[{"data":1,"prerenderedAt":3197},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fconcepts\u002Foutbound-connections\u002Fserver":1849,"docs-surround:\u002Fconcepts\u002Foutbound-connections\u002Fserver":3192},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":174,"body":1851,"description":3183,"extension":3184,"links":3185,"meta":3186,"navigation":3189,"path":175,"seo":3190,"stem":176,"__hash__":3191},"docs\u002F02.concepts\u002F08.outbound-connections\u002F01.server.md",{"type":1852,"value":1853,"toc":3164},"minimark",[1854,1858,1863,2865,2876,2880,2886,2889,2895,2898,2904,2912,2915,2935,2938,2943,2946,2953,2962,2965,2972,2975,2982,2985,2993,3004,3007,3015,3018,3041,3044,3050,3057,3060,3072,3075,3082,3085,3088,3092,3095,3102,3105,3112,3115,3118,3122,3125,3130,3133,3140,3143,3149,3156],[1855,1856,1857],"p",{},"For: cluster operators and plugin authors.",[1859,1860,1862],"h2",{"id":1861},"the-server","The server",[1864,1865,1866,1885],"table",{},[1867,1868,1869],"thead",{},[1870,1871,1872,1876,1879,1882],"tr",{},[1873,1874,1875],"th",{},"Host",[1873,1877,1878],{},"Why",[1873,1880,1881],{},"When",[1873,1883,1884],{},"Turn it off",[1886,1887,1888,1914,1934,1965,1987,2002,2015,2042,2069,2110,2128,2154,2185,2199,2226,2243,2289,2326,2357,2389,2414,2436,2461,2504,2532,2560,2589,2611,2643,2668,2708,2733,2756,2794,2815],"tbody",{},[1870,1889,1890,1897,1900,1911],{},[1891,1892,1893],"td",{},[1894,1895,1896],"code",{},"version-info.temporal.io",[1891,1898,1899],{},"Temporal's version check, which would send the cluster's ID, version, OS, database type and SDKs",[1891,1901,1902,1906,1907,1910],{},[1903,1904,1905],"strong",{},"Never",": off in dev and cluster mode (",[1894,1908,1909],{},"frontend.enableServerVersionCheck",")",[1891,1912,1913],{},"Already off",[1870,1915,1916,1921,1924,1932],{},[1891,1917,1918],{},[1894,1919,1920],{},"newsfeed.temporal.io",[1891,1922,1923],{},"The Temporal UI's news feed, in your browser",[1891,1925,1926,1928,1929,1910],{},[1903,1927,1905],{},": off (",[1894,1930,1931],{},"DisableNewsFetch",[1891,1933,1913],{},[1870,1935,1936,1947,1954,1957],{},[1891,1937,1938,1939,1942,1943,1946],{},"LLM providers: ",[1894,1940,1941],{},"api.anthropic.com",", ",[1894,1944,1945],{},"api.openai.com",", and the base URL of each provider you add",[1891,1948,1949,1950,1953],{},"The gateway calls the model a job asked for, with the tenant's key; ",[1894,1951,1952],{},"oz0 doctor"," asks for the list of models to check a key",[1891,1955,1956],{},"Only when a tenant has a key or a provider and an agent calls a model",[1891,1958,1959,1960,1964],{},"No key, or ",[1961,1962,1963],"a",{"href":1309},"local models"," only",[1870,1966,1967,1970,1973,1984],{},[1891,1968,1969],{},"Your OTLP collector",[1891,1971,1972],{},"Traces of the server and the nodes",[1891,1974,1975,1976,1979,1980,1983],{},"Only with ",[1894,1977,1978],{},"server start --otlp-endpoint"," (Temporal's own traces only with ",[1894,1981,1982],{},"OTEL_TRACES_EXPORTER"," in the server's environment)",[1891,1985,1986],{},"Leave it unset",[1870,1988,1989,1992,1995,2000],{},[1891,1990,1991],{},"Your identity providers",[1891,1993,1994],{},"Console sign-in",[1891,1996,1975,1997],{},[1894,1998,1999],{},"--oidc-config",[1891,2001,1986],{},[1870,2003,2004,2007,2010,2013],{},[1891,2005,2006],{},"Your S3-compatible object store",[1891,2008,2009],{},"Large payloads",[1891,2011,2012],{},"Only when configured",[1891,2014,1986],{},[1870,2016,2017,2027,2030,2039],{},[1891,2018,2019,2020,1942,2023,2026],{},"Temporal Cloud (",[1894,2021,2022],{},"\u003Cnamespace>.tmprl.cloud",[1894,2024,2025],{},"login.tmprl.cloud",") or your own Temporal",[1891,2028,2029],{},"The Temporal backend",[1891,2031,1975,2032,2035,2036],{},[1894,2033,2034],{},"--temporal-backend cloud"," or ",[1894,2037,2038],{},"external",[1891,2040,2041],{},"Embedded Temporal, the default",[1870,2043,2044,2051,2058,2066],{},[1891,2045,2046,2047,2050],{},"Git forges (",[1894,2048,2049],{},"github.com"," and its API, GitLab, any Git URL)",[1891,2052,2053,2054,2057],{},"Plugin installs and updates from Git, private repositories with a token, and ",[1961,2055,2056],{"href":1660},"Connections"," such as the GitHub App",[1891,2059,2060,2061,2065],{},"When an admin installs a plugin from a forge, or connects