[{"data":1,"prerenderedAt":3283},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Ffleet\u002Freleases":1849,"docs-surround:\u002Ffleet\u002Freleases":3278},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":1459,"body":1851,"description":3269,"extension":3270,"links":3271,"meta":3272,"navigation":3275,"path":1460,"seo":3276,"stem":1461,"__hash__":3277},"docs\u002F07.fleet\u002F24.releases.md",{"type":1852,"value":1853,"toc":3252},"minimark",[1854,1858,1861,1870,1875,1878,2055,2062,2066,2076,2146,2157,2176,2215,2236,2239,2244,2262,2265,2272,2276,2279,2347,2372,2391,2435,2442,2494,2542,2555,2582,2593,2597,2600,2683,2690,2724,2745,2765,2769,2776,2787,2790,2800,2805,2808,2818,2822,2843,2847,2865,2957,2969,2973,2992,2996,2999,3096,3104,3125,3132,3147,3151,3189,3206,3210,3213,3220,3234,3240,3248],[1855,1856,1857],"p",{},"For: cluster operators.",[1855,1859,1860],{},"Choose the channel and platform artifact you need, then verify it before installation. Use the upgrade guide when replacing an existing deployment.",[1862,1863,1864,1865,1869],"note",{},"There is no public release yet. Everything on this page works with a release candidate you build yourself with ",[1866,1867,1868],"code",{},"make release-candidate",", signed with your own key, on the build machine or offline.",[1871,1872,1874],"h2",{"id":1873},"what-a-release-holds","What a release holds",[1855,1876,1877],{},"A release is a flat list of files, as a GitHub release holds them:",[1879,1880,1881,1894],"table",{},[1882,1883,1884],"thead",{},[1885,1886,1887,1891],"tr",{},[1888,1889,1890],"th",{},"File",[1888,1892,1893],{},"What it is",[1895,1896,1897,1925,1935,1949,1959,1973,1990,2000,2010,2024,2034,2045],"tbody",{},[1885,1898,1899,1910],{},[1900,1901,1902,1905,1906,1909],"td",{},[1866,1903,1904],{},"orchestrator-zero_\u003Cv>_\u003Cos>_\u003Carch>.tar.gz"," (",[1866,1907,1908],{},".zip"," on Windows)",[1900,1911,1912,1913,1916,1917,1920,1921,1924],{},"The server: ",[1866,1914,1915],{},"bin\u002Forchestrator-zero",", ",[1866,1918,1919],{},"LICENSE"," and ",[1866,1922,1923],{},"README.md",", for Linux and macOS on amd64 and arm64 and Windows on amd64 and arm64",[1885,1926,1927,1932],{},[1900,1928,1929],{},[1866,1930,1931],{},"orchestrator-zero-node_\u003Cv>_\u003Cos>_\u003Carch>",[1900,1933,1934],{},"The node binary, for Linux and macOS on amd64 and arm64 and Windows on amd64",[1885,1936,1937,1942],{},[1900,1938,1939],{},[1866,1940,1941],{},"orchestrator-zero-dist_\u003Cv>.tar.gz",[1900,1943,1944,1945,1948],{},"The folder the edge serves to new nodes: the node binaries, the runtime and their signed manifest. It goes next to the server's ",[1866,1946,1947],{},"bin\u002F"," folder",[1885,1950,1951,1956],{},[1900,1952,1953],{},[1866,1954,1955],{},"orchestrator-zero-runtime_\u003Cv>.tar.gz",[1900,1957,1958],{},"The Python runtime nodes install",[1885,1960,1961,1966],{},[1900,1962,1963],{},[1866,1964,1965],{},"orchestrator-zero-toolchain_\u003Cv>_\u003Cos>_\u003Carch>.tar.gz",[1900,1967,1968,1969,1972],{},"Optional, one per node platform, about 150 MB each: what nodes there install before their runtime (uv, Python, the runtime's packages, Node.js), so that they reach only the edge (",[1970,1971,167],"a",{"href":168},")",[1885,1974,1975,1983],{},[1900,1976,1977,1916,1980],{},[1866,1978,1979],{},"orchestrator-zero_\u003Cv>_image_linux_\u003Carch>.tar.gz",[1866,1981,1982],{},"orchestrator-zero-node_…",[1900,1984,1985,1986,1989],{},"The server and node container images; ",[1866,1987,1988],{},"docker load -i"," them",[1885,1991,1992,1997],{},[1900,1993,1994],{},[1866,1995,1996],{},"install.sh",[1900,1998,1999],{},"Installs the server or a node from the release",[1885,2001,2002,2007],{},[1900,2003,2004],{},[1866,2005,2006],{},"*.cdx.json",[1900,2008,2009],{},"A CycloneDX SBOM for each server archive, node binary, runtime, toolchain archive and image",[1885,2011,2012,2017],{},[1900,2013,2014],{},[1866,2015,2016],{},"release.json",[1900,2018,2019,2020],{},"What each file is, the version, the commit and the ",[1970,2021,2023],{"href":2022},"\u002Ffleet\u002Freleases#release-channels","release channel",[1885,2025,2026,2031],{},[1900,2027,2028],{},[1866,2029,2030],{},"provenance.intoto.jsonl",[1900,2032,2033],{},"SLSA v1 provenance for every file: what was built, from which commit and channel, with