[{"data":1,"prerenderedAt":1528},["ShallowReactive",2],{"navigation_docs":3,"-project-data-and-privacy":520,"-project-data-and-privacy-surround":1523},[4,28,51,191,222,485],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,117,138,187],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109,113],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116},"Share chains with add-ons","\u002Fguides\u002Fcustomize\u002Fshare-chains-with-addons","3.guides\u002F2.customize\u002F4.share-chains-with-addons",{"title":118,"path":119,"stem":120,"children":121,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[122,126,130,134],{"title":123,"path":124,"stem":125},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":127,"path":128,"stem":129},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":131,"path":132,"stem":133},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":135,"path":136,"stem":137},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":139,"path":140,"stem":141,"children":142,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[143,147,151,155,159,163,167,171,175,179,183],{"title":144,"path":145,"stem":146},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":148,"path":149,"stem":150},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":152,"path":153,"stem":154},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":156,"path":157,"stem":158},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":160,"path":161,"stem":162},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":164,"path":165,"stem":166},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":168,"path":169,"stem":170},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":172,"path":173,"stem":174},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":176,"path":177,"stem":178},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":180,"path":181,"stem":182},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":184,"path":185,"stem":186},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":188,"path":189,"stem":190},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":192,"path":193,"stem":194,"children":195},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[196,198,202,206,210,214,218],{"title":10,"path":193,"stem":197},"4.troubleshooting\u002Findex",{"title":199,"path":200,"stem":201},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":203,"path":204,"stem":205},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":207,"path":208,"stem":209},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":211,"path":212,"stem":213},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":215,"path":216,"stem":217},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":219,"path":220,"stem":221},"Add-on problems","\u002Ftroubleshooting\u002Faddon-problems","4.troubleshooting\u002F6.addon-problems",{"title":223,"path":224,"stem":225,"children":226},"Reference","\u002Freference","5.reference",[227,229,267,289,293,391,409,435,439,443,477,481],{"title":10,"path":224,"stem":228},"5.reference\u002Findex",{"title":230,"path":231,"stem":232,"children":233},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[234,235,239,243,247,251,255,259,263],{"title":10,"path":231,"stem":232},{"title":236,"path":237,"stem":238},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":240,"path":241,"stem":242},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":244,"path":245,"stem":246},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":248,"path":249,"stem":250},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":252,"path":253,"stem":254},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":256,"path":257,"stem":258},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":260,"path":261,"stem":262},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":264,"path":265,"stem":266},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":268,"path":269,"stem":270,"children":271},