one; and when a job ",[1961,2062,2064],{"href":2063},"\u002Fgovern\u002Freviewed-changes\u002Fproposals#change-requests-a-job-files","proposes an update"," of a plugin installed from Git, the edge asks the forge for the commit its ref is at (refs only, nothing downloaded)",[1891,2067,2068],{},"Install from a local folder or bundle",[1870,2070,2071,2079,2094,2097],{},[1891,2072,2073,1942,2076],{},[1894,2074,2075],{},"registry.npmjs.org",[1894,2077,2078],{},"pypi.org",[1891,2080,2081,2082,2085,2086,2089,2090,1910],{},"Pinning a plugin's ",[1894,2083,2084],{},"npm:"," and ",[1894,2087,2088],{},"pypi:"," tools and harness packages, with every package they depend on, to exact versions and the hashes of their files (",[1961,2091,2093],{"href":2092},"\u002Fbuild\u002Fplugins\u002Fpackages#pinning-and-hashes","pinning and hashes",[1891,2095,2096],{},"When a plugin with such a package is installed or updated, pinned in the manifest or not",[1891,2098,2099,2085,2102,2105,2106,2109],{},[1894,2100,2101],{},"OZ0_PLUGIN_PYPI_URL",[1894,2103,2104],{},"OZ0_PLUGIN_NPM_URL"," point the edge at your own mirrors (the npm one also for imported plugins' ",[1894,2107,2108],{},"npx"," servers and marketplace npm entries); or no such plugins",[1870,2111,2112,2115,2118,2125],{},[1891,2113,2114],{},"OCI registries",[1891,2116,2117],{},"Mirroring a plugin's container image on the edge",[1891,2119,2120,2121,2124],{},"When a plugin with an ",[1894,2122,2123],{},"oci:"," tool is installed",[1891,2126,2127],{},"No such plugins",[1870,2129,2130,2135,2145,2148],{},[1891,2131,2132],{},[1894,2133,2134],{},"registry.modelcontextprotocol.io",[1891,2136,2137,2138,1942,2141,2144],{},"The MCP Registry: ",[1894,2139,2140],{},"plugin mcp",[1894,2142,2143],{},"plugin install mcp:...",", the console's MCP Registry page",[1891,2146,2147],{},"Only when someone uses them",[1891,2149,2150,2153],{},[1894,2151,2152],{},"OZ0_MCP_REGISTRY_URL"," points at your own registry",[1870,2155,2156,2162,2165,2176],{},[1891,2157,2158,2161],{},[1894,2159,2160],{},"hub.oz0.ai"," (coming soon)",[1891,2163,2164],{},"The plugin hub's signed index",[1891,2166,2167,2168,2171,2172,2175],{},"Only for ",[1894,2169,2170],{},"hub:"," installs and ",[1894,2173,2174],{},"index refresh","; builds without our root key never fetch it",[1891,2177,2178,2181,2182],{},[1894,2179,2180],{},"index remove oz0","; your own index with ",[1894,2183,2184],{},"index add",[1870,2186,2187,2190,2193,2196],{},[1891,2188,2189],{},"The URLs of routines' safe outputs, flows' webhooks and chat channels",[1891,2191,2192],{},"What an agent's routine posts, and replies to Slack and Discord",[1891,2194,2195],{},"Only when a tenant sets them up",[1891,2197,2198],{},"Do not configure them",[1870,2200,2201,2204,2217,2220],{},[1891,2202,2203],{},"The tenant's LLM providers, for live evals and model canaries",[1891,2205,2206,2207,2211,2212,2216],{},"An ",[1961,2208,2210],{"href":2209},"\u002Fimprove\u002Fevals\u002Fregressions#scheduled-evals","eval routine"," runs a plugin's eval cases against the models its agents use; a ",[1961,2213,2215],{"href":2214},"\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement#model-canaries","model canary"," sends about 15 one-token calls a day (294 once, to start); a kept case runs three times; all with the tenant's key, billed to the tenant",[1891,2218,2219],{},"Only after a tenant admin saves an eval routine or turns a canary on, or someone keeps a job as an eval case",[1891,2221,2222,2223],{},"Do not save eval routines; ",[1894,2224,2225],{},"oz0 model canary off",[1870,2227,2228,2234,2237,2240],{},[1891,2229,2230,2231],{},"The address in ",[1894,2232,2233],{},"oz0 server dist pull",[1891,2235,2236],{},"Mirroring a release onto the edge",[1891,2238,2239],{},"Only when an operator runs it",[1891,2241,2242],{},"Copy the folder by hand",[1870,2244,2245,2272,2279,2282],{},[1891,2246,2247,2250,2251,2254,2255,2258,2259,2250,2262,1942,2265,1942,2268,2271],{},[1894,2248,2249],{},"slack.com"," (",[1894,2252,2253],{},"\u002Fapi\u002Foauth.v2.access"," with a made-up code, ",[1894,2256,2257],{},"\u002Fapi\u002Fauth.test","), ",[1894,2260,2261],{},"discord.com",[1894,2263,2264],{},"\u002Fapi\u002Fv10\u002Fusers\u002F@me",[1894,2266,2267],{},"\u002Fapi\u002Fv10\u002Fapplications\u002F@me",[1894,2269,2270],{},"\u002Fapi\u002Foauth2\u002Ftoken"," with