which tools",[1885,2035,2036,2042],{},[1900,2037,2038,2041],{},[1866,2039,2040],{},"SHA256SUMS"," and its signatures",[1900,2043,2044],{},"Every file's SHA-256, signed with the release key",[1885,2046,2047,2052],{},[1900,2048,2049],{},[1866,2050,2051],{},"release-sign_\u003Cv>_linux_\u003Carch>",[1900,2053,2054],{},"In a release signed offline: the signing tool itself, for linux\u002Famd64 and linux\u002Farm64, with its SHA-256 in the release notes",[1855,2056,2057,2058,2061],{},"The binaries trust the release key: an edge serves a dist folder's release only once its signature verifies, and a node checks the key's signature again before it installs a new binary or runtime from its edge (",[1970,2059,2060],{"href":1401},"upgrades",").",[1871,2063,2065],{"id":2064},"release-channels","Release channels",[1855,2067,2068,2069,2072,2073,2075],{},"Every release is on one channel, which its signed ",[1866,2070,2071],{},"manifest.json"," (in the dist archive) and ",[1866,2074,2016],{}," both name, so an edge cannot change it without breaking the signature:",[1879,2077,2078,2091],{},[1882,2079,2080],{},[1885,2081,2082,2085,2088],{},[1888,2083,2084],{},"Channel",[1888,2086,2087],{},"What it carries",[1888,2089,2090],{},"A cluster on it takes",[1895,2092,2093,2109,2125],{},[1885,2094,2095,2100,2106],{},[1900,2096,2097],{},[1866,2098,2099],{},"stable",[1900,2101,2102,2103],{},"Releases: ",[1866,2104,2105],{},"v1.2.0",[1900,2107,2108],{},"Stable releases",[1885,2110,2111,2116,2122],{},[1900,2112,2113],{},[1866,2114,2115],{},"preview",[1900,2117,2118,2119],{},"Release candidates: ",[1866,2120,2121],{},"v1.3.0-rc.1",[1900,2123,2124],{},"Release candidates and stable releases, so it never falls behind stable",[1885,2126,2127,2136,2143],{},[1900,2128,2129,2132,2133],{},[1866,2130,2131],{},"lts-\u003Cmajor>.\u003Cminor>",", such as ",[1866,2134,2135],{},"lts-1.0",[1900,2137,2138,2139,2142],{},"One long-term support line: ",[1866,2140,2141],{},"v1.0.Z",", built from the line's branch with backported fixes; never a release candidate",[1900,2144,2145],{},"Only that line's releases",[1855,2147,2148,2149,2152,2153,2156],{},"A cluster follows one channel. ",[1866,2150,2151],{},"oz0 server init"," (and a dev server's first start) picks the channel of the release in the server's own dist folder, so a server installed from an LTS release starts on its line, and stable when there is none; ",[1866,2154,2155],{},"--release-channel"," sets another. From then on:",[2158,2159,2160,2167,2173],"ul",{},[2161,2162,2163,2166],"li",{},[1866,2164,2165],{},"oz0 server dist pull"," mirrors only a release of the cluster's channel, and never an older node version over a newer one on the same channel;",[2161,2168,2169,2172],{},[1866,2170,2171],{},"oz0 node upgrade --binary"," tells nodes only about a release of that channel, and refuses to send a node back to an older version;",[2161,2174,2175],{},"each node checks the same itself, against the signed manifest, before it replaces its binary.",[1855,2177,2178,2179,2185,2186,2189,2190,2193,2194,2197,2198,2201,2202,2205,2206,2209,2210,2214],{},"Versions are ordered as ",[1970,2180,2184],{"href":2181,"rel":2182},"https:\u002F\u002Fsemver.org\u002Fspec\u002Fv2.0.0.html",[2183],"nofollow","Semantic Versioning"," says: ",[1866,2187,2188],{},"v1.0.0-rc.2"," comes before ",[1866,2191,2192],{},"v1.0.0",", which comes before ",[1866,2195,2196],{},"v1.0.1",". A build of a commit that is not a release (",[1866,2199,2200],{},"make dist"," from a working tree: a commit hash, or ",[1866,2203,2204],{},"git describe"," output such as ",[1866,2207,2208],{},"v1.0.0-5-gabcdef1",") has no place in that order: a node that runs a release does not move to one unless you allow it, and a node that runs such a build may move to anything. Going back, or to another channel, is always an explicit act with a reason: see ",[1970,2211,2213],{"href":2212},"\u002Ffleet\u002Fupgrades\u002Frelease-verification#switch-release-channels","Switch channels",".",[1855,2216,2217,2220,2221,1916,2224,2227,2228,2231,2232,2235],{},[1866,2218,2219],{},"oz0 server dist status"," shows the release a dist folder serves, its channel and whether its signature verifies; with the database (",[1866,2222,2223],{},"OZ0_DB",[1866,2225,2226],{},"--db-file"," or ",[1866,2229,2230],{},"--dev",") also the channel the cluster follows. ",[1866,2233,2234],{},"oz0 doctor"," warns when the two disagree.",[1855,2237,2238],{},"A build's flavour, such as a FIPS build, is a property beside the channel: no channel makes a cluster take a build of another flavour.",[2240,2241,2243],"h3",{"id":2242},"lts-lines","LTS lines",[1855,2245,2246,2247,2250,2251,2254,2255,2258,2259,2214],{},"An LTS line starts from a release tag: its branch ",[1866,2248,2249],{},"lts\u002F\u003Cmajor>.