[{"data":1,"prerenderedAt":3413},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Ffleet\u002Fkubernetes":1849,"docs-surround:\u002Ffleet\u002Fkubernetes":3408},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1468,"body":1851,"description":3399,"extension":3400,"links":3401,"meta":3402,"navigation":3405,"path":1469,"seo":3406,"stem":1470,"__hash__":3407},"docs\u002F07.fleet\u002F26.kubernetes\u002F00.index.md",{"type":1852,"value":1853,"toc":3386},"minimark",[1854,1858,1871,1876,1913,1917,1952,1956,2019,2028,2087,2090,2140,2159,2883,2902,2907,2910,2931,2949,2970,2974,2985,2991,3078,3081,3084,3089,3098,3102,3117,3134,3138,3153,3157,3174,3218,3229,3304,3322,3331,3335,3346,3355,3364,3373,3382],[1855,1856,1857],"p",{},"For: cluster operators.",[1855,1859,1860,1861,1865,1866,1870],{},"The chart in ",[1862,1863,1864],"code",{},"deploy\u002Fhelm\u002Forchestrator-zero"," runs a ",[1867,1868,1869],"a",{"href":1244},"cluster"," on Kubernetes: two or more servers on a PostgreSQL you provide, each running management, the edge and Temporal's services. Nodes can run in the cluster too, or join from outside it.",[1872,1873,1875],"h2",{"id":1874},"choose-a-task","Choose a task",[1877,1878,1879,1892],"table",{},[1880,1881,1882],"thead",{},[1883,1884,1885,1889],"tr",{},[1886,1887,1888],"th",{},"Task",[1886,1890,1891],{},"Guide",[1893,1894,1895,1905],"tbody",{},[1883,1896,1897,1900],{},[1898,1899,1474],"td",{},[1898,1901,1902],{},[1867,1903,1904],{"href":1475},"Open guide",[1883,1906,1907,1909],{},[1898,1908,1478],{},[1898,1910,1911],{},[1867,1912,1904],{"href":1479},[1872,1914,1916],{"id":1915},"what-you-need","What you need",[1918,1919,1920,1924,1942,1949],"ul",{},[1921,1922,1923],"li",{},"Kubernetes 1.29 or later and Helm (the chart is tested with Helm 4.3).",[1921,1925,1926,1927,1930,1931,1933,1934,1937,1938,1941],{},"PostgreSQL 13 to 16, reachable from the pods, with ",[1862,1928,1929],{},"max_connections"," of at least 100 per server. The user in the URL should be allowed to create databases; otherwise create ",[1862,1932,1714],{},", ",[1862,1935,1936],{},"oz0_temporal"," and ",[1862,1939,1940],{},"oz0_temporal_visibility"," yourself, named after the database in the URL.",[1921,1943,1944,1945,1948],{},"The images, pushed to a registry your cluster pulls from. No official images are published yet; build them with ",[1862,1946,1947],{},"make images"," (below).",[1921,1950,1951],{},"A network plugin that enforces NetworkPolicy, if you want the chart's policies to mean anything. Most do; kind's does.",[1872,1953,1955],{"id":1954},"build-the-images","Build the images",[1957,1958,1964],"pre",{"className":1959,"code":1960,"filename":1961,"language":1962,"meta":1963,"style":1963},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","make images IMAGE_TAG=0.9.0          # orchestrator-zero:0.9.0 and orchestrator-zero-node:0.9.0, built locally\ndocker tag orchestrator-zero:0.9.0 registry.example.com\u002Foz0\u002Forchestrator-zero:0.9.0\ndocker push registry.example.com\u002Foz0\u002Forchestrator-zero:0.9.0   # and the same for orchestrator-zero-node\n","Terminal","bash","",[1862,1965,1966,1990,2005],{"__ignoreMap":1963},[1967,1968,1971,1975,1979,1982,1986],"span",{"class":1969,"line":1970},"line",1,[1967,1972,1974],{"class":1973},"sBMFI","make",[1967,1976,1978],{"class":1977},"sfazB"," images",[1967,1980,1981],{"class":1977}," IMAGE_TAG=",[1967,1983,1985],{"class":1984},"sbssI","0.9.0",[1967,1987,1989],{"class":1988},"sHwdD","          # orchestrator-zero:0.9.0 and orchestrator-zero-node:0.9.0, built locally\n",[1967,1991,1993,1996,1999,2002],{"class":1969,"line":1992},2,[1967,1994,1995],{"class":1973},"docker",[1967,1997,1998],{"class":1977}," tag",[1967,2000,2001],{"class":1977}," orchestrator-zero:0.9.0",[1967,2003,2004],{"class":1977}," registry.example.com\u002Foz0\u002Forchestrator-zero:0.9.0\n",[1967,2006,2008,2010,2013,2016],{"class":1969,"line":2007},3,[1967,2009,1995],{"class":1973},[1967,2011,2012],{"class":1977}," push",[1967,2014,2015],{"class":1977}," registry.example.com\u002Foz0\u002Forchestrator-zero:0.9.0",[1967,2017,2018],{"class":1988},"   # and the same for orchestrator-zero-node\n",[1855,2020,2021,2023,2024,2027],{},[1862,2022,1947],{}," never pushes. Both images are based on ",[1862,2025,2026],{},"debian:trixie-slim"," pinned by digest and run as user 65532 on a read-only root file system.",[1877,2029,2030,2040],{},[1880,2031,2032],{},[1883,2033,2034,2037],{},[1886,2035,2036],{},"Image",[1886,2038,2039],{},"Holds",[1893,2041,2042,2068],{},[1883,2043,2044,2049],{},[1898,2045,2046],{},[1862,2047,2048],{},"orchestrator-zero",[1898,2050,2051,2052,2055,2056,2059,2060,2063,2064,2067],{},"The server binary, ",[1862,2053,2054],{},"git"," for plugin installs from Git, and the ",[1862,2057,2058],{},"dist\u002F"," folder the edge serves to new nodes: node binaries for Linux, macOS and Windows and the runtime bundle, signed with the build machine's release