a client credentials grant), and the addresses other plugins' connection checks name",[1891,2273,2274,2275,1910],{},"The edge checks a client secret or bot token an admin pasted or a connection saved, for an app of the tenant's own (",[1961,2276,2278],{"href":2277},"\u002Fadmin\u002Fconnections#your-own-app-about-two-minutes","guided steps",[1891,2280,2281],{},"Only while an admin runs a connection's steps, from the edge",[1891,2283,2284,2285,2288],{},"Set the secrets by hand (",[1894,2286,2287],{},"oz0 secret set",") instead of connecting",[1870,2290,2291,2306,2309,2323],{},[1891,2292,2293,2294,2297,2298,2301,2302,2305],{},"The token endpoints of providers signed with OAuth2 (",[1894,2295,2296],{},"auth.token_url","), such as ",[1894,2299,2300],{},"oauth2.googleapis.com"," for Vertex AI and ",[1894,2303,2304],{},"login.microsoftonline.com"," for Entra",[1891,2307,2308],{},"The edge trades a tenant's client secret or service account key for a bearer token; one request per tenant and provider when a token is about to end, never with a redirect followed",[1891,2310,2311,2312,2315,2316,2035,2319,2322],{},"Only for a provider record whose ",[1894,2313,2314],{},"auth.kind"," is ",[1894,2317,2318],{},"oauth2_client_credentials",[1894,2320,2321],{},"oauth2_jwt_bearer",", when an agent calls it",[1891,2324,2325],{},"Use a header key, or delete the record",[1870,2327,2328,2338,2341,2348],{},[1891,2329,2330,2331,2334,2335],{},"Your SMTP relay (",[1894,2332,2333],{},"--smtp-addr",") and the webhook targets a tenant admin names in a ",[1961,2336,2337],{"href":1698},"notification rule",[1891,2339,2340],{},"Notifications of approvals that wait, escalate or expire, questions, budget requests and failed jobs: email over STARTTLS or TLS with the relay's certificate verified, and signed JSON POSTs",[1891,2342,2343,2344,2347],{},"An SMTP relay only when configured; a webhook only when a tenant admin adds one (private addresses only in networks ",[1894,2345,2346],{},"--notify-allow-net"," allows); both from the edge",[1891,2349,2350,2351,2353,2354,1910],{},"Leave ",[1894,2352,2333],{}," unset, and delete the tenant's webhook rules (",[1894,2355,2356],{},"oz0 notify rule delete",[1870,2358,2359,2375,2381,2385],{},[1891,2360,2361,2364,2365,2250,2367,2370,2371,2374],{},[1894,2362,2363],{},"login.botframework.com"," (the Bot Connector's OpenID metadata and keys), ",[1894,2366,2304],{},[1894,2368,2369],{},"\u002F\u003Ctenant>\u002Foauth2\u002Fv2.0\u002Ftoken",", a client credentials grant for the bot), and the key hosts of any other plugin's ",[1894,2372,2373],{},"jwt"," event source",[1891,2376,2377],{},[1961,2378,2380],{"href":2379},"#loginbotframeworkcom-the-bot-connectors-openid-metadata-and-keys-loginmicrosoftonlinecom-tenantoauth2v20token-a-client-details","Details",[1891,2382,2383],{},[1961,2384,2380],{"href":2379},[1891,2386,2387],{},[1961,2388,2380],{"href":2379},[1870,2390,2391,2397,2404,2411],{},[1891,2392,2393,2394],{},"The URL given to ",[1894,2395,2396],{},"oz0 plugin import openapi",[1891,2398,2399,2400,2403],{},"Reading an OpenAPI document to write a plugin from it (",[1961,2401,2402],{"href":728},"OpenAPI import","): one GET from the operator's machine, HTTPS only, TLS verified, no credentials, at most 16 MiB and 30 seconds, redirects only to HTTPS",[1891,2405,2406,2407,2410],{},"Only when someone runs the command with an ",[1894,2408,2409],{},"https:\u002F\u002F"," URL",[1891,2412,2413],{},"Download the document yourself and give the file",[1870,2415,2416,2419,2427,2430],{},[1891,2417,2418],{},"Your identity providers' discovery documents and keys, from the edge",[1891,2420,2421,2422,2426],{},"The ",[1961,2423,2425],{"href":2424},"\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication#apps-that-act-as-their-people","token exchange for apps"," checks a person's token against the keys of the provider the app names (the issuer a cluster admin configured, never an app's own URL): discovery once, the keys once and again for a key the edge does not hold at most once a minute per provider; exchanges are limited per address and per app",[1891,2428,2429],{},"Only after a tenant's owner registers an app, when its backend exchanges a token; from the edge (management