[{"data":1,"prerenderedAt":2114},["ShallowReactive",2],{"navigation_docs":3,"-reference-permissions":520,"-reference-permissions-surround":2109},[4,28,51,191,222,485],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,117,138,187],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109,113],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116},"Share chains with add-ons","\u002Fguides\u002Fcustomize\u002Fshare-chains-with-addons","3.guides\u002F2.customize\u002F4.share-chains-with-addons",{"title":118,"path":119,"stem":120,"children":121,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[122,126,130,134],{"title":123,"path":124,"stem":125},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":127,"path":128,"stem":129},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":131,"path":132,"stem":133},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":135,"path":136,"stem":137},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":139,"path":140,"stem":141,"children":142,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[143,147,151,155,159,163,167,171,175,179,183],{"title":144,"path":145,"stem":146},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":148,"path":149,"stem":150},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":152,"path":153,"stem":154},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":156,"path":157,"stem":158},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":160,"path":161,"stem":162},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":164,"path":165,"stem":166},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":168,"path":169,"stem":170},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":172,"path":173,"stem":174},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":176,"path":177,"stem":178},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":180,"path":181,"stem":182},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":184,"path":185,"stem":186},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":188,"path":189,"stem":190},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":192,"path":193,"stem":194,"children":195},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[196,198,202,206,210,214,218],{"title":10,"path":193,"stem":197},"4.troubleshooting\u002Findex",{"title":199,"path":200,"stem":201},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":203,"path":204,"stem":205},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":207,"path":208,"stem":209},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":211,"path":212,"stem":213},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":215,"path":216,"stem":217},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":219,"path":220,"stem":221},"Add-on problems","\u002Ftroubleshooting\u002Faddon-problems","4.troubleshooting\u002F6.addon-problems",{"title":223,"path":224,"stem":225,"children":226},"Reference","\u002Freference","5.reference",[227,229,267,289,293,391,409,435,439,443,477,481],{"title":10,"path":224,"stem":228},"5.reference\u002Findex",{"title":230,"path":231,"stem":232,"children":233},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[234,235,239,243,247,251,255,259,263],{"title":10,"path":231,"stem":232},{"title":236,"path":237,"stem":238},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":240,"path":241,"stem":242},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":244,"path":245,"stem":246},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":248,"path":249,"stem":250},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":252,"path":253,"stem":254},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":256,"path":257,"stem":258},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":260,"path":261,"stem":262},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":264,"path":265,"stem":266},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":268,"path":269,"stem":270,"children":271},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[272,273,277,281,285],{"title":10,"path":269,"stem":270},{"title":274,"path":275,"stem":276},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":278,"path":279,"stem":280},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":282,"path":283,"stem":284},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":286,"path":287,"stem":288},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":290,"path":291,"stem":292},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":294,"path":295,"stem":296,"children":297},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[298,299,317,321,325,329,333,337,341,345,379,383,387],{"title":10,"path":295,"stem":296},{"title":300,"path":301,"stem":302,"children":303},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[304,305,309,313],{"title":10,"path":301,"stem":302},{"title":306,"path":307,"stem":308},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":310,"path":311,"stem":312},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":314,"path":315,"stem":316},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":318,"path":319,"stem":320},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":322,"path":323,"stem":324},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