\u003Cminor>"," is cut from ",[1866,2252,2253],{},"v\u003Cmajor>.\u003Cminor>.0",", and its releases are ",[1866,2256,2257],{},"v\u003Cmajor>.\u003Cminor>.Z"," built with ",[1866,2260,2261],{},"make release-candidate CHANNEL=lts-\u003Cmajor>.\u003Cminor>",[1855,2263,2264],{},"Fixes go back to the line as cherry-picks that name the commit they came from, never with a database migration (a fix that needs one reaches the line's clusters with the next minor release); security fixes reach the main branch and every supported release branch no later than any LTS line. The backported commits are part of the core source. How long each line is supported is published with its first release.",[1855,2266,2267,2268,2271],{},"With repository access, you can build a line from its branch and sign it with your own key; the binaries then trust that key, as with any build (",[1970,2269,2060],{"href":2270},"\u002Ffleet\u002Fupgrades\u002Frelease-verification#releases-and-their-signatures","). Public source downloads are coming soon.",[1871,2273,2275],{"id":2274},"install-from-a-release","Install from a release",[1855,2277,2278],{},"On Linux or macOS, the server:",[2280,2281,2286],"pre",{"className":2282,"code":2283,"language":2284,"meta":2285,"style":2285},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -fsSL \u003Crelease-url>\u002Finstall.sh | sh -s - server\noz0 server start --dev\n","bash","",[1866,2287,2288,2333],{"__ignoreMap":2285},[2289,2290,2293,2297,2301,2305,2308,2312,2315,2318,2321,2324,2327,2330],"span",{"class":2291,"line":2292},"line",1,[2289,2294,2296],{"class":2295},"sBMFI","curl",[2289,2298,2300],{"class":2299},"sfazB"," -fsSL",[2289,2302,2304],{"class":2303},"sMK4o"," \u003C",[2289,2306,2307],{"class":2299},"release-ur",[2289,2309,2311],{"class":2310},"sTEyZ","l",[2289,2313,2314],{"class":2303},">",[2289,2316,2317],{"class":2299},"\u002Finstall.sh",[2289,2319,2320],{"class":2303}," |",[2289,2322,2323],{"class":2295}," sh",[2289,2325,2326],{"class":2299}," -s",[2289,2328,2329],{"class":2299}," -",[2289,2331,2332],{"class":2299}," server\n",[2289,2334,2336,2338,2341,2344],{"class":2291,"line":2335},2,[2289,2337,1714],{"class":2295},[2289,2339,2340],{"class":2299}," server",[2289,2342,2343],{"class":2299}," start",[2289,2345,2346],{"class":2299}," --dev\n",[1855,2348,2349,2350,2353,2354,2357,2358,1920,2361,2364,2365,1920,2368,2371],{},"As root it goes to ",[1866,2351,2352],{},"\u002Fopt\u002Forchestrator-zero\u002F\u003Cversion>"," with a link in ",[1866,2355,2356],{},"\u002Fusr\u002Flocal\u002Fbin","; otherwise to ",[1866,2359,2360],{},"~\u002F.local\u002Fshare\u002Forchestrator-zero",[1866,2362,2363],{},"~\u002F.local\u002Fbin",". ",[1866,2366,2367],{},"--prefix",[1866,2369,2370],{},"--bin-dir"," change both. The dist folder comes with it, so the edge can serve nodes at once.",[1855,2373,2374,2375,2378,2379,2382,2383,2386,2387,2390],{},"For nodes that should reach nothing but the edge, unpack the toolchain archive of each of your nodes' platforms into the same folder: it adds ",[1866,2376,2377],{},"dist\u002Ftoolchain\u002F"," with that platform's files and manifest (",[1866,2380,2381],{},"dist\u002Ftoolchain\u002Fplatforms\u002F\u003Cos>-\u003Carch>.json","), the edge serves every platform it finds there, and nodes run with ",[1866,2384,2385],{},"oz0-node run --offline"," (or ",[1866,2388,2389],{},"OZ0_NODE_OFFLINE=1",") never fall back to the internet:",[2280,2392,2394],{"className":2282,"code":2393,"language":2284,"meta":2285,"style":2285},"tar -xzf orchestrator-zero-toolchain_\u003Cv>_linux_amd64.tar.gz -C \u002Fopt\u002Forchestrator-zero\u002F\u003Cversion>\n",[1866,2395,2396],{"__ignoreMap":2285},[2289,2397,2398,2401,2404,2407,2410,2413,2415,2418,2421,2424,2426,2429,2432],{"class":2291,"line":2292},[2289,2399,2400],{"class":2295},"tar",[2289,2402,2403],{"class":2299}," -xzf",[2289,2405,2406],{"class":2299}," orchestrator-zero-toolchain_",[2289,2408,2409],{"class":2303},"\u003C",[2289,2411,2412],{"class":2310},"v",[2289,2414,2314],{"class":2303},[2289,2416,2417],{"class":2299},"_linux_amd64.tar.gz",[2289,2419,2420],{"class":2299}," -C",[2289,2422,2423],{"class":2299}," \u002Fopt\u002Forchestrator-zero\u002F",[2289,2425,2409],{"class":2303},[2289,2427,2428],{"class":2299},"versio",[2289,2430,2431],{"class":2310},"n",[2289,2433,2434],{"class":2303},">\n",[1855,2436,2437,2438,2441],{},"A node, joined to a cluster and run ",[1970,2439,2440],{"href":1262},"as a service",":",[2280,2443,2445],{"className":2282,"code":2444,"language":2284,"meta":2285,"style":2285},"curl -fsSL \u003Crelease-url>\u002Finstall.sh | OZ0_JOIN_TOKEN='K10…' sh -s - node --server https:\u002F\u002Foz0-edge:7443\n",[1866,2446,2447],{"__ignoreMap":2285},[2289,2448,2449,2451,2453,2455,2457,2459,2461,2463,2465,2468,2471,2474,2477,2479,2481,2483,2485,2488,2491],{"class":2291,"line":2292},[2289,2450,2296],{"class":2295},[2289,2452,2300],{"class":2299},[2289,2454,2304],{"class":2303},[2289,2456,2307],{"class":2299},[2289,2458,2311],{"class":2310},[2289,2460,2314],{"class":2303},[2289,2462,2317],{"class":2299},[2289,2464,2320],{"class":2303},[2289,2466,2467],{"class":2310}," OZ0_JOIN_TOKEN",[2289,2469,2470],{"class":2303},"=",[2289,2472,2473],{"class":2303},"'",[2289,2475,2476],{"class":2299},"K10…",[2289,2478,2473],{"class":2303},[2289,2480,2323],{"class":2295},[2289,2482,2326],{"class":2299},[2289,2484,2329],{"class":2299},[2289,2486,2487],{"class":2299}," node",[2289,2489,2490],{"class":2299}," --server",[2289,2492,2493],{"class":2299}," https:\u002F\u002Foz0-edge:7443\n",[1855,2495,2496,2499,2500,2503,2504,1920,2507,2510,2511,1916,2514,2517,2518,2522,2523,1920,2526,2529,2530,2533,2534,2537,2538,2541],{},[1866,2497,2498],{},"--foreground"," runs it in the terminal instead (and so does a machine without systemd, such as a container), ",[1866,2501,2502],{},"--no-run"," joins without starting, ",[1866,2505,2506],{},"--service-name",[1866,2508,2509],{},"--no-linger"," pass to ",[1866,2512,2513],{},"service install",[1866,2515,2516],{},"--no-sandbox-setup"," skips the ",[1970,2519,2521],{"href":2520},"\u002Fgetting-started\u002Finstall\u002Flinux-sandbox#sandbox-tier-1-on-linux","sandbox setup"," it runs as root on Linux (bubblewrap, and Ubuntu's own AppArmor profile for it), ",[1866,2524,2525],{},"--data-dir",[1866,2527,2528],{},"--name"," work as for ",[1866,2531,2532],{},"oz0-node join",", and ",[1866,2535,2536],{},"--from"," installs from another URL or from a folder, for machines without internet access. The ",[1970,2539,2540],{"href":1249},"one-line install from the console"," is still the quickest way to add a node to a running cluster: it installs from your edge.",[1855,2543,2544,2547,2548,2550,2551,2554],{},[1866,2545,2546],{},"--channel stable|preview|lts-\u003Cmajor>.\u003Cminor>"," makes the script refuse a release that a cluster on that channel would not take, as the release's signed ",[1866,2549,2016],{}," says, before it installs anything: ",[1866,2552,2553],{},"--channel preview"," takes a stable release too.",[1855,2556,2557,2558,2533,2560,2562,2563,2566,2567,2569,2570,2574,2575,2578,2579,2581],{},"The script checks every file against ",[1866,2559,2040],{},[1866,2561,2040],{}," against the release key it carries, with ",[1866,2564,2565],{},"openssl"," (OpenSSL 3 checks ed25519 signatures; macOS's LibreSSL and OpenSSL before 3 do not). It installs only once openssl says the signature verifies. Where there is no openssl that can check it, it stops and says so: install OpenSSL 3, or check ",[1866,2568,2040],{}," with ",[1970,2571,2573],{"href":2572},"\u002Ffleet\u002Freleases#check-a-release","cosign"," yourself and pass ",[1866,2576,2577],{},"--digests-only",", which checks each file against ",[1866,2580,2040],{}," alone and says so. Any other answer of openssl stops the install, with or without the flag.",[1855,2583,2584,2585,2588,2589,2592],{},"It is tested on Ubuntu 24.04, Debian 13, Fedora 42 and Alpine 3.22. On Alpine (musl) the server runs and the node binary installs and joins, but the node's Python runtime does not install yet, so ",[1866,2586,2587],{},"oz0-node run"," stops: one of its