already reaches the providers for sign-in)",[1891,2431,2432,2433],{},"Register no app, or ",[1894,2434,2435],{},"oz0 app delete",[1870,2437,2438,2441,2452,2455],{},[1891,2439,2440],{},"The base URL or token endpoint of each provider record that reads a secret being set",[1891,2442,2443,2447,2448,2451],{},[1961,2444,2446],{"href":2445},"\u002Fadmin\u002Fsecrets\u002Frotation#a-providers-key-is-tested-before-it-is-stored","Testing a provider's key before it is stored",": one ",[1894,2449,2450],{},"GET \u002Fv1\u002Fmodels"," with the candidate key, or one token request with the candidate client secret or service account key, never cached and never with a redirect followed, under the record's own address rules",[1891,2453,2454],{},"Only when a tenant admin sets a secret a provider record reads, with the test (the default for such secrets); from the edge",[1891,2456,2457,2460],{},[1894,2458,2459],{},"oz0 secret set --no-test --reason ...",", or untick the test on Credentials' Secrets tab",[1870,2462,2463,2470,2490,2496],{},[1891,2464,2465,2466,2469],{},"The secret stores an operator lists in an edge's ",[1894,2467,2468],{},"--secret-stores"," file (OpenBao, Vault, a cloud's secret manager, or any program that speaks the protocol)",[1891,2471,2472,2473,2477,2478,2481,2482,2485,2486,2489],{},"The edge starts each store's process, which reads the tenants' ",[1961,2474,2476],{"href":2475},"\u002Fadmin\u002Fsecrets\u002Fexternal-stores#secrets-in-your-own-store","secret references"," from its store: when a reference is first used, then once every ",[1894,2479,2480],{},"cache_ttl"," for the hot swap, a ",[1894,2483,2484],{},"health"," check a minute, and for ",[1894,2487,2488],{},"oz0 secret export-to-sealed",". The process dials what its own configuration names; the edge itself dials nothing",[1891,2491,2492,2493,2495],{},"Only on an edge started with ",[1894,2494,2468],{},", for the references tenants set",[1891,2497,2350,2498,2500,2501,2503],{},[1894,2499,2468],{}," unset; ",[1894,2502,2488],{}," first moves the references back to sealed secrets",[1870,2505,2506,2513,2516,2525],{},[1891,2507,2508,2509,2512],{},"Whatever your ",[1961,2510,2511],{"href":1656},"key commands"," reach: an HSM, a cloud KMS or a secrets engine",[1891,2514,2515],{},"The server runs the command you gave to unwrap the master key and the secrets key, and asks it whether it still reaches its wrapping key; the server itself opens no connection for it",[1891,2517,1975,2518,2035,2521,2524],{},[1894,2519,2520],{},"--master-key-command",[1894,2522,2523],{},"--secrets-key-command",": at each start, every 10 minutes, and when an operator runs the wrap and unwrap-to-file commands",[1891,2526,2527,2528,2531],{},"Leave the flags unset; ",[1894,2529,2530],{},"oz0 server master-key unwrap-to-file"," moves a key back to a plain file",[1870,2533,2534,2547,2552,2556],{},[1891,2535,2536,1942,2538,2540,2541,2250,2544,1910],{},[1894,2537,2078],{},[1894,2539,2075],{},", OCI registries, plugin indexes and release addresses, on an edge that serves an ",[1961,2542,2543],{"href":1483},"offline folder",[1894,2545,2546],{},"server start --offline-dir",[1891,2548,2549],{},[1961,2550,2380],{"href":2551},"#pypiorg-registrynpmjsorg-oci-registries-plugin-indexes-and-release-addresses-on-an-edge-details",[1891,2553,2554],{},[1961,2555,2380],{"href":2551},[1891,2557,2558],{},[1961,2559,2380],{"href":2551},[1870,2561,2562,2576,2581,2585],{},[1891,2563,2564,2565,2568,2569,2572,2573],{},"The advisory feed you name with ",[1894,2566,2567],{},"OZ0_ADVISORY_FEED"," (or ",[1894,2570,2571],{},"server start --advisory-feed-file","), such as OSV's ",[1894,2574,2575],{},"storage.googleapis.com\u002Fosv-vulnerabilities\u002FPyPI\u002Fall.zip",[1891,2577,2578],{},[1961,2579,2380],{"href":2580},"#the-advisory-feed-you-name-with-oz0_advisory_feed-or-server-start-advisory-feed-file-such-as-osvs-storagegoogleapiscomosv-vulnerabilitiespypiallzip",[1891,2582,2583],{},[1961,2584,2380],{"href":2580},[1891,2586,2587],{},[1961,2588,2380],{"href":2580},[1870,2590,2591,2594,2601,2608],{},[1891,2592,2593],{},"The tenant's LLM providers, for comparisons",[1891,2595,2596,2597,2600],{},"A ",[1961,2598,2599],{"href":965},"comparison"," runs an agent's cases on two arms, several times each, as shadow runs, with