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[272,273,277,281,285],{"title":10,"path":269,"stem":270},{"title":274,"path":275,"stem":276},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":278,"path":279,"stem":280},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":282,"path":283,"stem":284},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":286,"path":287,"stem":288},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":290,"path":291,"stem":292},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":294,"path":295,"stem":296,"children":297},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[298,299,317,321,325,329,333,337,341,345,379,383,387],{"title":10,"path":295,"stem":296},{"title":300,"path":301,"stem":302,"children":303},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[304,305,309,313],{"title":10,"path":301,"stem":302},{"title":306,"path":307,"stem":308},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":310,"path":311,"stem":312},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":314,"path":315,"stem":316},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":318,"path":319,"stem":320},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":322,"path":323,"stem":324},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":326,"path":327,"stem":328},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":330,"path":331,"stem":332},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":334,"path":335,"stem":336},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":338,"path":339,"stem":340},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":342,"path":343,"stem":344},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":346,"path":347,"stem":348,"children":349},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[350,351,355,359,363,367,371,375],{"title":10,"path":347,"stem":348},{"title":352,"path":353,"stem":354},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":356,"path":357,"stem":358},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":360,"path":361,"stem":362},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":364,"path":365,"stem":366},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":368,"path":369,"stem":370},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":372,"path":373,"stem":374},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":376,"path":377,"stem":378},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":380,"path":381,"stem":382},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":384,"path":385,"stem":386},"Add-ons and collections","\u002Freference\u002Fconfiguration\u002Faddons","5.reference\u002F03.configuration\u002F12.addons",{"title":388,"path":389,"stem":390},"Repo libraries","\u002Freference\u002Fconfiguration\u002Frepo-libraries","5.reference\u002F03.configuration\u002F13.repo-libraries",{"title":392,"path":393,"stem":394,"children":395},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[396,397,401,405],{"title":10,"path":393,"stem":394},{"title":398,"path":399,"stem":400},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":402,"path":403,"stem":404},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":406,"path":407,"stem":408},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":410,"path":411,"stem":412,"children":413},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[414,415,419,423,427,431],{"title":10,"path":411,"stem":412},{"title":416,"path":417,"stem":418},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":420,"path":421,"stem":422},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":424,"path":425,"stem":426},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":428,"path":429,"stem":430},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":432,"path":433,"stem":434},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":436,"path":437,"stem":438},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":440,"path":441,"stem":442},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":444,"path":445,"stem":446,"children":447},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[448,449,453,457,461,465,469,473],{"title":10,"path":445,"stem":446},{"title":450,"path":451,"stem":452},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":454,"path":455,"stem":456},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":458,"path":459,"stem":460},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":462,"path":463,"stem":464},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":466,"path":467,"stem":468},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":470,"path":471,"stem":472},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":474,"path":475,"stem":476},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":478,"path":479,"stem":480},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":482,"path":483,"stem":484},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":486,"path":487,"stem":488,"children":489},"Security and project","\u002Fproject","6.project",[490,492,496,500,504,508,512,516],{"title":10,"path":487,"stem":491},"6.project\u002Findex",{"title":493,"path":494,"stem":495},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":497,"path":498,"stem":499},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":501,"path":502,"stem":503},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":505,"path":506,"stem":507},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":509,"path":510,"stem":511},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":513,"path":514,"stem":515},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":517,"path":518,"stem":519},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":521,"title":497,"body":522,"description":1516,"extension":1517,"links":1518,"meta":1519,"navigation":1520,"path":498,"seo":1521,"stem":499,"__hash__":1522},"docs\u002F6.project\u002F2.data-and-privacy.md",{"type":523,"value":524,"toc":1503},"minimark",[525,529,534,537,559,563,566,854,861,952,956,978,983,1052,1061,1065,1074,1312,1318,1323,1454,1458,1472,1476],[526,527,528],"p",{},"Kraft has no telemetry. It sends no usage data, crash reports or analytics\nanywhere. The outbound calls it makes are listed below, and each one serves a\nfeature you can see.",[530,531,533],"h2",{"id":532},"model-providers","Model providers",[526,535,536],{},"Kraft never calls a model API itself. It runs the agent CLI you installed,\nsuch as Claude Code, and that CLI sends your code, prompts and tool output to\nits provider under your account and that provider's terms. What the provider\nkeeps and for how long is set by your account with it, not by Kraft.",[526,538,539,540,545,546,553,554,558],{},"Under a ",[541,542,544],"a",{"href":543},"\u002Fconcepts\u002Fvocabulary#sandbox","sandbox"," with a\n",[541,547,548,552],{"href":361},[549,550,551],"code",{},"network:"," policy",", the agent's traffic leaves through Kraft's own egress\nproxy, and only to the hosts the policy and the ",[541,555,557],{"href":556},"\u002Fconcepts\u002Fvocabulary#harness","harness"," allow.",[530,560,562],{"id":561},"outbound-calls","Outbound calls",[526,564,565],{},"Each row is a call Kraft or your browser makes, and what turns it off.",[567,568,569,588],"table",{},[570,571,572],"thead",{},[573,574,575,579,582,585],"tr",{},[576,577,578],"th",{},"Call",[576,580,581],{},"Goes to",[576,583,584],{},"When",[576,586,587],{},"Turn it off",[589,590,591,609,636,667,692,722,751,767,800,825],"tbody",{},[573,592,593,597,603,606],{},[594,595,596],"td",{},"Agent CLI",[594,598,599,600],{},"Its provider, such as ",[549,601,602],{},"api.anthropic.com",[594,604,605],{},"Every agent task",[594,607,608],{},"Not possible: this is the work.",[573,610,611,614,620,630],{},[594,612,613],{},"Update check",[594,615,616,619],{},[549,617,618],{},"api.github.com",", this project's releases list",[594,621,622,625,626,629],{},[549,623,624],{},"kraft