dependencies, ",[1866,2590,2591],{},"cel-expr-python",", publishes no musl wheel. Use a glibc distribution for nodes.",[1871,2594,2596],{"id":2595},"check-a-release","Check a release",[1855,2598,2599],{},"Get the release's public key from somewhere other than the release itself, then:",[2280,2601,2603],{"className":2282,"code":2602,"language":2284,"meta":2285,"style":2285},"sha256sum -c SHA256SUMS\ncosign verify-blob --key release.pub --bundle SHA256SUMS.sigstore.json --insecure-ignore-tlog=true SHA256SUMS\ncosign verify-blob-attestation --key release.pub --bundle provenance.sigstore.json \\\n  --type slsaprovenance1 --insecure-ignore-tlog=true orchestrator-zero-node_\u003Cv>_linux_amd64\n",[1866,2604,2605,2616,2640,2660],{"__ignoreMap":2285},[2289,2606,2607,2610,2613],{"class":2291,"line":2292},[2289,2608,2609],{"class":2295},"sha256sum",[2289,2611,2612],{"class":2299}," -c",[2289,2614,2615],{"class":2299}," SHA256SUMS\n",[2289,2617,2618,2620,2623,2626,2629,2632,2635,2638],{"class":2291,"line":2335},[2289,2619,2573],{"class":2295},[2289,2621,2622],{"class":2299}," verify-blob",[2289,2624,2625],{"class":2299}," --key",[2289,2627,2628],{"class":2299}," release.pub",[2289,2630,2631],{"class":2299}," --bundle",[2289,2633,2634],{"class":2299}," SHA256SUMS.sigstore.json",[2289,2636,2637],{"class":2299}," --insecure-ignore-tlog=true",[2289,2639,2615],{"class":2299},[2289,2641,2643,2645,2648,2650,2652,2654,2657],{"class":2291,"line":2642},3,[2289,2644,2573],{"class":2295},[2289,2646,2647],{"class":2299}," verify-blob-attestation",[2289,2649,2625],{"class":2299},[2289,2651,2628],{"class":2299},[2289,2653,2631],{"class":2299},[2289,2655,2656],{"class":2299}," provenance.sigstore.json",[2289,2658,2659],{"class":2310}," \\\n",[2289,2661,2663,2666,2669,2671,2674,2676,2678,2680],{"class":2291,"line":2662},4,[2289,2664,2665],{"class":2299},"  --type",[2289,2667,2668],{"class":2299}," slsaprovenance1",[2289,2670,2637],{"class":2299},[2289,2672,2673],{"class":2299}," orchestrator-zero-node_",[2289,2675,2409],{"class":2303},[2289,2677,2412],{"class":2310},[2289,2679,2314],{"class":2303},[2289,2681,2682],{"class":2299},"_linux_amd64\n",[1855,2684,2685,2686,2689],{},"The project's releases are signed by release key A, or by its standby B, on a machine that never goes online; every official binary trusts both, so a release signed by B installs and updates like one signed by A. Their public halves, to check ",[1866,2687,2688],{},"release.pub"," against:",[1879,2691,2692,2702],{},[1882,2693,2694],{},[1885,2695,2696,2699],{},[1888,2697,2698],{},"Key",[1888,2700,2701],{},"Public half (Ed25519, base64)",[1895,2703,2704,2714],{},[1885,2705,2706,2709],{},[1900,2707,2708],{},"Release key A",[1900,2710,2711],{},[1866,2712,2713],{},"xRl\u002FUKsJS2EALhhHB3lbVsk\u002FpJI1LNNA7lOQhMEuqVw=",[1885,2715,2716,2719],{},[1900,2717,2718],{},"Release key B (standby)",[1900,2720,2721],{},[1866,2722,2723],{},"IEl7naTT+Y8zBsVMFlhjKFuLctFiuTS0eiydkTpJcM4=",[1855,2725,2726,2728,2729,2732,2733,2736,2737,2740,2741,2744],{},[1866,2727,2016],{},"'s ",[1866,2730,2731],{},"key"," names the one that signed; the commands above are the same whichever it is. The signatures are made with the release key and recorded in no transparency log, so ",[1866,2734,2735],{},"--insecure-ignore-tlog=true"," is expected. cosign reads at most 128 MiB of a file it checks against the provenance, and the toolchain archives are larger: set ",[1866,2738,2739],{},"COSIGN_MAX_ATTACHMENT_SIZE=512MiB"," for them. From a checkout of the source, ",[1866,2742,2743],{},"go run .\u002Fscripts\u002Freleasetool verify \u003Cfolder> release.pub"," checks all of it, and also that the binaries trust the key, that each SBOM belongs to its file and that the dist archive serves the release's own node binaries.",[1855,2746,2747,2748,2750,2751,2754,2755,1916,2758,2760,2761,2764],{},"Every file but the images is reproducible: building the same commit with ",[1866,2749,1868],{}," gives the same bytes. It refuses a tree with uncommitted changes or untracked files, since those would be built in too. With ",[1866,2752,2753],{},"ALLOW_DIRTY=1"," it builds one as a trial: the version ends in ",[1866,2756,2757],{},"-dirty",[1866,2759,2016],{}," and the provenance say ",[1866,2762,2763],{},"\"dirty\": true",", and verify prints a warning.",[2240,2766,2768],{"id":2767},"sign-your-own-releases-offline","Sign