":326,"path":327,"stem":328},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":330,"path":331,"stem":332},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":334,"path":335,"stem":336},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":338,"path":339,"stem":340},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":342,"path":343,"stem":344},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":346,"path":347,"stem":348,"children":349},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[350,351,355,359,363,367,371,375],{"title":10,"path":347,"stem":348},{"title":352,"path":353,"stem":354},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":356,"path":357,"stem":358},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":360,"path":361,"stem":362},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":364,"path":365,"stem":366},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":368,"path":369,"stem":370},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":372,"path":373,"stem":374},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":376,"path":377,"stem":378},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":380,"path":381,"stem":382},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":384,"path":385,"stem":386},"Add-ons and collections","\u002Freference\u002Fconfiguration\u002Faddons","5.reference\u002F03.configuration\u002F12.addons",{"title":388,"path":389,"stem":390},"Repo libraries","\u002Freference\u002Fconfiguration\u002Frepo-libraries","5.reference\u002F03.configuration\u002F13.repo-libraries",{"title":392,"path":393,"stem":394,"children":395},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[396,397,401,405],{"title":10,"path":393,"stem":394},{"title":398,"path":399,"stem":400},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":402,"path":403,"stem":404},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":406,"path":407,"stem":408},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":410,"path":411,"stem":412,"children":413},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[414,415,419,423,427,431],{"title":10,"path":411,"stem":412},{"title":416,"path":417,"stem":418},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":420,"path":421,"stem":422},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":424,"path":425,"stem":426},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":428,"path":429,"stem":430},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":432,"path":433,"stem":434},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":436,"path":437,"stem":438},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":440,"path":441,"stem":442},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":444,"path":445,"stem":446,"children":447},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[448,449,453,457,461,465,469,473],{"title":10,"path":445,"stem":446},{"title":450,"path":451,"stem":452},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":454,"path":455,"stem":456},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":458,"path":459,"stem":460},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":462,"path":463,"stem":464},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":466,"path":467,"stem":468},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":470,"path":471,"stem":472},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":474,"path":475,"stem":476},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":478,"path":479,"stem":480},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":482,"path":483,"stem":484},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":486,"path":487,"stem":488,"children":489},"Security and project","\u002Fproject","6.project",[490,492,496,500,504,508,512,516],{"title":10,"path":487,"stem":491},"6.project\u002Findex",{"title":493,"path":494,"stem":495},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":497,"path":498,"stem":499},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":501,"path":502,"stem":503},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":505,"path":506,"stem":507},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":509,"path":510,"stem":511},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":513,"path":514,"stem":515},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":517,"path":518,"stem":519},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":521,"title":436,"body":522,"description":2102,"extension":2103,"links":2104,"meta":2105,"navigation":2106,"path":437,"seo":2107,"stem":438,"__hash__":2108},"docs\u002F5.reference\u002F06.permissions.md",{"type":523,"value":524,"toc":2068},"minimark",[525,543,570,575,681,697,714,718,737,740,833,840,843,850,857,902,919,930,933,942,947,972,975,1074,1090,1094,1139,1162,1169,1173,1183,1190,1193,1199,1203,1210,1233,1244,1248,1292,1296,1304,1307,1322,1371,1374,1389,1442,1446,1485,1488,1506,1517,1521,1524,1595,1602,1607,1750,1761,1765,1768,1823,1827,1837,1853,1857,1863,1918,1929,1935,1962,1966,1972,1993,1996,2029,2035,2039,2064],[526,527,528,529,534,535,539,540,542],"p",{},"Kraft's permission gate answers a ",[530,531,533],"a",{"href":532},"\u002Fconcepts\u002Fvocabulary#worker","worker","'s