the tenant's key, billed to the tenant and within the comparison's budget",[1891,2602,2603,2604,2607],{},"Only when a tenant's operator or admin starts one (",[1894,2605,2606],{},"oz0 compare-savings start",", or the Measured savings page)",[1891,2609,2610],{},"Do not start comparisons",[1870,2612,2613,2630,2635,2639],{},[1891,2614,2615,2616,2619,2620,1942,2623,2035,2626,2629],{},"The API of a Git plugin's forge (",[1894,2617,2618],{},"api.github.com",", or ",[1894,2621,2622],{},"\u002Fapi\u002Fv3",[1894,2624,2625],{},"\u002Fapi\u002Fv4",[1894,2627,2628],{},"\u002Fapi\u002Fv1"," on the forge's own host)",[1891,2631,2632],{},[1961,2633,2380],{"href":2634},"#the-api-of-a-git-plugins-forge-apigithubcom-or-apiv3-apiv4-or-apiv1-on-the-forges-own-host",[1891,2636,2637],{},[1961,2638,2380],{"href":2634},[1891,2640,2641],{},[1961,2642,2380],{"href":2634},[1870,2644,2645,2655,2660,2664],{},[1891,2646,2647,2648,2651,2652,2654],{},"The token endpoints of ",[1894,2649,2650],{},"on_behalf_of"," connections (a literal ",[1894,2653,2409],{}," URL in the plugin's manifest)",[1891,2656,2657],{},[1961,2658,2380],{"href":2659},"#the-token-endpoints-of-on_behalf_of-connections-a-literal-https-url-in-the-plugins-manifest",[1891,2661,2662],{},[1961,2663,2380],{"href":2659},[1891,2665,2666],{},[1961,2667,2380],{"href":2659},[1870,2669,2670,2689,2694,2705],{},[1891,2671,2672,2673,2676,2677,2085,2680,1942,2683,2685,2686],{},"The clouds' token services: ",[1894,2674,2675],{},"sts.\u003Cregion>.amazonaws.com"," (AWS STS), ",[1894,2678,2679],{},"sts.googleapis.com",[1894,2681,2682],{},"iamcredentials.googleapis.com",[1894,2684,2304],{}," (Entra), or the endpoints an operator names with ",[1894,2687,2688],{},"--cloud-endpoint",[1891,2690,2691,2693],{},[1961,2692,1391],{"href":1392},": the edge exchanges the calling agent's workload token (the agent, never a person) for a credential that lives an hour, kept in memory for the job's next calls; the endpoints are fixed, never a manifest's or a tenant's, and no redirect is followed",[1891,2695,2696,2697,2700,2701,2704],{},"Only for a model provider of ",[1894,2698,2699],{},"auth.kind: federated"," when an agent calls it, or a plugin's connection of kind ",[1894,2702,2703],{},"federated"," when one of its tools is called; from the edge",[1891,2706,2707],{},"Use providers and connections with keys, delete the federated records, or uninstall the plugin",[1870,2709,2710,2716,2723,2726],{},[1891,2711,2712,2713],{},"The folder or S3 bucket given to ",[1894,2714,2715],{},"oz0 tenant oidc publish",[1891,2717,2718,2722],{},[1961,2719,2721],{"href":2720},"\u002Ffleet\u002Fcloud-federation#private-clusters","Discovery for a private cluster",": the tenant's discovery document and public key set, read from an edge and written where the clouds can fetch them",[1891,2724,2725],{},"Only when an operator runs the command, from the machine it runs on",[1891,2727,2728,2729,2732],{},"Do not run it (",[1894,2730,2731],{},"oz0 tenant oidc jwks"," only prints the key set)",[1870,2734,2735,2743,2748,2752],{},[1891,2736,2737,2738,2742],{},"The hosts of MCP clients' ",[1961,2739,2741],{"href":2740},"\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth#who-may-connect","client metadata documents"," that a tenant lists",[1891,2744,2745],{},[1961,2746,2380],{"href":2747},"#the-hosts-of-mcp-clients-client-metadata-documents-that-a-tenant-lists",[1891,2749,2750],{},[1961,2751,2380],{"href":2747},[1891,2753,2754],{},[1961,2755,2380],{"href":2747},[1870,2757,2758,2761,2774,2784],{},[1891,2759,2760],{},"The tenant's LLM providers, for judge jobs",[1891,2762,2763,2764,2768,2769,2773],{},"A judge looks at a ",[1961,2765,2767],{"href":2766},"\u002Fimprove\u002Foutcome-checks\u002Fsampling#sampled-judging-of-finished-jobs","sampled finished job",", or at a judge's ",[1961,2770,2772],{"href":2771},"\u002Fimprove\u002Foutcome-checks\u002Fsampling#anchors-is-it-the-judge-or-the-agent","anchors",", with the tenant's key, through the gateway and its data rules, billed to the tenant",[1891,2775,2776,2777,2035,2780,2783],{},"Only for agents whose definition declares ",[1894,2778,2779],{},"quality.sample",[1894,2781,2782],{},"anchors_file",", or that a tenant rule samples; anchors only when an eval routine or sampling