your own releases offline",[1855,2770,2771,2772,2775],{},"A cluster that builds its own releases can keep its key off the build machine too. ",[1866,2773,2774],{},"make release-candidate SIGN=offline RELEASE_PUB=\u003Cyour key's public half>"," builds with no private key, reads none and makes none, and prints a folder to carry to the machine that holds the key.",[1855,2777,2778,2779,2782,2783,2786],{},"There, ",[1866,2780,2781],{},"release-sign sign-bundle --key \u003Cseed file, or - for stdin> \u003Cfolder>"," checks the folder against the digests it lists, refuses a key other than the one it asks for, and writes the signatures into the folder; ",[1866,2784,2785],{},"release-sign show \u003Cfolder>"," first says what it is asked to sign.",[1855,2788,2789],{},"It signs only files it can name (the dist manifest, and in Enterprise a sector pack's payload) and refuses any text it would print with a control character in it, so what the terminal shows is what gets signed.",[1855,2791,2792,2793,2796,2797,2214],{},"Bring the folder back and run the same ",[1866,2794,2795],{},"make"," command with ",[1866,2798,2799],{},"SIGNED=\u003Cfolder>",[1855,2801,2802,2803,2214],{},"A release takes two such trips: the first signs the dist manifest, which the dist archive and the server image hold, and the second the provenance and ",[1866,2804,2040],{},[1855,2806,2807],{},"The build machine refuses anything that is not what it wrote, signed by that key, and the result checks with the same commands as above.",[1855,2809,2810,2813,2814,2817],{},[1866,2811,2812],{},"release-sign"," runs without Go: the release holds it, built static for Linux, and ",[1866,2815,2816],{},"make release-signer"," builds the same bytes on another machine to compare, without reading or making a key there.",[1871,2819,2821],{"id":2820},"what-the-provenance-says","What the provenance says",[1855,2823,2824,2825,2830,2831,2834,2835,2838,2839,2842],{},"Each release carries an ",[1970,2826,2829],{"href":2827,"rel":2828},"https:\u002F\u002Fslsa.dev\u002Fspec\u002Fv1.0\u002Fprovenance",[2183],"SLSA v1 provenance"," in ",[1866,2832,2833],{},"provenance.sigstore.json",", signed with the release key. Its ",[1866,2836,2837],{},"buildType"," and its builder's ",[1866,2840,2841],{},"id"," are links to the two sections below, which say what they mean.",[2240,2844,2846],{"id":2845},"release-candidate-v1","Release candidate v1",[1855,2848,2849,2852,2853,2855,2856,2858,2859,2861,2862,2864],{},[1866,2850,2851],{},"https:\u002F\u002Fdocs.oz0.ai\u002Ffleet\u002Freleases#release-candidate-v1"," is the ",[1866,2854,2837],{}," of a release built with ",[1866,2857,1868],{},": it builds the server and node binaries, the runtime bundle, the toolchain archives and the images from one commit, writes their SBOMs and ",[1866,2860,2016],{},", and signs ",[1866,2863,2040],{}," and the provenance with the release key. Its fields are:",[1879,2866,2867,2877],{},[1882,2868,2869],{},[1885,2870,2871,2874],{},[1888,2872,2873],{},"Field",[1888,2875,2876],{},"What it holds",[1895,2878,2879,2892,2902,2917,2927,2937,2947],{},[1885,2880,2881,2886],{},[1900,2882,2883],{},[1866,2884,2885],{},"externalParameters.version",[1900,2887,2888,2889,2891],{},"The release's version, as ",[1866,2890,2016],{}," names it",[1885,2893,2894,2899],{},[1900,2895,2896],{},[1866,2897,2898],{},"externalParameters.source",[1900,2900,2901],{},"The repository and the commit the tree was built from",[1885,2903,2904,2909],{},[1900,2905,2906],{},[1866,2907,2908],{},"externalParameters.dirty",[1900,2910,2911,2914,2915,1972],{},[1866,2912,2913],{},"true"," only when the tree had uncommitted changes (",[1866,2916,2753],{},[1885,2918,2919,2924],{},[1900,2920,2921],{},[1866,2922,2923],{},"externalParameters.channel",[1900,2925,2926],{},"The release channel, when the release names one",[1885,2928,2929,2934],{},[1900,2930,2931],{},[1866,2932,2933],{},"externalParameters.*",[1900,2935,2936],{},"The build's other settings, such as the platforms and the image architectures, and the Go FIPS module for the FIPS flavour",[1885,2938,2939,2944],{},[1900,2940,2941],{},[1866,2942,2943],{},"internalParameters.SOURCE_DATE",[1900,2945,2946],{},"The timestamp written into every file, which makes the build reproducible",[1885,2948,2949,2954],{},[1900,2950,2951],{},[1866,2952,2953],{},"resolvedDependencies",[1900,2955,2956],{},"The source commit and the build's other inputs, its lock files and base images, each with its digest",[1855,2958,2959,2962,2963,2965,2966,2968],{},[1866,2960,2961],{},"go run .