tool-permission request from the task's own policy. Each answer, allow or deny and why, lands on the ",[530,536,538],{"href":537},"\u002Fconcepts\u002Fvocabulary#work-item","work item","'s timeline. For the reasoning behind this design, see ",[530,541,44],{"href":45},".",[526,544,545,546,550,551,554,555,558,559,550,561,554,563,565,566,569],{},"The gate enforces whatever ",[547,548,549],"code",{},"allowed_tools",", ",[547,552,553],{},"deny_tools"," and ",[547,556,557],{},"grants"," resolve to at the task's scope. Set them like any other policy field: see the ",[547,560,549],{},[547,562,553],{},[547,564,557],{}," rows in ",[530,567,318],{"href":568},"\u002Freference\u002Fconfiguration\u002Fpolicy#policy-fields"," for how the layers combine.",[571,572,574],"h2",{"id":573},"which-harnesses-reach-the-gate","Which harnesses reach the gate",[576,577,578,594],"table",{},[579,580,581],"thead",{},[582,583,584,588,591],"tr",{},[585,586,587],"th",{},"Harness",[585,589,590],{},"Mechanism",[585,592,593],{},"Reaches the gate",[595,596,597,609,622,635,646,655,669],"tbody",{},[582,598,599,603,606],{},[600,601,602],"td",{},"Claude",[600,604,605],{},"Permission prompt tool",[600,607,608],{},"Yes",[582,610,611,614,620],{},[600,612,613],{},"Cursor",[600,615,616,619],{},[547,617,618],{},"preToolUse"," hook",[600,621,608],{},[582,623,624,627,633],{},[600,625,626],{},"Codex",[600,628,629,632],{},[547,630,631],{},"PreToolUse"," hook, trusted per launch",[600,634,608],{},[582,636,637,640,643],{},[600,638,639],{},"OpenCode",[600,641,642],{},"Rules written at launch",[600,644,645],{},"No",[582,647,648,651,653],{},[600,649,650],{},"Amp",[600,652,642],{},[600,654,645],{},[582,656,657,660,667],{},[600,658,659],{},"Gemini",[600,661,662,663,666],{},"Its most permissive unattended mode (",[547,664,665],{},"--approval-mode yolo",")",[600,668,645],{},[582,670,671,674,679],{},[600,672,673],{},"Antigravity",[600,675,662,676,666],{},[547,677,678],{},"--dangerously-skip-permissions",[600,680,645],{},[526,682,683,684,688,689,692,693,696],{},"A ",[530,685,687],{"href":686},"\u002Fconcepts\u002Fvocabulary#harness","harness"," that reaches the gate also logs a ",[547,690,691],{},"permission_decision"," event for each call it decides, and takes ",[530,694,557],{"href":695},"\u002Fconcepts\u002Fvocabulary#grant",". A harness that does not reach it has neither.",[526,698,699,700,702,703,705,706,710,711,713],{},"Gemini and Antigravity refuse a task with ",[547,701,553],{}," or ",[547,704,549],{},". OpenCode and Amp still enforce those lists through ",[530,707,709],{"href":708},"#opencode-and-amp-rules-written-at-launch","rules written at launch",". ",[530,712,416],{"href":417}," shows the mode each harness runs in.",[571,715,717],{"id":716},"how-the-gate-decides","How the gate decides",[526,719,720,721,550,723,554,725,727,728,732,733,736],{},"The gate answers from the resolved policy of the task the calling session is running: the same ",[547,722,549],{},[547,724,553],{},[547,726,557],{}," its launch resolved. Claude asks in ",[729,730,731],"strong",{},"prompt"," mode. The Cursor and Codex hooks ask in ",[729,734,735],{},"enforce"," mode.",[526,738,739],{},"If the policy cannot be resolved (the task, its harness profile or its agent profile is gone), that decides the call first: Deny, or, for a Cursor or Codex session that is not fail-closed, no opinion. Otherwise the gate checks these rows in order:",[576,741,742,755],{},[579,743,744],{},[582,745,746,749,752],{},[585,747,748],{},"The call",[585,750,751],{},"Prompt mode (Claude)",[585,753,754],{},"Enforce mode (Cursor and Codex hooks)",[595,756,757,774,785,795,807,818],{},[582,758,759,768,771],{},[600,760,761,762,702,765],{},"Cursor only: touches ",[547,763,764],{},".cursor\u002Fhooks.json",[547,766,767],{},".cursor",[600,769,770],{},"Not applicable",[600,772,773],{},"Deny",[582,775,776,781,783],{},[600,777,778,779],{},"Names a tool in ",[547,780,553],{},[600,782,773],{},[600,784,773],{},[582,786,787,790,793],{},[600,788,789],{},"Is an instance of one of the task's grants",[600,791,792],{},"Allow",[600,794,792],{},[582,796,797,802,804],{},[600,798,799,800],{},"No layer set ",[547,801,549],{},[600,803,792],{},[600,805,806],{},"No opinion: the CLI's own classifier or reviewer decides",[582,808,809,814,816],{},[600,810,811,813],{},[547,812,549],{}," is set and names the tool",[600,815,792],{},[600,817,792],{},[582,819,820,829,831],{},[600,821,822,824,825,828],{},[547,823,549],{}," is set and does not name it (",[547,826,827],{},"[]"," names nothing)",[600,830,773],{},[600,832,773],{},[526,834,835,836,839],{},"A deny is a deny on every harness. An allow is not always final. On Cursor, a hook allow does not override ",[547,837,838],{},"--auto-review",", so Cursor's classifier can still refuse a call the gate allowed. Whether a Codex hook allow outranks Codex's reviewer is not guaranteed.",[571,841,602],{"id":842},"claude",[526,844,845,846,849],{},"Kraft launches Claude with its own MCP tool, ",[547,847,848],{},"mcp__kraft__permission_request",", as the permission prompt tool. Claude calls it for any tool call its own classifier does not settle, and Kraft answers from the task's policy.",[526,851,852,853,856],{},"What