admin start",", ",[549,627,628],{},"kraft admin doctor"," and the web interface, at most once a day, or once an hour after a failed check",[594,631,632,635],{},[549,633,634],{},"KRAFT_NO_UPDATE_CHECK=1",". It stops the automatic checks only.",[573,637,638,643,661,664],{},[594,639,640],{},[549,641,642],{},"kraft admin update",[594,644,645,646,648,649,652,653,656,657,660],{},"The releases list on ",[549,647,618],{},", then ",[549,650,651],{},"uv tool install"," of ",[549,654,655],{},"kraft-sdlc"," from PyPI (the release's wheel on GitHub if that fails), or ",[549,658,659],{},"brew upgrade kraft"," on a Homebrew install",[594,662,663],{},"Only when you run it",[594,665,666],{},"Do not run it.",[573,668,669,683,686,689],{},[594,670,671,675,676,625,679,682],{},[541,672,674],{"href":673},"\u002Fconcepts\u002Fvocabulary#forge","Forge"," CLI (",[549,677,678],{},"gh",[549,680,681],{},"glab",")",[594,684,685],{},"Your forge",[594,687,688],{},"Merge-request nodes: open, read checks and reviews, mark ready, merge",[594,690,691],{},"A chain without merge-request nodes makes none.",[573,693,694,702,708,719],{},[594,695,696,625,699],{},[549,697,698],{},"git fetch",[549,700,701],{},"git push",[594,703,704,705],{},"Your repository's ",[549,706,707],{},"origin",[594,709,710,711,625,715,718],{},"Fetching the ",[541,712,714],{"href":713},"\u002Fconcepts\u002Fvocabulary#base-branch","base branch",[549,716,717],{},"git ls-remote"," on a base branch or a pushed branch, and pushing the item's branch. A workspace's pointer-only bump is pushed to the base branch itself",[594,720,721],{},"Not possible.",[573,723,724,731,738,748],{},[594,725,726,730],{},[541,727,729],{"href":728},"\u002Fconcepts\u002Fvocabulary#add-on","Kraft add-on"," collections",[594,732,733,734,737],{},"Each git URL in ",[549,735,736],{},"addons.yaml",", with your own git login",[594,739,740,743,744,747],{},[549,741,742],{},"kraft admin addon"," installs, updates and ",[549,745,746],{},"collection"," fetches; after a server start and once a day, for an add-on set to auto-update; and to restore an add-on's missing files",[594,749,750],{},"Add no git collection.",[573,752,753,756,761,764],{},[594,754,755],{},"Notifications",[594,757,758,759],{},"The webhook URL in ",[549,760,338],{},[594,762,763],{},"For each event you chose, only while notifications are on",[594,765,766],{},"Off by default.",[573,768,769,772,778,789],{},[594,770,771],{},"API docs pages",[594,773,774,777],{},[549,775,776],{},"cdn.jsdelivr.net",", fetched by your browser",[594,779,780,781,784,785,788],{},"Only when you open ",[549,782,783],{},"\u002Fdocs"," or ",[549,786,787],{},"\u002Fredoc"," in a browser. The board loads nothing from outside.",[594,790,791,792,795,796,799],{},"Do not open them; read ",[549,793,794],{},"\u002Fopenapi.json"," in your own viewer. See ",[541,797,798],{"href":445},"the HTTP API",".",[573,801,802,805,812,819],{},[594,803,804],{},"Embedding model",[594,806,807,808,811],{},"Hugging Face, ",[549,809,810],{},"Qdrant\u002Fbge-small-en-v1.5-onnx-Q",", about 130 MB",[594,813,814,815,818],{},"The first vector index or search, only with the ",[549,816,817],{},"vector"," extra installed",[594,820,821,822,824],{},"Do not install the ",[549,823,817],{}," extra.",[573,826,827,834,844,851],{},[594,828,829,833],{},[541,830,832],{"href":831},"\u002Fconcepts\u002Fvocabulary#kit","Kit"," image registry",[594,835,836,837,784,840,843],{},"The registry named by a Kit's digest-pinned image reference, through your own ",[549,838,839],{},"docker",[549,841,842],{},"podman"," and its login",[594,845,846,847,850],{},"Only for a ",[549,848,849],{},"kind: kit"," sandbox, when Kraft reads the Kit's descriptor",[594,852,853],{},"Do not use a Kit.",[526,855,856,857,860],{},"The forge CLI and ",[549,858,859],{},"git"," calls use your own logins for those tools. More on four\nof the rows:",[862,863,864,886,903,934],"ul",{},[865,866,867,871,872,875,876,878,879,882,883,885],"li",{},[868,869,870],"strong",{},"Update check."," The result is cached in ",[549,873,874],{},"run\u002Fupdate-check.json",".