runs",[1891,2785,2786,2787,2790,2791,2793],{},"Rate 0 in a tenant rule (",[1894,2788,2789],{},"oz0 tenant quality --sample AGENT=0","), or no ",[1894,2792,2779],{}," and no anchors",[1870,2795,2796,2802,2807,2811],{},[1891,2797,2798,2799,2801],{},"The token endpoints of connections whose tokens the edge refreshes (a literal ",[1894,2800,2409],{}," URL in the plugin's manifest, or the host a connection was connected for)",[1891,2803,2804],{},[1961,2805,2380],{"href":2806},"#the-token-endpoints-of-connections-whose-tokens-the-edge-refreshes-a-literal-details",[1891,2808,2809],{},[1961,2810,2380],{"href":2806},[1891,2812,2813],{},[1961,2814,2380],{"href":2806},[1870,2816,2817,2834,2840,2854],{},[1891,2818,2819,2250,2822,2825,2826,2250,2828,2830,2831,2833],{},[1894,2820,2821],{},"graph.microsoft.com",[1894,2823,2824],{},"POST \u002Fv1.0\u002Fusers\u002F\u003Csender>\u002FsendMail",") from a node, ",[1894,2827,2304],{},[1894,2829,2369],{},", a client credentials grant for the tenant's own Entra app) from the edge, and the SMTP relay (",[1894,2832,2333],{},") for agents' mail",[1891,2835,2836,2837,2839],{},"The mail agents send with ",[1961,2838,595],{"href":596},": through the relay the edge sends it; through Microsoft Graph the edge mints the app's token for each message it allowed and the plugin's server posts the message, its only egress",[1891,2841,2842,2843,2846,2847,2850,2851],{},"Only in a tenant with ai.oz0\u002Femail installed, its mail domains named and a send approved; Graph only when the tenant set ",[1894,2844,2845],{},"EMAIL_TRANSPORT"," to ",[1894,2848,2849],{},"graph"," and connected ",[1894,2852,2853],{},"email-graph",[1891,2855,2856,2857,2860,2861,2864],{},"Uninstall the plugin, or ",[1894,2858,2859],{},"oz0 plugin revoke-reads email mail","; ",[1894,2862,2863],{},"oz0 connection delete email-graph"," stops the tokens",[2866,2867,2869,2364,2871,2250,2873,2875],"h3",{"id":2868},"loginbotframeworkcom-the-bot-connectors-openid-metadata-and-keys-loginmicrosoftonlinecom-tenantoauth2v20token-a-client-details",[1894,2870,2363],{},[1894,2872,2304],{},[1894,2874,2369],{},", a client details",[2877,2878,1878],"h4",{"id":2879},"why",[1855,2881,2882,2883,1910],{},"The edge checks each Teams delivery's token against the published keys (fetched over HTTPS, kept for their lifetime up to a day, again for an unknown key at most once a minute), and gets the bot's token for each post with the connection's client secret (",[1961,2884,2885],{"href":545},"ai.oz0\u002Fteams",[2877,2887,1881],{"id":2888},"when",[1855,2890,2891,2892,2894],{},"Only in a tenant with ai.oz0\u002Fteams (or a plugin with a ",[1894,2893,2373],{}," source) installed: keys when a delivery comes, the token while connecting and when a post is made; from the edge",[2877,2896,1884],{"id":2897},"turn-it-off",[1855,2899,2900,2901,2864],{},"Uninstall the plugin; ",[1894,2902,2903],{},"oz0 connection delete teams",[2866,2905,2907,1942,2909,2911],{"id":2906},"pypiorg-registrynpmjsorg-oci-registries-plugin-indexes-and-release-addresses-on-an-edge-details",[1894,2908,2078],{},[1894,2910,2075],{},", OCI registries, plugin indexes and release addresses, on an edge details",[2877,2913,1878],{"id":2914},"why-1",[1855,2916,2917,2918,2085,2920,2922,2923,2926,2927,2930,2931,2934],{},"None: the edge pins ",[1894,2919,2088],{},[1894,2921,2084],{}," packages against the folder's files in its own process, takes plugin bundles, OCI plugins and tools' images only from the folder by digest, and fetches no plugin index by URL (an index imported with ",[1894,2924,2925],{},"index add --file"," is never fetched); ",[1894,2928,2929],{},"server dist pull --from \u003Cfolder>"," takes a release and its toolchain from it; an offline node (",[1894,2932,2933],{},"oz0-node run --offline",") takes every plugin package, Python and npm, from the edge's mirrors of the folder",[2877,2936,1881],{"id":2937},"when-1",[1855,2939,2940,2942],{},[1903,2941,1905],{}," while the edge serves a folder",[2877,2944,1884],{"id":2945},"turn-it-off-1",[1855,2947,2948,2949,2952],{},"Already off. Git sources, and the hosts in other rows a folder does not hold (LLM providers, notifications, a harness's ",[1894,2950,2951],{},"binaries","), still need their own