key (",[1862,2061,2062],{},"ARCH=arm64"," builds for arm64; ",[1862,2065,2066],{},"PLATFORMS=linux\u002Famd64"," limits the node binaries it serves).",[1883,2069,2070,2075],{},[1898,2071,2072],{},[1862,2073,2074],{},"orchestrator-zero-node",[1898,2076,2077,2078,2081,2082,2086],{},"The node binary, with uv, Python and the runtime already installed by ",[1862,2079,2080],{},"oz0-node prepare",", and Debian's bubblewrap 0.12.0 for ",[1867,2083,2085],{"href":2084},"\u002Ffleet\u002Fkubernetes#sandbox-tier-1-in-node-pods","sandbox tier 1",". A node starts in seconds without reaching the internet.",[1855,2088,2089],{},"The node image works outside Kubernetes too:",[1957,2091,2093],{"className":1959,"code":2092,"filename":1961,"language":1962,"meta":1963,"style":1963},"docker run -d -e OZ0_SERVER=https:\u002F\u002Fedge.example.com:7443 -e OZ0_JOIN_TOKEN='K10...' \\\n  -v oz0-node:\u002Fvar\u002Flib\u002Forchestrator-zero-node orchestrator-zero-node:0.9.0\n",[1862,2094,2095,2129],{"__ignoreMap":1963},[1967,2096,2097,2099,2102,2105,2108,2111,2113,2116,2120,2123,2125],{"class":1969,"line":1970},[1967,2098,1995],{"class":1973},[1967,2100,2101],{"class":1977}," run",[1967,2103,2104],{"class":1977}," -d",[1967,2106,2107],{"class":1977}," -e",[1967,2109,2110],{"class":1977}," OZ0_SERVER=https:\u002F\u002Fedge.example.com:7443",[1967,2112,2107],{"class":1977},[1967,2114,2115],{"class":1977}," OZ0_JOIN_TOKEN=",[1967,2117,2119],{"class":2118},"sMK4o","'",[1967,2121,2122],{"class":1977},"K10...",[1967,2124,2119],{"class":2118},[1967,2126,2128],{"class":2127},"sTEyZ"," \\\n",[1967,2130,2131,2134,2137],{"class":1969,"line":1992},[1967,2132,2133],{"class":1977},"  -v",[1967,2135,2136],{"class":1977}," oz0-node:\u002Fvar\u002Flib\u002Forchestrator-zero-node",[1967,2138,2139],{"class":1977}," orchestrator-zero-node:0.9.0\n",[1855,2141,2142,2143,2146,2147,2150,2151,2154,2155,2158],{},"Its entrypoint copies uv, Python and the runtime into the volume unless they are there already, joins once when the volume holds no identity (with ",[1862,2144,2145],{},"OZ0_JOIN_TOKEN",", or ",[1862,2148,2149],{},"OZ0_CA_HASH"," to wait for an operator's ",[1862,2152,2153],{},"node accept","), and runs the node. Keep the volume at ",[1862,2156,2157],{},"\u002Fvar\u002Flib\u002Forchestrator-zero-node",": the runtime's virtual environment refers to its Python by that path.",[2160,2161,2163,2167,2170,2301,2308,2312,2485,2516,2531,2535,2538,2675,2682,2738,2761,2765,2768,2861],"steps",{"level":2162},"2",[1872,2164,2166],{"id":2165},"make-the-master-key-and-the-secrets","Make the master key and the Secrets",[1855,2168,2169],{},"The master key unseals the cluster's CAs and secrets. Make it yourself, keep a copy outside the cluster, and give it to the chart as a Secret, with the database URL in another:",[1957,2171,2173],{"className":1959,"code":2172,"filename":1961,"language":1962,"meta":1963,"style":1963},"kubectl create namespace oz0\nhead -c 32 \u002Fdev\u002Furandom | base64 > master.key\nkubectl -n oz0 create secret generic oz0-master-key --from-file=master.key\nkubectl -n oz0 create secret generic oz0-db \\\n  --from-literal=url='postgres:\u002F\u002Foz0:\u003Cpassword>@db.internal:5432\u002Foz0?sslmode=require'\nkubectl -n oz0 create secret generic oz0-admin --from-literal=password='\u003Cat least 12 characters>'\n",[1862,2174,2175,2189,2215,2239,2259,2273],{"__ignoreMap":1963},[1967,2176,2177,2180,2183,2186],{"class":1969,"line":1970},[1967,2178,2179],{"class":1973},"kubectl",[1967,2181,2182],{"class":1977}," create",[1967,2184,2185],{"class":1977}," namespace",[1967,2187,2188],{"class":1977}," oz0\n",[1967,2190,2191,2194,2197,2200,2203,2206,2209,2212],{"class":1969,"line":1992},[1967,2192,2193],{"class":1973},"head",[1967,2195,2196],{"class":1977}," -c",[1967,2198,2199],{"class":1984}," 32",[1967,2201,2202],{"class":1977}," \u002Fdev\u002Furandom",[1967,2204,2205],{"class":2118}," |",[1967,2207,2208],{"class":1973}," base64",[1967,2210,2211],{"class":2118}," >",[1967,2213,2214],{"class":1977}," master.key\n",[1967,2216,2217,2219,2222,2225,2227,2230,2233,2236],{"class":1969,"line":2007},[1967,2218,2179],{"class":1973},[1967,2220,2221],{"class":1977}," -n",[1967,2223,2224],{"class":1977}," oz0",[1967,2226,2182],{"class":1977},[1967,2228,2229],{"class":1977}," secret",[1967,2231,2232],{"class":1977}," generic",[1967,2234,2235],{"class":1977}," oz0-master-key",[1967,2237,2238],{"class":1977}," --from-file=master.key\n",[1967,2240,2242,2244,2246,2248,2250,2252,2254,2257],{"class":1969,"line":2241},4,[1967,2243,2179],{"class":1973},[1967,2245,2221],{"class":1977},[1967,2247,2224],{"class":1977},[1967,2249,2182],{"class":1977},[1967,2251,2229],{"class":1977},[1967,2253,2232],{"class":1977},[1967,2255,2256],{"class":1977}," oz0-db",[1967,2258,2128],{"class":2127},[1967,2260,2262,2265,2267,2270],{"class":1969,"line":2261},5,[1967,2263,2264],{"class":1977},"  --from-literal=url=",[1967,2266,2119],{"class":2118},[1967,2268,2269],{"class":1977},"postgres:\u002F\u002Foz0:\u003Cpassword>@db.internal:5432\u002Foz0?sslmode=require",[1967,2271,2272],{"class":2118},"'\n",[1967,2274,2276,2278,2280,2282,2284,2286,2288,2291,2294,2296,2299],{"class":1969,"line":2275},6,[1967,2277,2179],{"class":1973},[1967,2279,2221],{"class":1977},[1967,2281,2224],{"class":1977},[1967,2283,2182],{"class":1977},[1967,2285,2229],{"class":1977},[1967,2287,2232],{"class":1977},[1967,2289,2290],{"class":1977}," oz0-admin",[1967,2292,2293],{"class":1977}," --from-literal=password=",[1967,2295,2119],{"class":2118},[1967,2297,2298],{"class":1977},"\u003Cat least 12 characters>",[1967,2300,2272],{"class":2118},[1855,2302,2303,2304,2307],{},"Store ",[1862,2305,2306],{},"master.key"," where you keep your other recovery secrets. Without it a restored database cannot be opened.",[1872,2309,2311],{"id":2310},"install-the-chart","Install the chart",[1957,2313,2318],{"className":2314,"code":2315,"filename":2316,"language":2317,"meta":1963,"style":1963},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","image:\n  server: {repository: registry.example.com\u002Foz0\u002Forchestrator-zero, tag: \"0.9.0\"}\n  node: {repository: registry.example.com\u002Foz0\u002Forchestrator-zero-node, tag: \"0.9.0\"}\ncluster: {name: prod-eu, historyShards: 1024}\ndatabase: {existingSecret: oz0-db}\nmasterKey: {existingSecret: oz0-master-key}\ninit:\n  adminPassword: {existingSecret: oz0-admin}\n","values.yaml","yaml",[1862,2319,2320,2329,2366,2396,2424,2442,2459,2467],{"__ignoreMap":1963},[1967,2321,2322,2326],{"class":1969,"line":1970},[1967,2323,2325],{"class":2324},"swJcz","image",[1967,2327,2328],{"class":2118},":\n",[1967,2330,2331,2334,2337,2340,2343,2345,2348,2351,2353,2355,2358,2360,2363],{"class":1969,"line":1992},[1967,2332,2333],{"class":2324},"  server",[1967,2335,2336],{"class":2118},":",[1967,2338,2339],{"class":2118}," {",[1967,2341,2342],{"class":2324},"repository",[1967,2344,2336],{"class":2118},[1967,2346,2347],{"class":1977}," registry.example.com\u002Foz0\u002Forchestrator-zero",[1967,2349,2350],{"class":2118},",",[1967,2352,1998],{"class":2324},[1967,2354,2336],{"class":2118},[1967,2356,2357],{"class":2118}," \"",[1967,2359,1985],{"class":1977},[1967,2361,2362],{"class":2118},"\"",[1967,2364,2365],{"class":2118},"}\n",[1967,2367,2368,2371,2373,2375,2377,2379,2382,2384,2386,2388,2390,2392,2394],{"class":1969,"line":2007},[1967,2369,2370],{"class":2324},"  node",[1967,2372,2336],{"class":2118},[1967,2374,2339],{"class":2118},[1967,2376,2342],{"class":2324},[1967,2378,2336],{"class":2118},[1967,2380,2381],{"class":1977}," registry.example.com\u002Foz0\u002Forchestrator-zero-node",[1967,2383,2350],{"class":2118},[1967,2385,1998],{"class":2324},[1967,2387,2336],{"class":2118},[1967,2389,2357],{"class":2118},[1967,2391,1985],{"class":1977},[1967,2393,2362],{"class":2118},[1967,2395,2365],{"class":2118},[1967,2397,2398,2400,2402,2404,2407,2409,2412,2414,2417,2419,2422],{"class":1969,"line":2241},[1967,2399,1869],{"class":2324},[1967,2401,2336],{"class":2118},[1967,2403,2339],{"class":2118},[1967,2405,2406],{"class":2324},"name",[1967,2408,2336],{"class":2118},[1967,2410,2411],{"class":1977}," prod-eu",[1967,2413,2350],{"class":2118},[1967,2415,2416],{"class":2324}," historyShards",[1967,2418,2336],{"class":2118},[1967,2420,2421],{"class":1984}," 1024",[1967,2423,2365],{"class":2118},[1967,2425,2426,2429,2431,2433,2436,2438,2440],{"class":1969,"line":2261},[1967,2427,2428],{"class":2324},"database",[1967,2430,2336],{"class":2118},[1967,2432,2339],{"class":2118},[1967,2434,2435],{"class":2324},"existingSecret",[1967,2437,2336],{"class":2118},[1967,2439,2256],{"class":1977},[1967,2441,2365],{"class":2118},[1967,2443,2444,2447,2449,2451,2453,2455,2457],{"class":1969,"line":2275},[1967,2445,2446],{"class":2324},"masterKey",[1967,2448,2336],{"class":2118},[1967,2450,2339],{"class":2118},[1967,2452,2435],{"class":2324},[1967,2454,2336],{"class":2118},[1967,2456,2235],{"class":1977},[1967,2458,2365],{"class":2118},[1967,2460,2462,2465],{"class":1969,"line":2461},7,[1967,2463,2464],{"class":2324},"init",[1967,2466,2328],{"class":2118},[1967,2468,2470,2473,2475,2477,2479,2481,2483],{"class":1969,"line":2469},8,[1967,2471,2472],{"class":2324},"  adminPassword",[1967,2474,2336],{"class":2118},[1967,2476,2339],{"class":2118},[1967,2478,2435],{"class":2324},[1967,2480,2336],{"class":2118},[1967,2482,2290],{"class":1977},[1967,2484,2365],{"class":2118},[1957,2486,2488],{"className":1959,"code":2487,"filename":1961,"language":1962,"meta":1963,"style":1963},"helm install oz0 .\u002Fdeploy\u002Fhelm\u002Forchestrator-zero -n oz0 -f values.yaml --wait\n",[1862,2489,2490],{"__ignoreMap":1963},[1967,2491,2492,2495,2498,2500,2503,2505,2507,2510,2513],{"class":1969,"line":1970},[1967,2493,2494],{"class":1973},"helm",[1967,2496,2497],{"class":1977}," install",[1967,2499,2224],{"class":1977},[1967,2501,2502],{"class":1977}," .