3399,3401],{"href":3400},"\u002Fbuild\u002Fparts\u002Froutines#events","routine"," that greets each new pull request, as its own identity and with only the tools it lists:",[1933,3404,3407],{"className":3080,"code":3405,"filename":3406,"language":3082,"meta":1939,"style":1939},"name: greet-prs\ndescription: Greets each new pull request\nagent: oz0-github\ninput: Greet the pull request in the trigger data.\nowner_team: dev\ntools: [oz0_github.get_pull_request, oz0_github.comment]\ntriggers:\n  - name: opened\n    event:\n      source: github\n      types: [pull_request]\n      filter: event.action == 'opened'\nlimits: { budget_usd: 0.5, daily_budget_usd: 5 }\n","greet-prs.yaml",[1862,3408,3409,3418,3427,3437,3446,3456,3475,3482,3495,3502,3512,3525,3536],{"__ignoreMap":1939},[1943,3410,3411,3413,3415],{"class":1945,"line":1946},[1943,3412,3154],{"class":3089},[1943,3414,3108],{"class":2008},[1943,3416,3417],{"class":1952}," greet-prs\n",[1943,3419,3420,3422,3424],{"class":1945,"line":2085},[1943,3421,3164],{"class":3089},[1943,3423,3108],{"class":2008},[1943,3425,3426],{"class":1952}," Greets each new pull request\n",[1943,3428,3429,3432,3434],{"class":1945,"line":3102},[1943,3430,3431],{"class":3089},"agent",[1943,3433,3108],{"class":2008},[1943,3435,3436],{"class":1952}," oz0-github\n",[1943,3438,3439,3441,3443],{"class":1945,"line":3119},[1943,3440,3213],{"class":3089},[1943,3442,3108],{"class":2008},[1943,3444,3445],{"class":1952}," Greet the pull request in the trigger data.\n",[1943,3447,3448,3451,3453],{"class":1945,"line":3130},[1943,3449,3450],{"class":3089},"owner_team",[1943,3452,3108],{"class":2008},[1943,3454,3455],{"class":1952}," dev\n",[1943,3457,3458,3460,3462,3464,3467,3470,3473],{"class":1945,"line":3199},[1943,3459,3234],{"class":3089},[1943,3461,3108],{"class":2008},[1943,3463,3138],{"class":2008},[1943,3465,3466],{"class":1952},"oz0_github.get_pull_request",[1943,3468,3469],{"class":2008},",",[1943,3471,3472],{"class":1952}," oz0_github.comment",[1943,3474,3143],{"class":2008},[1943,3476,3477,3480],{"class":1945,"line":3210},[1943,3478,3479],{"class":3089},"triggers",[1943,3481,3092],{"class":2008},[1943,3483,3484,3487,3490,3492],{"class":1945,"line":3221},[1943,3485,3486],{"class":2008},"  -",[1943,3488,3489],{"class":3089}," name",[1943,3491,3108],{"class":2008},[1943,3493,3494],{"class":1952}," opened\n",[1943,3496,3497,3500],{"class":1945,"line":3231},[1943,3498,3499],{"class":3089},"    event",[1943,3501,3092],{"class":2008},[1943,3503,3504,3507,3509],{"class":1945,"line":3246},[1943,3505,3506],{"class":3089},"      source",[1943,3508,3108],{"class":2008},[1943,3510,3511],{"class":1952}," github\n",[1943,3513,3514,3517,3519,3521,3523],{"class":1945,"line":3254},[1943,3515,3516],{"class":3089},"      types",[1943,3518,3108],{"class":2008},[1943,3520,3138],{"class":2008},[1943,3522,3299],{"class":1952},[1943,3524,3143],{"class":2008},[1943,3526,3528,3531,3533],{"class":1945,"line":3527},12,[1943,3529,3530],{"class":3089},"      filter",[1943,3532,3108],{"class":2008},[1943,3534,3535],{"class":1952}," event.action == 'opened'\n",[1943,3537,3539,3542,3544,3547,3550,3552,3555,3557,3560,3562,3565],{"class":1945,"line":3538},13,[1943,3540,3541],{"class":3089},"limits",[1943,3543,3108],{"class":2008},[1943,3545,3546],{"class":2008}," {",[1943,3548,3549],{"class":3089}," budget_usd",[1943,3551,3108],{"class":2008},[1943,3553,3554],{"class":3353}," 0.5",[1943,3556,3469],{"class":2008},[1943,3558,3559],{"class":3089}," daily_budget_usd",[1943,3561,3108],{"class":2008},[1943,3563,3564],{"class":3353}," 5",[1943,3566,3567],{"class":2008}," }\n",[1855,3569,3570,3571,3574,3575,2165,3577,3579,3580,3582],{},"A job an outside event started runs its tool calls in the node's ",[1923,3572,3573],{"href":2159},"sandbox",", whose egress allows ",[1862,3576,2164],{},[1862,3578,2168],{}," (where GitHub sends ",[1862,3581,2180],{},"'s