@b00dea/cockpit 0.0.0-stage → 0.1.0

package/docs/configuration-reference.md

@@ -0,0 +1,621 @@
+# Configuration reference
+
+<!-- Generated by `npm run references`; edit its sources, not this file. -->
+
+This generated reference is for users authoring or reviewing `cockpit.toml`. It is generated from the schema cockpit validates against, so it matches this version. For the handful of tables a typical cockpit sets, start with [Configuration essentials](configuration-essentials.md).
+
+The same schema ships as JSON Schema in [`cockpit.schema.json`](https://github.com/b0dea/cockpit/blob/main/packages/cockpit/cockpit.schema.json), installed at `node_modules/@b00dea/cockpit/cockpit.schema.json`; point an editor at it for completion and validation as you type.
+
+## Defaults
+
+The values cockpit uses for a key the configuration leaves out.
+
+```json
+{
+  "cockpit": {
+    "siblings_root": "..",
+    "guide_cap": 200
+  },
+  "sibling": {
+    "toolchain": "none",
+    "guides": [
+      "CLAUDE.md",
+      "AGENTS.md"
+    ],
+    "instruction_pointer": false
+  },
+  "ports": {
+    "step": 100,
+    "count": 27
+  },
+  "guards": {
+    "hosted_db_hosts": [],
+    "vendor_endpoint_hosts": [],
+    "protected_branches": [
+      "main",
+      "master"
+    ],
+    "allow": [],
+    "deny": []
+  },
+  "mcp": {
+    "approved": {}
+  },
+  "work": {
+    "grading": "independent",
+    "attempt_cap": 2,
+    "wip_cap": 3,
+    "verification_timeout_seconds": 1800,
+    "evaluator_timeout_seconds": 900,
+    "gates": {}
+  },
+  "autonomy": {},
+  "environment": {
+    "resettable_volumes": [],
+    "generated_host_paths": [],
+    "compose_files": [],
+    "entrypoint_derivatives": [],
+    "install_policies": []
+  },
+  "surfaces": {
+    "tools": [
+      "claudecode",
+      "codexcli",
+      "opencode"
+    ],
+    "overlays": [],
+    "harnesses": [],
+    "bundles": [],
+    "adopted": []
+  }
+}
+```
+
+## Tables
+
+Each section is one TOML table: `[name]` holds one, `[[name]]` repeats. A table accepts only the keys it lists unless its rules below say otherwise. Rules are JSON Schema fragments that relate several keys of the same table. A pattern is a regular expression the value must contain a match for; `^` and `$` in it make it cover the whole value. A type that links to a shape is a table whose keys are listed once, under [Shapes](#shapes).
+
+### Top-level keys
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `unconfirmed` | Answers no person has stated yet; init writes them and doctor reports them. | array of string |  | 1–11 items; each item: one of `"cockpit.name"`, `"sibling"`, `"estate.runnable"`, `"ports.bases"`, `"environment.install_policies"`, `"environment.test_data"`, `"environment.compose_files"`, `"environment.machine"`, `"environment.posture"`, `"testing"`, `"guards"` |
+| `cockpit` | Identity and layout of this cockpit. | table: [`[cockpit]`](#cockpit) |  | required |
+| `sibling` | Product repositories the cockpit works across. | array of table: [`[[sibling]]`](#sibling) |  | required; at least 1 item |
+| `ports` | Port leasing for running stacks side by side. | table: [`[ports]`](#ports) |  | required |
+| `guards` | Rules that restrict what agents may run. | table: [`[guards]`](#guards) | `{}` |  |
+| `mcp` | Approval of MCP servers. | table: [`[mcp]`](#mcp) | `{}` |  |
+| `work` | How work orders are accepted, graded and closed. | table: [`[work]`](#work) | `{}` |  |
+| `autonomy` | Which decisions an agent may take without a person. | table: [`[autonomy]`](#autonomy) | `{}` |  |
+| `browser` | Browser automation for the stack. | table: [`[browser]`](#browser) |  |  |
+| `testing` | Test stages and gates. | table: [`[testing]`](#testing) |  |  |