\u002Fdeploy\u002Fhelm\u002Forchestrator-zero",[1967,2504,2221],{"class":1977},[1967,2506,2224],{"class":1977},[1967,2508,2509],{"class":1977}," -f",[1967,2511,2512],{"class":1977}," values.yaml",[1967,2514,2515],{"class":1977}," --wait\n",[1855,2517,2518,2519,2522,2523,2526,2527,2530],{},"Before the servers start, a hook Job runs ",[1862,2520,2521],{},"server init --master-key-file ... --exist-ok --temporal-backend \u003Ctemporal.backend>",". The first time it creates the cluster with your key, and, only with the embedded backend, Temporal's schemas; with ",[1862,2524,2525],{},"external"," or ",[1862,2528,2529],{},"cloud"," it leaves Temporal's databases alone. Later installs and every upgrade run it again: it only checks that the key unseals the cluster, so a wrong key stops the upgrade before any server restarts. The history shard count can never change after the first install.",[1872,2532,2534],{"id":2533},"get-operator-credentials","Get operator credentials",[1855,2536,2537],{},"The first operator's credentials are not kept by the init Job. Issue them in a server pod, which has the database and the master key, and copy them out:",[1957,2539,2541],{"className":1959,"code":2540,"filename":1961,"language":1962,"meta":1963,"style":1963},"kubectl -n oz0 exec oz0-orchestrator-zero-server-0 -- oz0 server operator issue admin \\\n  --master-key-file \u002Fetc\u002Forchestrator-zero\u002Fmaster-key\u002Fmaster.key --operator-dir \u002Ftmp\u002Foperator --advertise 127.0.0.1\nkubectl -n oz0 exec oz0-orchestrator-zero-server-0 -- tar -C \u002Ftmp -cf - operator | tar -xf -\nkubectl -n oz0 exec oz0-orchestrator-zero-server-0 -- rm -rf \u002Ftmp\u002Foperator\nexport OZ0_CONTEXT=$PWD\u002Foperator\u002Fcontext.json\n",[1862,2542,2543,2576,2596,2637,2660],{"__ignoreMap":1963},[1967,2544,2545,2547,2549,2551,2554,2557,2560,2562,2565,2568,2571,2574],{"class":1969,"line":1970},[1967,2546,2179],{"class":1973},[1967,2548,2221],{"class":1977},[1967,2550,2224],{"class":1977},[1967,2552,2553],{"class":1977}," exec",[1967,2555,2556],{"class":1977}," oz0-orchestrator-zero-server-0",[1967,2558,2559],{"class":1977}," --",[1967,2561,2224],{"class":1977},[1967,2563,2564],{"class":1977}," server",[1967,2566,2567],{"class":1977}," operator",[1967,2569,2570],{"class":1977}," issue",[1967,2572,2573],{"class":1977}," admin",[1967,2575,2128],{"class":2127},[1967,2577,2578,2581,2584,2587,2590,2593],{"class":1969,"line":1992},[1967,2579,2580],{"class":1977},"  --master-key-file",[1967,2582,2583],{"class":1977}," \u002Fetc\u002Forchestrator-zero\u002Fmaster-key\u002Fmaster.key",[1967,2585,2586],{"class":1977}," --operator-dir",[1967,2588,2589],{"class":1977}," \u002Ftmp\u002Foperator",[1967,2591,2592],{"class":1977}," --advertise",[1967,2594,2595],{"class":1984}," 127.0.0.1\n",[1967,2597,2598,2600,2602,2604,2606,2608,2610,2613,2616,2619,2622,2625,2627,2629,2631,2634],{"class":1969,"line":2007},[1967,2599,2179],{"class":1973},[1967,2601,2221],{"class":1977},[1967,2603,2224],{"class":1977},[1967,2605,2553],{"class":1977},[1967,2607,2556],{"class":1977},[1967,2609,2559],{"class":1977},[1967,2611,2612],{"class":1977}," tar",[1967,2614,2615],{"class":1977}," -C",[1967,2617,2618],{"class":1977}," \u002Ftmp",[1967,2620,2621],{"class":1977}," -cf",[1967,2623,2624],{"class":1977}," -",[1967,2626,2567],{"class":1977},[1967,2628,2205],{"class":2118},[1967,2630,2612],{"class":1973},[1967,2632,2633],{"class":1977}," -xf",[1967,2635,2636],{"class":1977}," -\n",[1967,2638,2639,2641,2643,2645,2647,2649,2651,2654,2657],{"class":1969,"line":2241},[1967,2640,2179],{"class":1973},[1967,2642,2221],{"class":1977},[1967,2644,2224],{"class":1977},[1967,2646,2553],{"class":1977},[1967,2648,2556],{"class":1977},[1967,2650,2559],{"class":1977},[1967,2652,2653],{"class":1977}," rm",[1967,2655,2656],{"class":1977}," -rf",[1967,2658,2659],{"class":1977}," \u002Ftmp\u002Foperator\n",[1967,2661,2662,2666,2669,2672],{"class":1969,"line":2261},[1967,2663,2665],{"class":2664},"spNyl","export",[1967,2667,2668],{"class":2127}," OZ0_CONTEXT",[1967,2670,2671],{"class":2118},"=",[1967,2673,2674],{"class":2127},"$PWD\u002Foperator\u002Fcontext.json\n",[1855,2676,2677,2678,2681],{},"The context points at ",[1862,2679,2680],{},"127.0.0.1",", for port-forwards:",[1957,2683,2685],{"className":1959,"code":2684,"filename":1961,"language":1962,"meta":1963,"style":1963},"kubectl -n oz0 port-forward svc\u002Foz0-orchestrator-zero-management 8443 &\nkubectl -n oz0 port-forward svc\u002Foz0-orchestrator-zero-edge 7233 7443 &\noz0 cluster info\n",[1862,2686,2687,2707,2728],{"__ignoreMap":1963},[1967,2688,2689,2691,2693,2695,2698,2701,2704],{"class":1969,"line":1970},[1967,2690,2179],{"class":1973},[1967,2692,2221],{"class":1977},[1967,2694,2224],{"class":1977},[1967,2696,2697],{"class":1977}," port-forward",[1967,2699,2700],{"class":1977}," svc\u002Foz0-orchestrator-zero-management",[1967,2702,2703],{"class":1984}," 