archive): the token such a call gets is the one minted for it, not a key that mints more.",[1905,3584,3586],{"id":3585},"the-merge-when-green-flow","The merge-when-green flow",[1855,3588,3589,3591,3592,3596,3597,3600,3601,3604,3605,3607,3608,3611],{},[1862,3590,1864],{}," is a ",[1923,3593,3595],{"href":3594},"\u002Fbuild\u002Fplugins\u002Fstructure#four-plugin-kinds","connector",": GitHub's tools, its connection, its events and\none delegate agent, and no business logic. The flow ",[1862,3598,3599],{},"oz0-github-merge-when-green",", which up to 1.2.0 came with it, is\nits own plugin since 1.3.0, the capability ",[1862,3602,3603],{},"ai.oz0\u002Fmerge-when-green",", which reaches GitHub through the four\n",[1862,3606,1883],{}," functions its ",[1862,3609,3610],{},"uses:"," names. It reads a pull request and its head's checks, and merges exactly that head\nwhen the checks passed and it is not a draft (a person approves, as for every merge), or comments why it waits.",[1855,3613,3614,3615,3617,3618,3621],{},"To keep the flow, upgrade ",[1862,3616,1872],{}," to 1.3.0 first, then install ",[1862,3619,3620],{},"merge-when-green"," (routines that run the flow by\nname keep working):",[1933,3623,3625],{"className":1935,"code":3624,"filename":1937,"language":1938,"meta":1939,"style":1939},"oz0 plugin install https:\u002F\u002Fgithub.com\u002Forchestrator-zero\u002Forchestrator-zero --path plugins\u002Fmerge-when-green\noz0 run oz0-github-merge-when-green '{\"repo\": \"acme\u002Fapi\", \"number\": 42}'\n",[1862,3626,3627,3642],{"__ignoreMap":1939},[1943,3628,3629,3631,3633,3635,3637,3639],{"class":1945,"line":1946},[1943,3630,1714],{"class":1949},[1943,3632,1953],{"class":1952},[1943,3634,1956],{"class":1952},[1943,3636,1959],{"class":1952},[1943,3638,1962],{"class":1952},[1943,3640,3641],{"class":1952}," plugins\u002Fmerge-when-green\n",[1943,3643,3644,3646,3649,3652,3655,3658],{"class":1945,"line":2085},[1943,3645,1714],{"class":1949},[1943,3647,3648],{"class":1952}," run",[1943,3650,3651],{"class":1952}," oz0-github-merge-when-green",[1943,3653,3654],{"class":2008}," '",[1943,3656,3657],{"class":1952},"{\"repo\": \"acme\u002Fapi\", \"number\": 42}",[1943,3659,3660],{"class":2008},"'\n",[1855,3662,3663,3664,3667,3668,3671],{},"Its eval cases replay recorded step outputs (",[1862,3665,3666],{},"evals\u002Fsteps\u002Fmerge-when-green\u002F","), so its quality gate checks the flow's logic at every install and update with no call to GitHub or a model, and ",[1862,3669,3670],{},"oz0 plugin test"," runs them the same way.",[3673,3674,3675],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":1939,"searchDepth":2085,"depth":2085,"links":3677},[3678,3682,3687,3688,3689],{"id":1907,"depth":2085,"text":1908,"children":3679},[3680,3681],{"id":1977,"depth":3102,"text":1978},{"id":2037,"depth":3102,"text":2038},{"id":2232,"depth":2085,"text":2233,"children":3683},[3684,3685,3686],{"id":2663,"depth":3102,"text":2664},{"id":2746,"depth":3102,"text":2747},{"id":2903,"depth":3102,"text":2904},{"id":3064,"depth":2085,"text":3065},{"id":3277,"depth":2085,"text":3278},{"id":3585,"depth":2085,"text":3586},"The verified ai.oz0\u002Fgithub plugin - repositories, issues, pull requests, checks and reviews for agents, GitHub's webhooks as events, and a GitHub App of your own.","md",null,{"audience":3694,"doc_type":3695},"plugin authors","how-to",{"icon":496},{"title":493,"description":3690},"2rzlwsdgqn08y28SBqueD0W6jcKQUkto35zZXVsk1S8",[3700,3702],{"title":489,"path":490,"stem":491,"description":3701,"icon":487,"children":-1},"Add an overlay or install from a marketplace or the MCP Registry.",{"title":498,"path":499,"stem":500,"description":3703,"icon":501,"children":-1},"Installed plugins' packages compared with known advisories from your indexes, a file you import or a feed you turn on, with the version that fixes each one. Nothing is sent anywhere to do it.",1794442921742]