\n",[549,877,634],{}," stops the automatic checks. The About page's\n",[868,880,881],{},"Check now"," and ",[549,884,642],{}," still look when you ask.",[865,887,888,891,892,896,897,899,900,902],{},[868,889,890],{},"Notifications."," For each event you chose, Kraft posts the ",[541,893,895],{"href":894},"\u002Fconcepts\u002Fvocabulary#work-item","work item","'s id\nand title, the event type, the gate when the event is about one, and a link\nto the item on your board. A title can name a private project, so check what\n",[549,898,338],{}," points at before you turn notifications on. ",[541,901,92],{"href":93}," sets them up.",[865,904,905,908,909,911,912,915,916,919,920,923,924,926,927,919,930,933],{},[868,906,907],{},"API docs pages."," ",[549,910,783],{}," loads ",[549,913,914],{},"swagger-ui-bundle.js"," and\n",[549,917,918],{},"swagger-ui.css"," from ",[549,921,922],{},"swagger-ui-dist@5.32.15",". ",[549,925,787],{}," loads\n",[549,928,929],{},"redoc.standalone.js",[549,931,932],{},"redoc@2.5.4",". Each is one pinned release,\nchecked against a hash Kraft ships.",[865,935,936,939,940,943,944,947,948,951],{},[868,937,938],{},"Embedding model."," It is cached in ",[549,941,942],{},"$XDG_CACHE_HOME\u002Fkraft\u002Ffastembed","\n(",[549,945,946],{},"~\u002F.cache\u002Fkraft\u002Ffastembed"," when that is unset), or in ",[549,949,950],{},"$KRAFT_EMBED_CACHE","\nif you set it.",[530,953,955],{"id":954},"secrets-and-state","Secrets and state",[526,957,958,959,962,963,966,967,970,971,973,974,977],{},"Everything lives under ",[549,960,961],{},"$KRAFT_HOME"," (default ",[549,964,965],{},"~\u002F.kraft","). Kraft writes its\nconfig files through a temporary file created with mode ",[549,968,969],{},"0600",", so a file\nKraft has written is readable only by you. The defaults Kraft copies into a\nnew home on its first start are ",[549,972,969],{}," too, in ",[549,975,976],{},"0700"," directories. A file you\ncreated or edited by hand keeps its own mode.",[979,980,982],"h3",{"id":981},"config-files-that-hold-secrets","Config files that hold secrets",[567,984,985,998],{},[570,986,987],{},[573,988,989,992,995],{},[576,990,991],{},"What",[576,993,994],{},"Where",[576,996,997],{},"Mode",[589,999,1000,1015,1029],{},[573,1001,1002,1005,1010],{},[594,1003,1004],{},"Settings password (scrypt hash) and bind",[594,1006,1007],{},[549,1008,1009],{},"config\u002Faccess.yaml",[594,1011,1012,1014],{},[549,1013,969],{}," once Kraft writes it",[573,1016,1017,1020,1025],{},[594,1018,1019],{},"Notification webhook URL",[594,1021,1022],{},[549,1023,1024],{},"config\u002Fnotify.yaml",[594,1026,1027,1014],{},[549,1028,969],{},[573,1030,1031,1038,1043],{},[594,1032,1033,1034,1037],{},"Repo ",[549,1035,1036],{},"env:"," values",[594,1039,1040],{},[549,1041,1042],{},"config\u002Frepos.yaml",[594,1044,1045,1047,1048,1051],{},[549,1046,969],{}," once Kraft writes it (",[549,1049,1050],{},"kraft repo connect"," or a Settings save)",[526,1053,1054,1055,1058,1059,799],{},"The rest of ",[549,1056,1057],{},"config\u002F"," is described in ",[541,1060,294],{"href":295},[979,1062,1064],{"id":1063},"the-run-directory","The run directory",[526,1066,1067,1070,1071,1073],{},[549,1068,1069],{},"run\u002F"," is ",[549,1072,976],{},", and Kraft sets that on every start. Because of that, other\nusers on the machine cannot reach anything inside it, whatever mode a file has.