8443",[1967,2705,2706],{"class":2118}," &\n",[1967,2708,2709,2711,2713,2715,2717,2720,2723,2726],{"class":1969,"line":1992},[1967,2710,2179],{"class":1973},[1967,2712,2221],{"class":1977},[1967,2714,2224],{"class":1977},[1967,2716,2697],{"class":1977},[1967,2718,2719],{"class":1977}," svc\u002Foz0-orchestrator-zero-edge",[1967,2721,2722],{"class":1984}," 7233",[1967,2724,2725],{"class":1984}," 7443",[1967,2727,2706],{"class":2118},[1967,2729,2730,2732,2735],{"class":1969,"line":2007},[1967,2731,1714],{"class":1973},[1967,2733,2734],{"class":1977}," cluster",[1967,2736,2737],{"class":1977}," info\n",[1855,2739,2740,2741,2744,2745,2748,2749,2752,2753,2756,2757,2760],{},"The console is at ",[1862,2742,2743],{},"https:\u002F\u002F127.0.0.1:8443"," with the user ",[1862,2746,2747],{},"admin"," and the password from the ",[1862,2750,2751],{},"init.adminPassword"," Secret. The chart requires that Secret while ",[1862,2754,2755],{},"init.enabled"," is on: a password the init Job made up would be printed to its log, which log collectors keep, and the Job is deleted once it succeeds. Change the password later with ",[1862,2758,2759],{},"oz0 user password admin",".",[1872,2762,2764],{"id":2763},"add-nodes","Add nodes",[1855,2766,2767],{},"Nodes in the cluster join with a token from a Secret, and each keeps its identity, uv, Python, runtimes and plugins in a volume of its own:",[1957,2769,2771],{"className":1959,"code":2770,"filename":1961,"language":1962,"meta":1963,"style":1963},"oz0 token create --max-uses 10 --ttl 720h --json   # the \"token\" field\nkubectl -n oz0 create secret generic oz0-join-token --from-literal=token='K10...'\nhelm upgrade oz0 .\u002Fdeploy\u002Fhelm\u002Forchestrator-zero -n oz0 -f values.yaml \\\n  --set nodes.enabled=true,nodes.replicas=3,nodes.joinToken.existingSecret=oz0-join-token\n",[1862,2772,2773,2800,2826,2847],{"__ignoreMap":1963},[1967,2774,2775,2777,2780,2782,2785,2788,2791,2794,2797],{"class":1969,"line":1970},[1967,2776,1714],{"class":1973},[1967,2778,2779],{"class":1977}," token",[1967,2781,2182],{"class":1977},[1967,2783,2784],{"class":1977}," --max-uses",[1967,2786,2787],{"class":1984}," 10",[1967,2789,2790],{"class":1977}," --ttl",[1967,2792,2793],{"class":1977}," 720h",[1967,2795,2796],{"class":1977}," --json",[1967,2798,2799],{"class":1988},"   # the \"token\" field\n",[1967,2801,2802,2804,2806,2808,2810,2812,2814,2817,2820,2822,2824],{"class":1969,"line":1992},[1967,2803,2179],{"class":1973},[1967,2805,2221],{"class":1977},[1967,2807,2224],{"class":1977},[1967,2809,2182],{"class":1977},[1967,2811,2229],{"class":1977},[1967,2813,2232],{"class":1977},[1967,2815,2816],{"class":1977}," oz0-join-token",[1967,2818,2819],{"class":1977}," --from-literal=token=",[1967,2821,2119],{"class":2118},[1967,2823,2122],{"class":1977},[1967,2825,2272],{"class":2118},[1967,2827,2828,2830,2833,2835,2837,2839,2841,2843,2845],{"class":1969,"line":2007},[1967,2829,2494],{"class":1973},[1967,2831,2832],{"class":1977}," upgrade",[1967,2834,2224],{"class":1977},[1967,2836,2502],{"class":1977},[1967,2838,2221],{"class":1977},[1967,2840,2224],{"class":1977},[1967,2842,2509],{"class":1977},[1967,2844,2512],{"class":1977},[1967,2846,2128],{"class":2127},[1967,2848,2849,2852,2855,2858],{"class":1969,"line":2241},[1967,2850,2851],{"class":1977},"  --set",[1967,2853,2854],{"class":1977}," nodes.enabled=",[1967,2856,2857],{"class":2118},"true",[1967,2859,2860],{"class":1977},",nodes.replicas=3,nodes.joinToken.existingSecret=oz0-join-token\n",[1855,2862,2863,2864,2867,2868,2871,2872,2875,2876,2879,2880,2882],{},"A token can be used as many times as ",[1862,2865,2866],{},"--max-uses"," says, until its TTL ends: give it enough for the replicas you will add. A replica that lost its volume joins again as a new node. Nodes outside the cluster join through the edge Service: make it a ",[1862,2869,2870],{},"LoadBalancer"," (",[1862,2873,2874],{},"service.edge.type",") and add its name with ",[1862,2877,2878],{},"server.sans",". They need only ports 7233 and 7443 (",[1867,2881,1248],{"href":1249},").",[1855,2884,2885,2886,2889,2890,2893,2894,2897,2898,2901],{},"A node you purge (",[1862,2887,2888],{},"oz0 node purge",") empties its volume, but a volume's mount point cannot be removed, so it leaves a marker there, ",[1862,2891,2892],{},".oz0-purged",". When the StatefulSet restarts the pod, its entrypoint sees the marker, logs that the node was purged and waits, instead of joining again with the token from the Secret. Scale ",[1862,2895,2896],{},"nodes.replicas"," down to drop the replica. To have it join as a new node instead, delete the marker (",[1862,2899,2900],{},"kubectl -n oz0 exec \u003Cpod> -- rm \u002Fvar\u002Flib\u002Forchestrator-zero-node\u002F.oz0-purged","), or delete its PersistentVolumeClaim and then its pod.",[2903,2904,2906],"h3",{"id":2905},"node-pods-drain-before-they-stop","Node pods drain before they stop",[1855,2908,2909],{},"A node pod that is deleted, evicted or