reaches the gate depends on ",[547,854,855],{},"permission_mode",":",[576,858,859,874],{},[579,860,861],{},[582,862,863,868,871],{},[585,864,865,866],{},"Task's ",[547,867,549],{},[585,869,870],{},"Claude's mode",[585,872,873],{},"What reaches the gate",[595,875,876,889],{},[582,877,878,881,886],{},[600,879,880],{},"Not set",[600,882,883],{},[547,884,885],{},"auto",[600,887,888],{},"Only calls Claude's classifier declines to settle.",[582,890,891,894,899],{},[600,892,893],{},"Set",[600,895,896],{},[547,897,898],{},"manual",[600,900,901],{},"Every call the built-in tool-name allowlist does not cover.",[526,903,904,905,907,908,911,912,915,916,918],{},"Under an ",[547,906,549],{}," list, the launch also passes Claude's ",[547,909,910],{},"--tools"," with the list's built-in tool names. That removes every built-in tool the list does not name. An ",[547,913,914],{},"mcp__"," tool in the list is not passed to ",[547,917,910],{},", because that flag does not govern MCP tools.",[526,920,921,922,925,926,929],{},"Every Claude launch also denies ",[547,923,924],{},"Monitor",", whatever the policy says: it is never legitimate in a one-shot ",[547,927,928],{},"claude -p"," process, because there is no later turn for it to resume into.",[571,931,613],{"id":932},"cursor",[526,934,935,936,938,939,941],{},"Cursor runs a ",[547,937,618],{}," hook before every tool call, ahead of its own ",[547,940,838],{}," classifier.",[943,944,946],"h3",{"id":945},"the-cursor-hook","The Cursor hook",[526,948,949,950,954,955,957,958,961,962,964,965,967,968,971],{},"When a Cursor task's policy has something to enforce, Kraft writes an entry into the ",[530,951,953],{"href":952},"\u002Fconcepts\u002Fvocabulary#worktree","worktree","'s ",[547,956,764],{}," that runs ",[547,959,960],{},"kraft admin permission-hook cursor",". Something to enforce means an ",[547,963,549],{}," list, any ",[547,966,553],{},", or a grant other than ",[547,969,970],{},"git-commit",". With nothing to enforce, Kraft writes no hook.",[526,973,974],{},"The hook sees Cursor's tools under the names your policy uses:",[576,976,977,990],{},[579,978,979],{},[582,980,981,984,987],{},[585,982,983],{},"Cursor's tool",[585,985,986],{},"Checked as",[585,988,989],{},"Note",[595,991,992,1006,1019,1036,1049,1063],{},[582,993,994,999,1004],{},[600,995,996],{},[547,997,998],{},"Shell",[600,1000,1001],{},[547,1002,1003],{},"Bash",[600,1005],{},[582,1007,1008,1013,1017],{},[600,1009,1010],{},[547,1011,1012],{},"Read",[600,1014,1015],{},[547,1016,1012],{},[600,1018],{},[582,1020,1021,1026,1033],{},[600,1022,1023],{},[547,1024,1025],{},"Write",[600,1027,1028,554,1030],{},[547,1029,1025],{},[547,1031,1032],{},"Edit",[600,1034,1035],{},"Cursor creates and edits files with it. Denied if either is denied. Allowed under an allowlist only if both are listed.",[582,1037,1038,1043,1047],{},[600,1039,1040],{},[547,1041,1042],{},"Delete",[600,1044,1045],{},[547,1046,1042],{},[600,1048],{},[582,1050,1051,1056,1060],{},[600,1052,1053],{},[547,1054,1055],{},"Grep",[600,1057,1058],{},[547,1059,1055],{},[600,1061,1062],{},"Also covers Cursor's glob.",[582,1064,1065,1068,1071],{},[600,1066,1067],{},"Web fetch, web search",[600,1069,1070],{},"none",[600,1072,1073],{},"Never reach the hook.",[526,1075,1076,1077,702,1080,1083,1084,1086,1087,1089],{},"Kraft cannot deny a web fetch or web search on Cursor. A Cursor launch whose policy would have to deny one is refused, rather than run with that part of its policy unenforced. That means ",[547,1078,1079],{},"WebFetch",[547,1081,1082],{},"WebSearch"," in ",[547,1085,553],{},", or an ",[547,1088,549],{}," list that does not name both.",[943,1091,1093],{"id":1092},"the-hook-file","The hook file",[1095,1096,1097,1101,1104,1119,1125],"ul",{},[1098,1099,1100],"li",{},"Your repository's own hooks in that file stay. Kraft's entry sits beside them.",[1098,1102,1103],{},"The entry stays for the worktree's life and is the same for every launch.",[1098,1105,1106,1107,1110,1111,1114,1115,1118],{},"The entry runs Kraft's own Python with ",[547,1108,1109],{},"-I",". Its import path then holds neither the worktree nor a ",[547,1112,1113],{},"PYTHONPATH"," from the worker's environment. A file the worker writes into the worktree, such as an ",[547,1116,1117],{},"argcomplete.py",", cannot run in place of Kraft's code and answer the hook.",[1098,1120,1121,1122,1124],{},"If a launch needs the hook and ",[547,1123,764],{}," cannot be read, Kraft refuses the launch and names the file.",[1098,1126,1127,1128,1130,1131,1134,1135,1138],{},"The file never reaches a commit. Kraft excludes an untracked ",[547,1129,764],{}," through one marked line in the repository's ",[547,1132,1133],{},"info\u002Fexclude",", and a tracked one through ",[547,1136,1137],{},"skip-worktree"," in that worktree's index. A skip-worktree file can make a rebase that touches it refuse to run.",[526,1140,1141,1142,702,1144,1146,1147,1149,1150,1152,1153,1155,1156,702,1158,1161],{},"The worker may not change the file. The gate denies a ",[547,1143,1025],{},[547,1145,1042],{}," of ",[547,1148,764],{}," or of ",[547,1151,767],{}," itself, in any letter case or through a symlink in the worktree. It also