answer",[2866,2954,2564,2956,2568,2958,2572,2960],{"id":2955},"the-advisory-feed-you-name-with-oz0_advisory_feed-or-server-start-advisory-feed-file-such-as-osvs-storagegoogleapiscomosv-vulnerabilitiespypiallzip",[1894,2957,2567],{},[1894,2959,2571],{},[1894,2961,2575],{},[2877,2963,1878],{"id":2964},"why-2",[1855,2966,2967,2968,2971],{},"Advisories for the ",[1961,2969,2970],{"href":499},"vulnerability scan"," of installed plugins' packages: one GET of the whole document (OSV entries, OSV's zip or the hub's format), never a query naming your packages; HTTPS with TLS verified (plain HTTP only to loopback), no redirect followed, at most 256 MB",[2877,2973,1881],{"id":2974},"when-2",[1855,2976,2977,2978,2981],{},"Only when an operator sets the feed (off by default): when an edge takes over the scanner's lease (at its start) and every ",[1894,2979,2980],{},"--advisory-feed-every"," (a day), within the hour after a failed fetch; from the edge",[2877,2983,1884],{"id":2984},"turn-it-off-2",[1855,2986,2987,2988,2992],{},"Leave it unset (its advisories are dropped at the next scan); ",[1961,2989,2991],{"href":2990},"\u002Fbuild\u002Fplugins\u002Fvulnerabilities#an-operators-file","import a file"," instead, or rely on the index's",[2866,2994,2615,2996,2619,2998,1942,3000,2035,3002,2629],{"id":2995},"the-api-of-a-git-plugins-forge-apigithubcom-or-apiv3-apiv4-or-apiv1-on-the-forges-own-host",[1894,2997,2618],{},[1894,2999,2622],{},[1894,3001,2625],{},[1894,3003,2628],{},[2877,3005,1878],{"id":3006},"why-3",[1855,3008,3009,3010,3014],{},"Recording the repository's ID and owner at a Git install, and checking them at each update, so that a repository transferred or created again under the same URL is noticed (",[1961,3011,3013],{"href":3012},"\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate#updates-from-new-hands","updates from new hands","); with a private repository's token, sent to that host only",[2877,3016,1881],{"id":3017},"when-3",[1855,3019,3020,3021,1942,3023,1942,3026,3029,3030,3033,3034,3037,3038,3040],{},"When an admin installs or updates a plugin from a Git URL on ",[1894,3022,2049],{},[1894,3024,3025],{},"gitlab.com",[1894,3027,3028],{},"codeberg.org",", or a host named with ",[1894,3031,3032],{},"--forge","; never for an install from a plugin index (its custody is the index's), ",[1894,3035,3036],{},"plugin inspect",", or an offline edge unless ",[1894,3039,3032],{}," names the forge",[2877,3042,1884],{"id":3043},"turn-it-off-3",[1855,3045,3046,3049],{},[1894,3047,3048],{},"--forge none"," at install, which later updates remember, or a source that is not a Git URL",[2866,3051,2647,3053,2651,3055,2654],{"id":3052},"the-token-endpoints-of-on_behalf_of-connections-a-literal-https-url-in-the-plugins-manifest",[1894,3054,2650],{},[1894,3056,2409],{},[2877,3058,1878],{"id":3059},"why-4",[1855,3061,3062,3063,3067,3068,3071],{},"The edge exchanges a ",[1961,3064,3066],{"href":3065},"\u002Fconcepts\u002Fdelegation-and-identity#on-behalf-of-a-person","delegated identity token",", which names the person a job runs for, for the service's own token (RFC 8693): one request per covered tool call, from the edge, never with a redirect followed, at public addresses only (any address in dev mode, or a network ",[1894,3069,3070],{},"--connect-allow-net"," lists)",[2877,3073,1881],{"id":3074},"when-4",[1855,3076,3077,3078,3081],{},"Only in a tenant with a plugin that declares such a connection, when one of its tools is called, and only after a tenant admin allowed delegated tokens off the cluster (",[1894,3079,3080],{},"oz0 tenant oidc delegated-off-cluster",", off by default)",[2877,3083,1884],{"id":3084},"turn-it-off-4",[1855,3086,3087],{},"Leave delegated tokens inside the cluster, or uninstall the plugin. The issuer's own discovery document and keys are served, never sent: outside services fetch them from the edge",[2866,3089,3091],{"id":3090},"the-hosts-of-mcp-clients-client-metadata-documents-that-a-tenant-lists","The hosts of MCP clients' client metadata documents that a tenant lists",[2877,3093,1878],{"id":3094},"why-5",[1855,3096,3097,3098,3101],{},"When an MCP client identifies itself by the https URL of its metadata document, the edge fetches that document to learn the client's name and redirect addresses: only for a host or URL on the tenant's ",[1894,3099,3100],{},"mcp_clients"," allowlist, over