rolled drains first, so the work it runs is not lost:",[2911,2912,2913,2928],"ol",{},[1921,2914,2915,2916,2919,2920,2923,2924,2927],{},"Its preStop hook runs ",[1862,2917,2918],{},"orchestrator-zero-node drain --wait",", in the data directory the image uses (",[1862,2921,2922],{},"OZ0_NODE_DATA_DIR",", which ",[1862,2925,2926],{},"nodes.extraEnv"," may set): the node takes no new job and starts no new session, and the hook returns once no session or call is in flight there, or when the node's stop grace is ending.",[1921,2929,2930],{},"Kubernetes then sends SIGTERM, and the node stops its runtimes and plugins.",[1855,2932,2933,2936,2937,2940,2941,1933,2944,2948],{},[1862,2934,2935],{},"nodes.stopGraceSeconds"," (600 by default, at most 3600) is the node's stop grace, and the pod's ",[1862,2938,2939],{},"terminationGracePeriodSeconds"," is that and a minute more, which covers the hook and the stop. A session longer than the grace is lost when the grace ends. Before maintenance you plan, drain the node with a deadline first (",[1862,2942,2943],{},"oz0 node drain NODE --deadline 2h",[1867,2945,2947],{"href":2946},"\u002Ffleet\u002Fmanage-nodes#patch-a-node","Patch a node",") and wait for \"safe to stop\" before you drain the Kubernetes node it runs on.",[1855,2950,2951,2952,2955,2956,2959,2960,1937,2963,2966,2967,2969],{},"The chart sets no PodDisruptionBudget for nodes. ",[1862,2953,2954],{},"kubectl drain"," evicts every node pod on a Kubernetes node at once, and each drains within its grace while the others take the new work. To keep some nodes taking work while Kubernetes nodes drain one after another, add a PodDisruptionBudget of your own for the node pods, such as ",[1862,2957,2958],{},"maxUnavailable: 1"," that selects the release's node pods by their labels ",[1862,2961,2962],{},"app.kubernetes.io\u002Finstance: \u003Crelease>",[1862,2964,2965],{},"app.kubernetes.io\u002Fcomponent: node","; an eviction it blocks waits, and ",[1862,2968,2954],{}," tries again. A budget never makes a pod's own drain longer than its grace.",[2903,2971,2973],{"id":2972},"sandbox-tier-1-in-node-pods","Sandbox tier 1 in node pods",[1855,2975,2976,2977,2980,2981,2984],{},"The node image carries bubblewrap, but a pod with Kubernetes' defaults cannot use it: the container runtime's default seccomp profile refuses the namespaces bubblewrap creates, and ",[1862,2978,2979],{},"\u002Fproc"," is masked, so bubblewrap cannot turn nested user namespaces off inside its sandbox. Such a node runs harness sessions in sandbox tier 0, and ",[1862,2982,2983],{},"oz0 node show"," says so. Since shell and write sessions run only on tier-1 nodes, a default node pod does not take them.",[1855,2986,2987,2990],{},[1862,2988,2989],{},"nodes.sandboxTier1.enabled"," gives the node pods what bubblewrap needs, and nothing more:",[1877,2992,2993,3003],{},[1880,2994,2995],{},[1883,2996,2997,3000],{},[1886,2998,2999],{},"Setting",[1886,3001,3002],{},"Why",[1893,3004,3005,3018,3032,3053],{},[1883,3006,3007,3012],{},[1898,3008,3009],{},[1862,3010,3011],{},"hostUsers: false",[1898,3013,3014,3015,3017],{},"A user namespace of the pod's own: root in the pod is no user on the host, and Kubernetes allows an unmasked ",[1862,3016,2979],{}," only then.",[1883,3019,3020,3025],{},[1898,3021,3022],{},[1862,3023,3024],{},"procMount: Unmasked",[1898,3026,3027,3028,3031],{},"bubblewrap writes ",[1862,3029,3030],{},"\u002Fproc\u002Fsys\u002Fuser\u002Fmax_user_namespaces"," in its sandbox, so a session cannot create user namespaces of its own.",[1883,3033,3034,3039],{},[1898,3035,3036],{},[1862,3037,3038],{},"seccompProfile",[1898,3040,3041,3044,3045,3048,3049,3052],{},[1862,3042,3043],{},"Localhost"," with the chart's ",[1862,3046,3047],{},"files\u002Fseccomp-node-tier1.json"," (the default), or ",[1862,3050,3051],{},"Unconfined",". The runtime's default profile leaves the node at tier 0, so the chart refuses it.",[1883,3054,3055,3058],{},[1898,3056,3057],{},"AppArmor",[1898,3059,3060,3061,3064,3065,3067,3068,3071,3072,2526,3074,3077],{},"Left at the runtime's default unless ",[1862,3062,3063],{},"nodes.sandboxTier1.appArmorProfile"," sets ",[1862,3066,3043],{}," (the chart's ",[1862,3069,3070],{},"files\u002Fapparmor-node-tier1","), ",[1862,3073,3051],{},[1862,3075,3076],{},"RuntimeDefault",". On hosts that run AppArmor, the default is expected to stop bubblewrap (see the AppArmor settings below).",[1855,3079,3080],{},"The pod stays unprivileged: no capability is added, privilege escalation stays off and the root file system read-only. bubblewrap sets no-new-privileges and its own seccomp filter on every session, and Debian's bubblewrap is not setuid.",[1855,3082,3083],{},"Before you turn it on, complete these checks.",[3085,3086,3088],"h4",{"id":3087},"check-user-namespace-support","Check user namespace support",[1855,3090,3091,3092,2882],{},"Kubernetes user namespaces are required. They are on by default from Kubernetes 