denies a ",[547,1154,998],{}," command that names ",[547,1157,767],{},[547,1159,1160],{},"hooks.json",", whatever the policy allows.",[1163,1164,1165,1166,1168],"note",{},"This is a check on the call's text: a script can still reach the file. Each launch with policy writes Kraft's entry back, so a worker that removes it works ungated for the rest of its own session at most. If that matters, deny ",[547,1167,998],{}," or leave it off the allowlist.",[943,1170,1172],{"id":1171},"failing-closed","Failing closed",[526,1174,1175,1176,1178,1179,1182],{},"The hook asks the gate in enforce mode. Under an ",[547,1177,549],{}," list, the launch sets ",[547,1180,1181],{},"KRAFT_PERMISSION_FAIL_CLOSED=1"," in the worker's environment, and the hook fails closed: if Kraft is unreachable, the payload is unreadable or the policy cannot be resolved, the call is denied. Without an allowlist, any of those is no opinion, and Cursor's classifier decides as if there were no hook.",[526,1184,1185,1186,1189],{},"Kraft's entry also sets ",[547,1187,1188],{},"failClosed: true",", so a hook that crashes or takes longer than its 10-second timeout denies the call, with or without an allowlist: Cursor would otherwise allow it.",[571,1191,626],{"id":1192},"codex",[526,1194,1195,1196,1198],{},"Codex runs a ",[547,1197,631],{}," hook before each tool call.",[943,1200,1202],{"id":1201},"the-codex-hook","The Codex hook",[526,1204,1205,1206,1209],{},"When a Codex task's policy has something to enforce (the same rule as Cursor), the launch adds three ",[547,1207,1208],{},"-c"," flags, on the resume command line too:",[1095,1211,1212,1221,1227],{},[1098,1213,1214,1217,1218,542],{},[547,1215,1216],{},"hooks.PreToolUse"," runs ",[547,1219,1220],{},"kraft admin permission-hook codex",[1098,1222,1223,1226],{},[547,1224,1225],{},"features.hooks=true"," switches hooks on.",[1098,1228,1229,1232],{},[547,1230,1231],{},"hooks.state"," trusts exactly that hook and marks it enabled.",[526,1234,1235,1236,1239,1240,1243],{},"Kraft never passes ",[547,1237,1238],{},"--dangerously-bypass-hook-trust",", since that also trusts every hook a repository ships. Kraft writes nothing to your ",[547,1241,1242],{},"~\u002F.codex"," or to the worktree. If Codex cannot list the hook, does not trust it, or does not answer within 15 seconds, Kraft refuses the launch.",[943,1245,1247],{"id":1246},"what-the-codex-hook-sees-and-returns","What the Codex hook sees and returns",[1095,1249,1250,1260,1273,1279,1282],{},[1098,1251,1252,1253,1256,1257,1259],{},"The hook also fires for Codex's own background agents. A call whose working directory is inside Codex's home (",[547,1254,1255],{},"$CODEX_HOME",", else ",[547,1258,1242],{},") gets no opinion and never reaches the gate. Every other call is asked, wherever it runs.",[1098,1261,1262,1263,710,1265,1268,1269,554,1271,542],{},"Codex calls its shell ",[547,1264,1003],{},[547,1266,1267],{},"apply_patch",", its one tool for creating and editing files, is checked as both ",[547,1270,1025],{},[547,1272,1032],{},[1098,1274,1275,1276,1278],{},"Web search runs on OpenAI's side and never reaches the hook. A Codex launch whose policy would have to deny ",[547,1277,1082],{}," is refused.",[1098,1280,1281],{},"Fail-closed under an allowlist works as it does for Cursor.",[1098,1283,1284,1285,1288,1289,542],{},"No opinion is ",[547,1286,1287],{},"{}",", which leaves the decision to Codex's own reviewer. A deny blocks the call, and the agent sees ",[547,1290,1291],{},"Command blocked by PreToolUse hook: Kraft: \u003Creason>",[571,1293,1295],{"id":1294},"opencode-and-amp-rules-written-at-launch","OpenCode and Amp: rules written at launch",[526,1297,1298,1299,554,1301,1303],{},"OpenCode and Amp get no per-call hook. Kraft writes the task's ",[547,1300,553],{},[547,1302,549],{}," into the CLI's own permission configuration for that one launch, and the CLI enforces them itself. With neither set, Kraft writes nothing.",[943,1305,639],{"id":1306},"opencode",[526,1308,1309,1310,1313,1314,1317,1318,1321],{},"OpenCode gets the rules as a ",[547,1311,1312],{},"permission"," block in ",[547,1315,1316],{},"OPENCODE_CONFIG_CONTENT",", and runs as ",[547,1319,1320],{},"opencode run --standalone",", because only a standalone run reads that block.",[1095,1323,1324,1339,1361],{},[1098,1325,1326,1327,1330,1331,1334,1335,1338],{},"A denied tool is ",[547,1328,1329],{},"deny","; for ",[547,1332,1333],{},"bash"," it is ",[547,1336,1337],{},"{\"?