\u002Fscripts\u002Freleasetool verify"," refuses a provenance of any other ",[1866,2964,2837],{},". A candidate built before the ",[1866,2967,2837],{}," was this link (it pointed at a file in the source repository) does not verify: build it again. No release was published with the earlier value.",[2240,2970,2972],{"id":2971},"local-builder","Local builder",[1855,2974,2975,2978,2979,2981,2982,2985,2986,2991],{},[1866,2976,2977],{},"https:\u002F\u002Fdocs.oz0.ai\u002Ffleet\u002Freleases#local-builder"," is the builder ",[1866,2980,2841],{}," of a release candidate built on a person's machine. ",[1866,2983,2984],{},"builder.version"," names the version of each tool the build used. SLSA counts such a build as ",[1970,2987,2990],{"href":2988,"rel":2989},"https:\u002F\u002Fslsa.dev\u002Fspec\u002Fv1.0\u002Flevels#build-l1",[2183],"Build L1",": the provenance exists and is signed, but nothing stronger than the release key vouches for the machine that built it. Rebuilding the same commit and comparing the bytes is how anyone checks it further.",[1871,2993,2995],{"id":2994},"two-kinds-of-sbom","Two kinds of SBOM",[1855,2997,2998],{},"Releases and plugins each have their own SBOMs, both CycloneDX:",[1879,3000,3001,3013],{},[1882,3002,3003],{},[1885,3004,3005,3007,3010],{},[1888,3006],{},[1888,3008,3009],{},"Release SBOMs",[1888,3011,3012],{},"Plugin SBOMs",[1895,3014,3015,3026,3044,3058,3072],{},[1885,3016,3017,3020,3023],{},[1900,3018,3019],{},"Describe",[1900,3021,3022],{},"Each release file: the server and node binaries, the runtime, the toolchain archives, the images",[1900,3024,3025],{},"One plugin version: the packages its lockfiles and the edge's hash pins name, and its tools' images",[1885,3027,3028,3031,3037],{},[1900,3029,3030],{},"Made by",[1900,3032,3033,3034,3036],{},"syft at ",[1866,3035,1868],{},", normalised so a rebuild gives the same bytes",[1900,3038,3039,3040,3043],{},"Orchestrator Zero itself from the lockfiles, at ",[1866,3041,3042],{},"plugin pack",", at a hub's inspect and for an installed version",[1885,3045,3046,3049,3055],{},[1900,3047,3048],{},"Bound to",[1900,3050,3051,3052,1972],{},"The file's SHA-256 (",[1866,3053,3054],{},"metadata.component",[1900,3056,3057],{},"The SHA-256 of the plugin's other files",[1885,3059,3060,3063,3069],{},[1900,3061,3062],{},"Signed",[1900,3064,3065,3066,3068],{},"In ",[1866,3067,2040],{},", with the release key",[1900,3070,3071],{},"In the plugin's bundle, and its digest in a signed hub listing",[1885,3073,3074,3077,3082],{},[1900,3075,3076],{},"Where",[1900,3078,3079,3081],{},[1866,3080,2006],{}," in the release",[1900,3083,3084,3087,3088,3091,3092],{},[1866,3085,3086],{},"sbom.cdx.json"," in the bundle, ",[1866,3089,3090],{},"oz0 plugin sbom",", the Plugins page, ",[1970,3093,3095],{"href":3094},"\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles#evidence-bundles","evidence bundles",[1855,3097,3098,3099,3103],{},"See ",[1970,3100,3102],{"href":3101},"\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records#sboms","SBOMs"," for the plugins'.",[1855,3105,3106,3107,3110,3111,3114,3115,3117,3118,3121,3122,3124],{},"For a build of your own from source, ",[1866,3108,3109],{},"make sbom"," writes the same kind of SBOMs into ",[1866,3112,3113],{},"dist\u002Fsbom\u002F",": one each for the server and node binaries in ",[1866,3116,1947],{},", one for the runtime bundle (with the bundle as one archive beside it), and one for each plugin in the repository's ",[1866,3119,3120],{},"plugins\u002F"," folder, as ",[1866,3123,3042],{}," writes it.",[1855,3126,3127,3128,3131],{},"It uses the release's own pinned syft, downloaded once into ",[1866,3129,3130],{},"~\u002F.cache\u002Foz0-tools"," and checked against its published SHA-256, and the release's own normalising, so each SBOM is bound to the SHA-256 of the file it describes and the same build gives the same SBOM.",[1855,3133,3134,1920,3137,3140,3141,3144,3145,2214],{},[1866,3135,3136],{},"RUNTIME=0",[1866,3138,3139],{},"PLUGINS=0"," leave those out, and ",[1866,3142,3143],{},"SBOM_OUT"," names