1.33 and need containerd 2.0 or CRI-O 1.25 or later, runc 1.2 or crun 1.9 or later, and Linux 6.3 or later on the hosts, with the pods' volumes on file systems that support idmapped mounts (ext4, xfs, btrfs, tmpfs, overlayfs) (",[1867,3093,3097],{"href":3094,"rel":3095},"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fworkloads\u002Fpods\u002Fuser-namespaces\u002F",[3096],"nofollow","User namespaces",[3085,3099,3101],{"id":3100},"install-the-seccomp-profile-on-every-node-host","Install the seccomp profile on every node host",[1855,3103,3104,3105,3108,3109,3112,3113,3116],{},"Copy ",[1862,3106,3107],{},"deploy\u002Fhelm\u002Forchestrator-zero\u002Ffiles\u002Fseccomp-node-tier1.json"," to ",[1862,3110,3111],{},"\u002Fvar\u002Flib\u002Fkubelet\u002Fseccomp\u002Foz0\u002Fnode-tier1.json"," (or set ",[1862,3114,3115],{},"nodes.sandboxTier1.seccompProfile.localhostProfile"," to where you put it). A pod whose profile is missing does not start.",[1855,3118,3119,3120,1933,3123,3126,3127,1933,3130,3133],{},"The profile refuses the kernel interfaces the runtime's default keeps from an unprivileged container (kernel modules, the keyrings, ",[1862,3121,3122],{},"bpf",[1862,3124,3125],{},"ptrace"," and the other calls that read another process's memory or take its file descriptors, ",[1862,3128,3129],{},"io_uring",[1862,3131,3132],{},"kexec",", the new mount API and more), apart from creating namespaces and the mount calls bubblewrap makes. It is a list of refusals, not the runtime's list of allowed calls, so it is looser than the default around the node process itself; the sessions in the sandbox still get bubblewrap's own filter.",[3085,3135,3137],{"id":3136},"set-the-namespaces-pod-security-level","Set the namespace's Pod Security level",[1855,3139,3140,3141,3143,3144,3146,3147,3149,3150,3152],{},"With the ",[1862,3142,3043],{}," seccomp profile, a tier-1 pod met the namespace's baseline level on Kubernetes 1.37 (on a host without AppArmor), which allows an unmasked ",[1862,3145,2979],{}," for pods with their own user namespace; the restricted level refuses it. A ",[1862,3148,3043],{}," AppArmor profile is also within baseline. ",[1862,3151,3051],{}," seccomp or AppArmor needs the privileged level.",[3085,3154,3156],{"id":3155},"configure-apparmor-on-the-hosts","Configure AppArmor on the hosts",[1855,3158,3159,3160,3163,3164,3167,3168,3170,3171,3173],{},"Where the hosts run AppArmor (Ubuntu, Debian, Container-Optimized OS, and the managed clusters whose nodes run them), expect the runtime's default AppArmor profile to stop bubblewrap: containerd's and CRI-O's default profiles deny every mount and writes under ",[1862,3161,3162],{},"\u002Fproc\u002Fsys"," outside ",[1862,3165,3166],{},"\u002Fproc\u002Fsys\u002Fkernel",", and bubblewrap needs both, to mount the sandbox's ",[1862,3169,2979],{}," and to write ",[1862,3172,3030],{},". Such a pod reports tier 0. There are two ways around it:",[1918,3175,3176,3205],{},[1921,3177,3178,3179,3182,3183,3186,3187,3190,3191,1937,3194,3197,3198,3201,3202,2760],{},"The chart's AppArmor profile (within baseline). ",[1862,3180,3181],{},"deploy\u002Fhelm\u002Forchestrator-zero\u002Ffiles\u002Fapparmor-node-tier1"," is the runtime's default with those two denials lifted, plus the user-namespace, umount and pivot_root rules bubblewrap needs. Load it on every host that may run a node pod (",[1862,3184,3185],{},"sudo install -D -m 0644 apparmor-node-tier1 \u002Fetc\u002Fapparmor.d\u002Foz0-node-tier1",", then ",[1862,3188,3189],{},"sudo apparmor_parser -r -W \u002Fetc\u002Fapparmor.d\u002Foz0-node-tier1","; it needs AppArmor 4, as on Ubuntu 24.04 and Debian 13), and set ",[1862,3192,3193],{},"nodes.sandboxTier1.appArmorProfile.type=Localhost",[1862,3195,3196],{},"localhostProfile=oz0-node-tier1",". A pod whose profile is not loaded on its host does not start. Its ",[1862,3199,3200],{},"userns"," rule also lets bubblewrap create user namespaces where Ubuntu's ",[1862,3203,3204],{},"kernel.apparmor_restrict_unprivileged_userns=1",[1921,3206,3207,3210,3211,3213,3214,3217],{},[1862,3208,3209],{},"appArmorProfile.type=Unconfined",", which needs the privileged Pod Security level. Then, on Ubuntu, ",[1862,3212,3204],{}," still stops unprivileged user namespaces: set it to ",[1862,3215,3216],{},"0"," on those hosts.",[1855,3219,3220,3221,3224,3225,3228],{},"Neither has been run on a host with AppArmor yet; the profile has only been parsed by ",[1862,3222,3223],{},"apparmor_parser",". The AppArmor setting is written as the pod annotation, which Kubernetes 1.29 reads and later versions copy into the ",[1862,3226,3227],{},"appArmorProfile"," field (with a deprecation warning).",[1957,3230,3232],{"className":1959,"code":3231,"filename":1961,"language":1962,"meta":1963,"style":1963},"helm upgrade oz0 .