\nEvery path in the two tables below is under it. A row with no mode is one Kraft\nsets none on.",[567,1075,1076,1088],{},[570,1077,1078],{},[573,1079,1080,1083,1086],{},[576,1081,1082],{},"Path",[576,1084,1085],{},"What it holds",[576,1087,997],{},[589,1089,1090,1108,1128,1144,1160,1174,1189,1203,1217,1237,1249,1273,1292],{},[573,1091,1092,1097,1100],{},[594,1093,1094],{},[549,1095,1096],{},"mcp-token",[594,1098,1099],{},"Bearer token for the CLI and MCP",[594,1101,1102,1104,1105,1107],{},[549,1103,969],{},"; ",[549,1106,628],{}," checks it",[573,1109,1110,1115,1122],{},[594,1111,1112],{},[549,1113,1114],{},"trigger-token",[594,1116,1117,1118,1121],{},"Bearer token for ",[549,1119,1120],{},"POST \u002Fapi\u002Ftriggers"," only",[594,1123,1124,1104,1126,1107],{},[549,1125,969],{},[549,1127,628],{},[573,1129,1130,1135,1138],{},[594,1131,1132],{},[549,1133,1134],{},"kraft.pid",[594,1136,1137],{},"The process id of the running server",[594,1139,1140,1143],{},[549,1141,1142],{},"0644",", less your umask",[573,1145,1146,1151,1158],{},[594,1147,1148],{},[549,1149,1150],{},"kraft.mode",[594,1152,1153,1154,1157],{},"Whether the server was started detached or attached, so ",[549,1155,1156],{},"kraft admin restart"," can start it the same way",[594,1159],{},[573,1161,1162,1167,1170],{},[594,1163,1164],{},[549,1165,1166],{},"update-check.json",[594,1168,1169],{},"The cached update check",[594,1171,1172],{},[549,1173,969],{},[573,1175,1176,1181,1184],{},[594,1177,1178],{},[549,1179,1180],{},"orchestrator.db",[594,1182,1183],{},"Login sessions (token hashes), work items, events",[594,1185,1186,1188],{},[549,1187,969],{}," when Kraft creates it",[573,1190,1191,1196,1199],{},[594,1192,1193],{},[549,1194,1195],{},"orchestrator.db.pre-v\u003CN>-\u003Ctime>",[594,1197,1198],{},"The database as it was before an upgrade migrated it",[594,1200,1201],{},[549,1202,969],{},[573,1204,1205,1210,1213],{},[594,1206,1207],{},[549,1208,1209],{},"index.db",[594,1211,1212],{},"Search index of specs, plans and other documents",[594,1214,1215,1188],{},[549,1216,969],{},[573,1218,1219,1224,1230],{},[594,1220,1221],{},[549,1222,1223],{},"logs\u002F",[594,1225,1226,1227],{},"Agent logs, and ",[549,1228,1229],{},"server.log",[594,1231,1232,1234,1235],{},[549,1233,969],{}," for a session log; none on ",[549,1236,1229],{},[573,1238,1239,1244,1247],{},[594,1240,1241],{},[549,1242,1243],{},"results\u002F",[594,1245,1246],{},"Agent results",[594,1248],{},[573,1250,1251,1256,1271],{},[594,1252,1253],{},[549,1254,1255],{},"addons\u002F",[594,1257,1258,1259,1262,1263,1266,1267,799],{},"Each git collection's mirror, the files of each installed ",[541,1260,1261],{"href":728},"add-on",", and ",[549,1264,1265],{},"status.json",", the last auto-update of each. See ",[541,1268,1270],{"href":1269},"\u002Freference\u002Fconfiguration\u002Faddons#on-disk","On disk",[594,1272],{},[573,1274,1275,1283,1290],{},[594,1276,1277,625,1280],{},[549,1278,1279],{},"attachments\u002F",[549,1281,1282],{},"worktrees\u002F",[594,1284,1285,1286],{},"Attachment copies and the item ",[541,1287,1289],{"href":1288},"\u002Fconcepts\u002Fvocabulary#worktree","worktrees",[594,1291],{},[573,1293,1294,1299,1310],{},[594,1295,1296],{},[549,1297,1298],{},"harness-config\u002F\u003Charness id>\u002F",[594,1300,1301,1302,1306,1307],{},"Permission-rule files Kraft writes for a harness, and the config files a ",[541,1303,1305],{"href":1304},"\u002Fconcepts\u002Fvocabulary#harness-profile","harness profile"," declares. For a sandboxed item the config files go to ",[549,1308,1309],{},"sandbox-home\u002F\u003Cid>\u002F.kraft-harness-config\u002F\u003Charness id>",[594,1311],{},[526,1313,1314,1315,1317],{},"Agent logs hold whole sessions: prompts, the code the agent read and wrote,\nand command output. A database created by an older Kraft keeps its mode. Treat ",[549,1316,1069],{}," like the repositories it works on.",[1319,1320,1322],"h4",{"id":1321},"sandbox-working-files","Sandbox working files",[567,1324,1325,1335],{},[570,1326,1327],{},[573,1328,1329,1331,1333],{},[576,1330,1082],{},[576,1332,1085],{},[576,1334,997],{},[589,1336,1337,1351,1373,1387,1402,1414,1426,1442],{},[573,1338,1339,1344,1347],{},[594,1340,1341],{},[549,1342,1343],{},"sn\u002F",[594,1345,1346],{},"Each sandboxed session's egress