https with TLS verified, only from public addresses (checked after the name resolves), no redirects followed, at most 5 KiB within 5 seconds, kept a few minutes",[2877,3103,1881],{"id":3104},"when-5",[1855,3106,3107,3108,3111],{},"Only after a tenant admin allows a client host or document URL (",[1894,3109,3110],{},"oz0 mcp clients policy --allow","), when a person connects such a client; from the edge",[2877,3113,1884],{"id":3114},"turn-it-off-5",[1855,3116,3117],{},"List no hosts or documents (the default): registered loopback clients need no fetch",[2866,3119,3121],{"id":3120},"the-token-endpoints-of-connections-whose-tokens-the-edge-refreshes-a-literal-details","The token endpoints of connections whose tokens the edge refreshes (a literal details",[2877,3123,1878],{"id":3124},"why-6",[1855,3126,3127,3128,3071],{},"The edge renews a connection's token with its refresh token before it expires (RFC 6749 section 6): one request when calls find less than ten minutes left (or less than half the token's lifetime, when that is shorter), from one of them on one edge however many find it at once, to the origin the refresh token was issued at only, never with a redirect followed, at public addresses only (any address in dev mode, or a network ",[1894,3129,3070],{},[2877,3131,1881],{"id":3132},"when-6",[1855,3134,3135,3136,3139],{},"Only in a tenant with a plugin whose connection declares ",[1894,3137,3138],{},"token.refresh",", once it is connected, when one of its tools is called",[2877,3141,1884],{"id":3142},"turn-it-off-6",[1855,3144,3145,3148],{},[1894,3146,3147],{},"oz0 connection delete \u003Cname>",", or uninstall the plugin",[1855,3150,3151,3152,3155],{},"The edge's plugin-source fetches use public HTTPS addresses. Private networks are reachable only where ",[1894,3153,3154],{},"oz0 server start --plugin-source-allow-net"," lists them. This applies to the sources above: Git forges and APIs, package indexes, OCI registries and token services, the MCP Registry, plugin indexes and listed bundles.",[1855,3157,3158,3159,3163],{},"The same rules cover addresses named in plugin content, including marketplace entries, tool images and remote-tool sign-in checks. The edge never reaches its own interface addresses, even inside an allowed network, its link or cloud metadata services. See ",[1961,3160,3162],{"href":3161},"\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources#where-the-edge-fetches-from","where the edge fetches from",". Dev mode can reach every address.",{"title":3165,"searchDepth":3166,"depth":3166,"links":3167},"",2,[3168],{"id":1861,"depth":3166,"text":1862,"children":3169},[3170,3173,3175,3177,3179,3181,3182],{"id":2868,"depth":3171,"text":3172},3,"login.botframework.com (the Bot Connector's OpenID metadata and keys), login.microsoftonline.com (\u002F\u003Ctenant>\u002Foauth2\u002Fv2.0\u002Ftoken, a client details",{"id":2906,"depth":3171,"text":3174},"pypi.org, registry.npmjs.org, OCI registries, plugin indexes and release addresses, on an edge details",{"id":2955,"depth":3171,"text":3176},"The advisory feed you name with OZ0_ADVISORY_FEED (or server start --advisory-feed-file), such as OSV's storage.googleapis.com\u002Fosv-vulnerabilities\u002FPyPI\u002Fall.zip",{"id":2995,"depth":3171,"text":3178},"The API of a Git plugin's forge (api.github.com, or \u002Fapi\u002Fv3, \u002Fapi\u002Fv4 or \u002Fapi\u002Fv1 on the forge's own host)",{"id":3052,"depth":3171,"text":3180},"The token endpoints of on_behalf_of connections (a literal https:\u002F\u002F URL in the plugin's manifest)",{"id":3090,"depth":3171,"text":3091},{"id":3120,"depth":3171,"text":3121},"Server outbound connections for cluster operators and plugin authors.","md",null,{"audience":3187,"doc_type":3188},"cluster operators and plugin authors","reference",true,{"title":174,"description":3183},"JXxifyeTKwxKQalu9SxtRelZww8VZQEHmiMCbWjw_wQ",[3193,3195],{"title":167,"path":168,"stem":169,"description":3194,"icon":172,"children":-1},"Every connection Orchestrator Zero can open to a host outside your cluster, when it does, and how to turn it off. Nothing phones home.",{"title":178,"path":179,"stem":180,"description":3196,"children":-1},"Node and plugin outbound connections for cluster operators and plugin authors.",1794443024670]