\u002Fdeploy\u002Fhelm\u002Forchestrator-zero -n oz0 -f values.yaml --set nodes.sandboxTier1.enabled=true\nkubectl -n oz0 exec oz0-orchestrator-zero-node-0 -- orchestrator-zero-node sandbox check   # Sandbox: tier 1 (bubblewrap 0.12.0)\noz0 node show NODE                                                                          # Sandbox  tier 1 (bubblewrap 0.12.0)\n",[1862,3233,3234,3261,3288],{"__ignoreMap":1963},[1967,3235,3236,3238,3240,3242,3244,3246,3248,3250,3252,3255,3258],{"class":1969,"line":1970},[1967,3237,2494],{"class":1973},[1967,3239,2832],{"class":1977},[1967,3241,2224],{"class":1977},[1967,3243,2502],{"class":1977},[1967,3245,2221],{"class":1977},[1967,3247,2224],{"class":1977},[1967,3249,2509],{"class":1977},[1967,3251,2512],{"class":1977},[1967,3253,3254],{"class":1977}," --set",[1967,3256,3257],{"class":1977}," nodes.sandboxTier1.enabled=",[1967,3259,3260],{"class":2118},"true\n",[1967,3262,3263,3265,3267,3269,3271,3274,3276,3279,3282,3285],{"class":1969,"line":1992},[1967,3264,2179],{"class":1973},[1967,3266,2221],{"class":1977},[1967,3268,2224],{"class":1977},[1967,3270,2553],{"class":1977},[1967,3272,3273],{"class":1977}," oz0-orchestrator-zero-node-0",[1967,3275,2559],{"class":1977},[1967,3277,3278],{"class":1977}," orchestrator-zero-node",[1967,3280,3281],{"class":1977}," sandbox",[1967,3283,3284],{"class":1977}," check",[1967,3286,3287],{"class":1988},"   # Sandbox: tier 1 (bubblewrap 0.12.0)\n",[1967,3289,3290,3292,3295,3298,3301],{"class":1969,"line":2007},[1967,3291,1714],{"class":1973},[1967,3293,3294],{"class":1977}," node",[1967,3296,3297],{"class":1977}," show",[1967,3299,3300],{"class":1977}," NODE",[1967,3302,3303],{"class":1988},"                                                                          # Sandbox  tier 1 (bubblewrap 0.12.0)\n",[1855,3305,3306,3307,3310,3311,3314,3315,3318,3319,3321],{},"A pod has no cgroup delegated to it, so sessions in its sandbox run without their memory, process and CPU limits, and ",[1862,3308,3309],{},"sandbox check"," says so on its ",[1862,3312,3313],{},"Limits:"," line; the pod's own ",[1862,3316,3317],{},"resources"," still bound the whole node. Where the pod cannot run bubblewrap, the node reports tier 0 with the reason, and tier-1 work goes to other nodes: run nodes outside the cluster (",[1867,3320,1248],{"href":1249},") for it.",[1855,3323,3324,3327,3328,2882],{},[1862,3325,3326],{},"nodes.runtimeClassName"," runs the node pods under a RuntimeClass of yours, such as one for gVisor or Kata Containers. The chart promises no tier from it: the node reports what its bubblewrap probe finds inside, and node pods under gVisor have not been tested. gVisor does not stand in for tier 1 either: the gVisor sandbox for harness sessions is built on bubblewrap's tier 1, and gVisor for tools needs a container engine, which a node pod does not have (",[1867,3329,3330],{"href":1280},"Sandbox tier 2",[1872,3332,3334],{"id":3333},"previous-section-links","Previous section links",[1855,3336,3337,3341,3342,2760],{},[1967,3338,3340],{"id":3339},"what-the-chart-runs","What the chart runs",": ",[1867,3343,3345],{"href":3344},"\u002Ffleet\u002Fkubernetes\u002Fvalues#what-the-chart-runs","open guide",[1855,3347,3348,3341,3352,2760],{},[1967,3349,3351],{"id":3350},"values","Values",[1867,3353,3345],{"href":3354},"\u002Ffleet\u002Fkubernetes\u002Fvalues#values",[1855,3356,3357,3341,3361,2760],{},[1967,3358,3360],{"id":3359},"backups","Backups",[1867,3362,3345],{"href":3363},"\u002Ffleet\u002Fkubernetes\u002Fmaintenance#backups",[1855,3365,3366,3341,3370,2760],{},[1967,3367,3369],{"id":3368},"upgrades","Upgrades",[1867,3371,3345],{"href":3372},"\u002Ffleet\u002Fkubernetes\u002Fmaintenance#upgrades",[1855,3374,3375,3341,3379,2760],{},[1967,3376,3378],{"id":3377},"limits","Limits",[1867,3380,3345],{"href":3381},"\u002Ffleet\u002Fkubernetes\u002Fmaintenance#limits",[3383,3384,3385],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}",{"title":1963,"searchDepth":1992,"depth":1992,"links":3387},[3388,3389,3390,3391,3392,3393,3394,3398],{"id":1874,"depth":1992,"text":1875},{"id":1915,"depth":1992,"text":1916},{"id":1954,"depth":1992,"text":1955},{"id":2165,"depth":1992,"text":2166},{"id":2310,"depth":1992,"text":2311},{"id":2533,"depth":1992,"text":2534},{"id":2763,"depth":1992,"text":2764,"children":3395},[3396,3397],{"id":2905,"depth":2007,"text":2906},{"id":2972,"depth":2007,"text":2973},{"id":3333,"depth":1992,"text":3334},"Prepare the chart and node isolation, then install the cluster.","md",null,{"audience":3403,"doc_type":3404},"cluster operators","how-to",{"icon":480},{"title":1468,"description":3399},"vQwC6Pt_hQdtkT9nhGHcIDB9K8sPG3zGsnLsqxtIL9U",[3409,3411],{"title":1463,"path":1464,"stem":1465,"description":3410,"icon":1466,"children":-1},"One command to try it: a server, a node, the console and a sample plugin in one container. And a compose file for a small team: PostgreSQL, a server and a node.",{"title":1474,"path":1475,"stem":1476,"description":3412,"icon":480,"children":-1},"Look up the chart objects and supported values.",1794442935306]