socket",[594,1348,1349],{},[549,1350,976],{},[573,1352,1353,1358,1361],{},[594,1354,1355],{},[549,1356,1357],{},"ca\u002F",[594,1359,1360],{},"Kraft's own certificate authority (CA) for sandboxes: its certificate, its key, and the certificates it signed",[594,1362,1363,1365,1366,1368,1369,1372],{},[549,1364,976],{},"; the key is ",[549,1367,969],{},", the certificates ",[549,1370,1371],{},"0666"," less your umask",[573,1374,1375,1380,1383],{},[594,1376,1377],{},[549,1378,1379],{},"kit\u002F",[594,1381,1382],{},"Each Kit's descriptor as fetched",[594,1384,1385],{},[549,1386,1142],{},[573,1388,1389,1394,1397],{},[594,1390,1391],{},[549,1392,1393],{},"sandbox-ca\u002F",[594,1395,1396],{},"The combined CA bundles for sandboxed containers, one set per image",[594,1398,1399,1401],{},[549,1400,1142],{}," for each bundle",[573,1403,1404,1409,1412],{},[594,1405,1406],{},[549,1407,1408],{},"sandbox-git\u002F",[594,1410,1411],{},"A private copy of the refs for each sandboxed worktree, so a worker cannot move another branch",[594,1413],{},[573,1415,1416,1421,1424],{},[594,1417,1418],{},[549,1419,1420],{},"sandbox-home\u002F\u003Cwork item id>\u002F",[594,1422,1423],{},"The home directory a sandboxed item's containers share, kept across its sessions",[594,1425],{},[573,1427,1428,1433,1436],{},[594,1429,1430],{},[549,1431,1432],{},"set-aside\u002F",[594,1434,1435],{},"Setup lockfiles kept aside while a rebase runs, one directory per worktree",[594,1437,1438,1439,1441],{},"The directory is ",[549,1440,976],{},"; the files keep their own modes",[573,1443,1444,1449,1452],{},[594,1445,1446],{},[549,1447,1448],{},"sandbox-client\u002F",[594,1450,1451],{},"A working directory for each running sandboxed session, removed when it ends",[594,1453],{},[979,1455,1457],{"id":1456},"repo-environment-values","Repo environment values",[526,1459,1460,1461,1463,1464,1467,1468,1471],{},"A repo's ",[549,1462,1036],{}," values go into each worker's process environment, not onto\nits command line. Your own user and root can read them there, for example\nwith ",[549,1465,1466],{},"ps eww"," on macOS or from ",[549,1469,1470],{},"\u002Fproc\u002F\u003Cpid>\u002Fenviron"," on Linux. Every agent\nrunning for that repo can read them too.",[530,1473,1475],{"id":1474},"related","Related",[862,1477,1478,1483,1490,1497],{},[865,1479,1480,1482],{},[541,1481,493],{"href":494},": the default posture and the threat model.",[865,1484,1485,1489],{},[541,1486,1488],{"href":1487},"\u002Fproject\u002Fsecurity#the-bearer-token","The bearer token",": what it grants.",[865,1491,1492,1496],{},[541,1493,1495],{"href":1494},"\u002Fguides\u002Frun\u002Fremote-access#rotate-the-token","Rotate the token",": how to replace the bearer token or the trigger token.",[865,1498,1499,1502],{},[541,1500,509],{"href":1501},"\u002Fproject\u002Farchitecture#state-on-disk",": how the stores fit together.",{"title":1504,"searchDepth":1505,"depth":1505,"links":1506},"",2,[1507,1508,1509,1515],{"id":532,"depth":1505,"text":533},{"id":561,"depth":1505,"text":562},{"id":954,"depth":1505,"text":955,"children":1510},[1511,1513,1514],{"id":981,"depth":1512,"text":982},3,{"id":1063,"depth":1512,"text":1064},{"id":1456,"depth":1512,"text":1457},{"id":1474,"depth":1505,"text":1475},"What leaves your machine, where it goes, how to turn it off, and where Kraft keeps secrets and state.","md",null,{},true,{"title":497,"description":1516},"04bv_F5kzBtU6rDbFx5kH3Jy1W9Fe_1_BhnB1DNg_KM",[1524,1526],{"title":493,"path":494,"stem":495,"description":1525,"children":-1},"What Kraft does on your machine, the few settings that make it safe to run, and the threat model behind them: what it protects against and what it does not.",{"title":501,"path":502,"stem":503,"description":1527,"children":-1},"What to do before you upgrade from 1.4, and what Kraft 2.0 brings, from a new interface and code-host review to a repo connect that reads more of the repo and safer sharing.",1791801169580]