*\": \"deny\"}",", which keeps the tool listed and still denies every call.",[1098,1340,1341,1342,1345,1346,554,1349,1352,1353,1356,1357,1360],{},"An allowlist is ",[547,1343,1344],{},"\"*\": \"deny\"",", with ",[547,1347,1348],{},"external_directory",[547,1350,1351],{},"doom_loop"," put back to ",[547,1354,1355],{},"ask",", followed by ",[547,1358,1359],{},"allow"," for each listed tool.",[1098,1362,1363,1364,1366,1367,1370],{},"Denying ",[547,1365,1003],{}," also denies ",[547,1368,1369],{},"execute",", OpenCode's code mode.",[943,1372,650],{"id":1373},"amp",[526,1375,1376,1377,1380,1381,1384,1385,1388],{},"Amp gets a settings file of the launch's own, ",[547,1378,1379],{},"$KRAFT_HOME\u002Frun\u002Fharness-config\u002Famp\u002F\u003Csession>.json",", passed with ",[547,1382,1383],{},"--settings-file",". For that run it replaces ",[547,1386,1387],{},"~\u002F.config\u002Famp\u002Fsettings.json",", which Kraft never reads or writes. Your Amp login still works.",[1095,1390,1391,1398,1405,1423,1432],{},[1098,1392,1393,1394,1397],{},"Its ",[547,1395,1396],{},"amp.permissions"," rules come before Amp's built-in ones, and the first match wins.",[1098,1399,1400,1401,1404],{},"A denied tool gets a ",[547,1402,1403],{},"reject"," rule and everything else is left to Amp's built-ins.",[1098,1406,1407,1408,1410,1411,1414,1415,1418,1419,1422],{},"Under an allowlist, each listed tool gets an ",[547,1409,1359],{}," rule and a final ",[547,1412,1413],{},"*"," rule rejects the rest. An allowlisted tool is therefore allowed outright: Amp's own built-in asks (a ",[547,1416,1417],{},"git push",", an ",[547,1420,1421],{},"rm -rf",") no longer apply to it.",[1098,1424,1363,1425,1427,1428,1431],{},[547,1426,1003],{}," rejects ",[547,1429,1430],{},"shell_command"," and its async and legacy forms.",[1098,1433,1434,1435,702,1437,1083,1439,1441],{},"Amp has no read, grep or glob tool of its own. ",[547,1436,1012],{},[547,1438,1055],{},[547,1440,553],{}," refuses an Amp launch, and in an allowlist grants nothing.",[943,1443,1445],{"id":1444},"on-both","On both",[1095,1447,1448,1451,1454,1468,1474],{},[1098,1449,1450],{},"A denied tool name that no tool on that CLI maps to refuses the launch and names the tool.",[1098,1452,1453],{},"An allowlisted name the CLI has no tool for grants nothing. Every tool not listed is denied anyway.",[1098,1455,1456,1457,1460,1461,1463,1464,554,1466,542],{},"A CLI tool that covers two policy names is denied if either is denied, and allowed under an allowlist only if both are listed. This applies to OpenCode's ",[547,1458,1459],{},"edit"," and Amp's ",[547,1462,1267],{},", which each cover ",[547,1465,1032],{},[547,1467,1025],{},[1098,1469,1470,1471,1473],{},"Nothing reaches the gate, so none of this appears as a ",[547,1472,691],{}," on the timeline.",[1098,1475,1476,1477,1480,1481,1484],{},"Grants are not applied. A CLI rule like ",[547,1478,1479],{},"git push *"," would also match ",[547,1482,1483],{},"git push x; rm -rf y",", so Kraft writes no grant.",[571,1486,1487],{"id":557},"Grants",[526,1489,1490,1491,1493,1494,550,1496,702,1499,1502,1503,1505],{},"A grant is a named operation the gate allows a task even outside its ",[547,1492,549],{},": ",[547,1495,970],{},[547,1497,1498],{},"git-rebase",[547,1500,1501],{},"git-push",". It matches a ",[547,1504,1003],{}," call only when the command is exactly one plain git invocation of that subcommand. Otherwise the call falls through to the rest of the decision table.",[526,1507,1508,1509,1512,1513,1516],{},"A grant does not stop git's own hooks. A commit or push under a grant still runs the repository's hooks, including a ",[547,1510,1511],{},"core.hooksPath"," inside the tree (",[547,1514,1515],{},".husky\u002F",", say), which the agent can edit.",[943,1518,1520],{"id":1519},"what-no-grant-covers","What no grant covers",[526,1522,1523],{},"A command is refused as a grant if it has:",[1095,1525,1526,1542,1549,1572],{},[1098,1527,1528,1529,1532,1533,702,1536,1538,1539,1541],{},"a shell operator, substitution, redirection, subshell, brace or glob expansion, backslash, ",[547,1530,1531],{},"!"," or a newline. A commit message with ",[547,1534,1535],{},"$",[547,1537,1531],{}," in it, a multi-line one, or one written through a heredoc is not granted. With no allowlist that leaves it to the CLI's classifier. Under an allowlist without ",[547,1540,1003],{}," it is denied.",[1098,1543,1544,1545,1548],{},"an env prefix, or anything but ",[547,1546,1547],{},"git"," as the first word.",[1098,1550,1551,1552,550,1555,1558,1559,1561,1562,702,1565,710,1568,1571],{},"a git option before the subcommand other than ",[547,1553,1554],{},"--no-pager",[547,1556,1557],{},"-P",", or ",[547,1560,1208],{}," setting ",[547,1563,1564],{},"user.name",[547,1566,1567],{},"user.email",[547,1569,1570],{},"-C"," is refused because it would point git at another repository's config and hooks.",[1098,1573,1574,1575,554,1578,1581,1582,1584,1585,554,1588,1584,1591,1594],{},"an option that runs a command of the caller's choosing: ",[547,1576,1577],{},"--exec",[547,1579,1580],{},"--receive-pack"," on push, ",[547,1583,1577],{},"\u002F",[547,1586,1587],{},"-x",[547,1589,1590],{},"--strategy",[547,1592,1593],{},"-s"," on rebase, and any abbreviation of those long options.",[943,1596,1598,1599,1601],{"id":1597},"what-a-git-push-grant-allows","What a ",[547,1600,1501],{}," grant allows",[526,1603,683,1604,1606],{},[547,1605,1501],{}," grant is further held to one named remote and the work item's own branch.",[576,1608,1609,1619],{},[579,1610,1611],{},[582,1612,1613,1616],{},[585,1614,1615],{},"The push",[585,1617,1618],{},"Granted",[595,1620,1621,1641,1663,1673,1723,1740],{},[582,1622,1623,1639],{},[600,1624,1625,1626,550,1629,1558,1632,1635,1636],{},"Names a plain remote, then at least one refspec. Every refspec updates the item's branch and nothing else: ",[547,1627,1628],{},"\u003Cbranch>",[547,1630,1631],{},"refs\u002Fheads\u002F\u003Cbranch>",[547,1633,1634],{},"\u003Csrc>:"," either of those, such as ",[547,1637,1638],{},"HEAD:\u003Cbranch>",[600,1640,608],{},[582,1642,1643,1661],{},[600,1644,1645,1646,550,1649,554,1651,1654,1655,550,1657,702,1659],{},"Names a remote that is not a plain name: a URL, a path, or a name with characters outside letters, digits, ",[547,1647,1648],{},"_",[547,1650,542],{},[547,1652,1653],{},"-",", or one starting with ",[547,1656,542],{},[547,1658,1648],{},[547,1660,1653],{},[600,1662,645],{},[582,1664,1665,1671],{},[600,1666,1667,1668,1670],{},"Names no refspec, such as a bare ",[547,1669,1417],{},": where it goes depends on git config the gate cannot see",[600,1672,645],{},[582,1674,1675,1721],{},[600,1676,1677,1678,1584,1681,550,1684,550,1687,1690,1691,1694,1695,550,1698,550,1701,550,1704,550,1707,702,1710,1584,1713,1716,1717,1720],{},"Uses ",[547,1679,1680],{},"--delete",[547,1682,1683],{},"-d",[547,1685,1686],{},"--mirror",[547,1688,1689],{},"--all"," (and ",[547,1692,1693],{},"--branches","), ",[547,1696,1697],{},"--prune",[547,1699,1700],{},"--tags",[547,1702,1703],{},"--follow-tags",[547,1705,1706],{},"--recurse-submodules",[547,1708,1709],{},"--repo",[547,1711,1712],{},"-o",[547,1714,1715],{},"--push-option",", or a refspec with an empty ",[547,1718,1719],{},"\u003Csrc>",", which deletes",[600,1722,645],{},[582,1724,1725,1738],{},[600,1726,1727,1728,1584,1731,1734,1735],{},"Uses a plain ",[547,1729,1730],{},"--force",[547,1732,1733],{},"-f"," or a forced ",[547,1736,1737],{},"+refspec",[600,1739,645],{},[582,1741,1742,1747],{},[600,1743,1677,1744],{},[547,1745,1746],{},"--force-with-lease",[600,1748,1749],{},"Yes: an escalation that rebased the branch has to force-push it",[526,1751,1752,1753,1757,1758,542],{},"An ",[530,1754,1756],{"href":1755},"\u002Fconcepts\u002Fvocabulary#escalation-turn","escalation turn"," is told the command: ",[547,1759,1760],{},"git push --force-with-lease origin HEAD:\u003Cbranch>",[943,1762,1764],{"id":1763},"where-a-grant-takes-effect","Where a grant takes effect",[526,1766,1767],{},"A grant is the gate's decision, a logged allow on the item's timeline. Whether the CLI then runs the call is the CLI's own business.",[576,1769,1770,1779],{},[579,1771,1772],{},[582,1773,1774,1776],{},[585,1775,587],{},[585,1777,1778],{},"Limit",[595,1780,1781,1791,1799,1815],{},[582,1782,1783,1785],{},[600,1784,613],{},[600,1786,1787,1788,1790],{},"A hook allow does not override ",[547,1789,838],{},", so the classifier can still refuse a granted call.",[582,1792,1793,1796],{},[600,1794,1795],{},"Claude, no allowlist",[600,1797,1798],{},"The gate already allows every tool, so a grant adds nothing.",[582,1800,1801,1806],{},[600,1802,1803,1804],{},"Claude, allowlist without ",[547,1805,1003],{},[600,1807,1808,1809,1811,1812,1814],{},"Claude launches without a ",[547,1810,1003],{}," tool at all, so a granted ",[547,1813,1417],{}," never reaches the gate.",[582,1816,1817,1820],{},[600,1818,1819],{},"OpenCode, Amp",[600,1821,1822],{},"Grants are not applied.",[943,1824,1826],{"id":1825},"how-grants-combine","How grants combine",[526,1828,1829,1830,1833,1834,1836],{},"Grants accumulate down the layers (repository ",[547,1831,1832],{},"policy:",", chain, node, step, task), as ",[547,1835,553],{}," does. A workspace grants only what every repository in it grants. A work item's own override, and a retry's, can drop a grant but never add one.",[526,1838,1839,1840,1843,1844,1846,1847,1849,1850,1852],{},"An escalation turn holds its node's grants plus ",[547,1841,1842],{},"defaults.escalation_grants"," from ",[547,1845,318],{},". Unset, that is all three grants. Set it to a shorter list, or ",[547,1848,827],{},", to grant escalations less. A gate's reviewer gets no such default. A chain task's ",[547,1851,970],{}," already comes with its launch.",[571,1854,1856],{"id":1855},"under-a-sandbox","Under a sandbox",[526,1858,683,1859,1862],{},[530,1860,1861],{"href":347},"sandbox"," changes how a harness reaches the gate:",[576,1864,1865,1883],{},[579,1866,1867],{},[582,1868,1869,1871,1877],{},[585,1870,587],{},[585,1872,1873,1874],{},"With ",[547,1875,1876],{},"network:",[585,1878,1873,1879,1882],{},[547,1880,1881],{},"unrestricted_network: true"," instead",[595,1884,1885,1899,1909],{},[582,1886,1887,1889,1896],{},[600,1888,602],{},[600,1890,1891,1892,1895],{},"Kraft launches it with its own MCP server at ",[547,1893,1894],{},"http:\u002F\u002Fkraft\u002Fmcp"," and no other. That server answers the permission tool for that session alone.",[600,1897,1898],{},"Kraft refuses the task whatever its policy: the permission tool would be missing and the CLI exits at start.",[582,1900,1901,1903,1906],{},[600,1902,626],{},[600,1904,1905],{},"The hook reaches Kraft through the sandbox's own route out, as below.",[600,1907,1908],{},"Kraft refuses a task with something to enforce, and the refusal says so: there is no route to Kraft.",[582,1910,1911,1913,1916],{},[600,1912,613],{},[600,1914,1915],{},"Kraft refuses the task: Cursor ignores a proxy.",[600,1917,1908],{},[526,1919,1920,1921,1923,1924,1926,1927,542],{},"A sandbox with neither ",[547,1922,1876],{}," nor ",[547,1925,1881],{}," is