another folder (a new or empty one, or one an earlier run wrote: it never clears a folder that holds anything else); images and toolchain archives are only built, with their SBOMs, by ",[1866,3146,1868],{},[1871,3148,3150],{"id":3149},"the-fips-flavour","The FIPS flavour",[1855,3152,3153,3154,3157,3158,3161,3162,3165,3166,3169,3170,3173,3174,3176,3177,3179,3180,2533,3183,3185,3186,2061],{},"A release is built in one flavour. The ",[1970,3155,3156],{"href":1488},"FIPS flavour","'s release candidate is ",[1866,3159,3160],{},"make release-candidate FLAVOUR=fips",": the same files, every Go binary built against Go's FIPS 140-3 module snapshot (",[1866,3163,3164],{},"FIPS140_MODULE",", default ",[1866,3167,3168],{},"v1.26.0","), in ",[1866,3171,3172],{},"dist\u002Frelease\u002F\u003Cv>-fips",". Its ",[1866,3175,2016],{}," and the dist folder's ",[1866,3178,2071],{}," say ",[1866,3181,3182],{},"\"flavour\": \"fips\"",[1866,3184,2016],{},"'s parameters name the snapshot (",[1866,3187,3188],{},"gofips140",[1855,3190,3191,3192,3194,3195,3198,3199,3202,3203,3205],{},"It has no container images yet. Its ",[1866,3193,1996],{}," downloads from the tag ",[1866,3196,3197],{},"\u003Cv>-fips"," unless ",[1866,3200,3201],{},"RELEASE_URL"," names another place, and, like the default release's, installs only binaries of its own flavour: the two releases name their files alike and are signed with the same key. An edge serves, ",[1866,3204,2165],{}," mirrors and a node installs only a release of its own flavour, so a FIPS cluster never upgrades to a default build.",[1871,3207,3209],{"id":3208},"upgrade-from-an-earlier-version","Upgrade from an earlier version",[1855,3211,3212],{},"Each release is tested by upgrading the data of earlier versions to it, on SQLite and PostgreSQL, with a node that replaces its own binary across the same versions.",[1855,3214,3215,3216,3219],{},"Install the new release next to the old one, stop the server, and start the new one on the same data: it migrates the database. ",[1866,3217,3218],{},"install.sh server"," puts the new dist folder next to the new binary, so the edge serves the new node binaries and runtime.",[1855,3221,3222,3223,3226,3227,3230,3231,3233],{},"An edge on another machine takes the release from a folder: unpack ",[1866,3224,3225],{},"orchestrator-zero-dist_\u003Cversion>.tar.gz"," there and run ",[1866,3228,3229],{},"oz0 server dist pull --from \u003Cthe unpacked dist folder>"," (or serve the folder over HTTP and give ",[1866,3232,2165],{}," its URL).",[1855,3235,3236,3237,2214],{},"Either way the signature is checked first, and the toolchain comes along when the folder has one. A cluster with no way out takes it from an ",[1970,3238,3239],{"href":1483},"offline folder",[1855,3241,3242,3243,3245,3246,2214],{},"Then upgrade the nodes from the console or with ",[1866,3244,2171],{},". See ",[1970,3247,2060],{"href":1401},[3249,3250,3251],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":2285,"searchDepth":2335,"depth":2335,"links":3253},[3254,3255,3258,3259,3262,3266,3267,3268],{"id":1873,"depth":2335,"text":1874},{"id":2064,"depth":2335,"text":2065,"children":3256},[3257],{"id":2242,"depth":2642,"text":2243},{"id":2274,"depth":2335,"text":2275},{"id":2595,"depth":2335,"text":2596,"children":3260},[3261],{"id":2767,"depth":2642,"text":2768},{"id":2820,"depth":2335,"text":2821,"children":3263},[3264,3265],{"id":2845,"depth":2642,"text":2846},{"id":2971,"depth":2642,"text":2972},{"id":2994,"depth":2335,"text":2995},{"id":3149,"depth":2335,"text":3150},{"id":3208,"depth":2335,"text":3209},"What a release holds, how to install from one, and how to check its signatures, SBOMs and provenance.","md",null,{"audience":3273,"doc_type":3274},"cluster operators","reference",{"icon":463},{"title":1459,"description":3269},"OLHqLPhQ3_6Wzy0kxl22knP04aV9X6xjwgDbqsw4mxc",[3279,3281],{"title":1455,"path":1456,"stem":1457,"description":3280,"children":-1},"Start a canary rollout and inspect its health and quality verdicts before the remaining nodes move.",{"title":1463,"path":1464,"stem":1465,"description":3282,"icon":1466,"children":-1},"One command to try it: a server, a node, the console and a sample plugin in one container. And a compose file for a small team: PostgreSQL, a server and a node.",1794442950999]