refused for every harness. See ",[530,1928,356],{"href":357},[943,1930,1932,1933],{"id":1931},"the-codex-hook-under-network","The Codex hook under ",[547,1934,1876],{},[1095,1936,1937,1947,1950,1956,1959],{},[1098,1938,1939,1940,1943,1944,542],{},"The hook's command is Kraft's ",[547,1941,1942],{},"kraft"," shim, mounted read-only in every such container at ",[547,1945,1946],{},"\u002Fopt\u002Fkraft\u002Fbin",[1098,1948,1949],{},"The shim asks the permission gate in the Kraft server as that session, and denies the call whenever it gets no answer.",[1098,1951,1952,1953,1955],{},"Kraft trusts the hook by the hash the image's own ",[547,1954,1192],{}," gives, asked in a short container with no network.",[1098,1957,1958],{},"Codex skips an untrusted hook without a word and runs the call, so Kraft refuses a task whose image cannot vouch for the hook.",[1098,1960,1961],{},"The launch also switches hooks on and marks Kraft's enabled, so a Codex config a worker writes into its home directory cannot turn the hook off.",[571,1963,1965],{"id":1964},"reading-decisions","Reading decisions",[526,1967,1968,1969,1971],{},"Kraft appends every decision to the work item's timeline as a ",[547,1970,691],{}," event. The event carries:",[1095,1973,1974,1977,1980,1983],{},[1098,1975,1976],{},"the tool name, and the session and node it came from;",[1098,1978,1979],{},"the decision and the reason;",[1098,1981,1982],{},"the grant that allowed it, if one did;",[1098,1984,1985,1986,550,1989,1992],{},"for a hook, the harness and the CLI's own tool name (",[547,1987,1988],{},"harness: cursor",[547,1990,1991],{},"cli_tool: Shell",").",[526,1994,1995],{},"No opinion is not a decision, so an enforce-mode call left to Cursor's classifier logs nothing. Read the events with:",[1997,1998,2002],"pre",{"className":1999,"code":2000,"language":1333,"meta":2001,"style":2001},"language-bash shiki shiki-themes github-light-high-contrast github-light-high-contrast github-dark-high-contrast","kraft view events ID --type permission_decision\n","",[547,2003,2004],{"__ignoreMap":2001},[2005,2006,2009,2012,2016,2019,2022,2026],"span",{"class":2007,"line":2008},"line",1,[2005,2010,1942],{"class":2011},"szw1H",[2005,2013,2015],{"class":2014},"semJd"," view",[2005,2017,2018],{"class":2014}," events",[2005,2020,2021],{"class":2014}," ID",[2005,2023,2025],{"class":2024},"ssYy9"," --type",[2005,2027,2028],{"class":2014}," permission_decision\n",[526,2030,2031,2032,2034],{},"Add ",[547,2033,1733],{}," to watch a live item.",[571,2036,2038],{"id":2037},"related","Related",[1095,2040,2041,2046,2051],{},[1098,2042,2043,2045],{},[530,2044,44],{"href":45},": the reasoning behind the gate.",[1098,2047,2048,2050],{},[530,2049,416],{"href":417},": the mode each harness runs in, and where its tool lists go.",[1098,2052,2053,2056,2057,550,2059,554,2061,2063],{},[530,2054,2055],{"href":568},"Policy fields",": where ",[547,2058,549],{},[547,2060,553],{},[547,2062,557],{}," are set.",[2065,2066,2067],"style",{},"html pre.shiki code .szw1H, html code.shiki .szw1H{--shiki-light:#702C00;--shiki-default:#702C00;--shiki-dark:#FFB757}html pre.shiki code .semJd, html code.shiki .semJd{--shiki-light:#032563;--shiki-default:#032563;--shiki-dark:#ADDCFF}html pre.shiki code .ssYy9, html code.shiki .ssYy9{--shiki-light:#023B95;--shiki-default:#023B95;--shiki-dark:#91CBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":2001,"searchDepth":2069,"depth":2069,"links":2070},2,[2071,2072,2073,2074,2080,2084,2089,2096,2100,2101],{"id":573,"depth":2069,"text":574},{"id":716,"depth":2069,"text":717},{"id":842,"depth":2069,"text":602},{"id":932,"depth":2069,"text":613,"children":2075},[2076,2078,2079],{"id":945,"depth":2077,"text":946},3,{"id":1092,"depth":2077,"text":1093},{"id":1171,"depth":2077,"text":1172},{"id":1192,"depth":2069,"text":626,"children":2081},[2082,2083],{"id":1201,"depth":2077,"text":1202},{"id":1246,"depth":2077,"text":1247},{"id":1294,"depth":2069,"text":1295,"children":2085},[2086,2087,2088],{"id":1306,"depth":2077,"text":639},{"id":1373,"depth":2077,"text":650},{"id":1444,"depth":2077,"text":1445},{"id":557,"depth":2069,"text":1487,"children":2090},[2091,2092,2094,2095],{"id":1519,"depth":2077,"text":1520},{"id":1597,"depth":2077,"text":2093},"What a git-​push grant allows",{"id":1763,"depth":2077,"text":1764},{"id":1825,"depth":2077,"text":1826},{"id":1855,"depth":2069,"text":1856,"children":2097},[2098],{"id":1931,"depth":2077,"text":2099},"The Codex hook under network:",{"id":1964,"depth":2069,"text":1965},{"id":2037,"depth":2069,"text":2038},"What Kraft's permission gate does per harness, how it decides, and the keys that configure it.","md",null,{},true,{"title":436,"description":2102},"T8152c1GQcnyJyVhjiOH458cML3YZr_Ttu6arr-IXOM",[2110,2112],{"title":432,"path":433,"stem":434,"description":2111,"children":-1},"Which harnesses report no dollar cost, how Kraft estimates what their sessions cost, and which caps still bound a session it cannot price.",{"title":440,"path":441,"stem":442,"description":2113,"children":-1},"The schedule fields in intake.yaml and the POST \u002Fapi\u002Ftriggers contract for starting a chain from a cron or a webhook.",1791801168477]