+| `environment` | How the stack is reached, signed in to, built and kept. | table: [`[environment]`](#environment) | `{}` |  |
+| `surfaces` | Instructions, skills and settings generated for agent tools. | table: [`[surfaces]`](#surfaces) | `{}` |  |
+
+### `[cockpit]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `name` | Name of this cockpit. | string |  | required; pattern `^[a-z0-9][a-z0-9-]*$` |
+| `siblings_root` | Directory holding the sibling checkouts, relative to the cockpit. | string | `".."` |  |
+| `guide_cap` | Most lines of always-loaded guidance; preflight fails above it. | integer | `200` | greater than 0; at most 9007199254740991 |
+
+### `[[sibling]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `slug` | Short name of the sibling; also how the root AGENTS.md labels its copied guides. | string |  | required; pattern `^[a-z0-9][a-z0-9-]*$` |
+| `dir` | Checkout directory under the siblings root, or . for the siblings root itself. | string |  | required; either (exactly `"."`) or (pattern [P1](#patterns)) |
+| `remote` | Git remote to clone from; required when acquire is auto or manual and not allowed when none. | string |  | at least 1 character |
+| `branch` | Branch to check out when cloning. | string |  | at least 1 character |
+| `mount` | How the stack uses the checkout: always mounted, mounted under a profile, host only, or not mounted. | string |  | required; either (one of `"always"`, `"host"`, `"none"`) or (pattern `^profile:[a-z0-9-]+$`) |
+| `acquire` | How the checkout reaches disk: cloned by setup, cloned by a person, or not a repository. | string |  | required; one of `"auto"`, `"manual"`, `"none"` |
+| `var` | Name of the exported *_DIR environment variable that points at the checkout. | string |  | required; pattern `^(?!(?:DOCKER_\|COMPOSE_\|LD_\|DYLD_\|LIBPATH$\|SHLIB_PATH$\|NODE_OPTIONS$\|NODE_PATH$\|BASH_ENV$\|ENV$\|PATH$\|IFS$))[A-Z][A-Z0-9_]*$` |
+| `toolchain` | Toolchain that installs and tests the sibling; none for a directory of data. | string | `"none"` | one of `"node"`, `"python"`, `"ruby"`, `"go"`, `"rust"`, `"dotnet"`, `"none"` |
+| `gate` | Set to operator for a lane that touches live data or local hardware; it never runs by default and asks first. | string |  | exactly `"operator"` |
+| `host_reason` | Why the sibling cannot join the stack; required when mount is host. | string |  | at least 1 character |
+| `guides` | Guide files the sibling publishes, copied into the cockpit's root AGENTS.md by sync. | array of string | `["CLAUDE.md","AGENTS.md"]` | each item: pattern [P1](#patterns) |
+| `instruction_pointer` | Let setup add a pointer to the cockpit guide in this sibling, when the command line also approves it. | boolean | `false` |  |
+| `purpose` | What the sibling is for; printed when its checkout is missing. | string |  | required; at least 1 character |
+| `environment_files` | Template and instance environment file pairs the sibling needs. | array of table: [`[[sibling.environment_files]]`](#siblingenvironment_files) |  |  |
+| `derives` | Facts about the sibling that cockpit derives rows or MCP servers from. | table: [`[sibling.derives]`](#siblingderives) |  |  |
+
+- Must match `{"oneOf":[{"properties":{"acquire":{"enum":["none"]}},"not":{"required":["remote"]}},{"properties":{"acquire":{"enum":["auto","manual"]}},"required":["remote"]}]}`.
+- Must match `{"anyOf":[{"properties":{"mount":{"enum":["host"]}},"required":["host_reason"]},{"properties":{"mount":{"not":{"enum":["host"]}}}}]}`.
+- Must match `{"anyOf":[{"properties":{"gate":{"enum":["operator"]}},"required":["gate"]},{"not":{"anyOf":[{"properties":{"mount":{"enum":["host"]}}},{"properties":{"purpose":{"pattern":"\\b(?:[lL][iI][vV][eE]|[pP][rR][oO][dD][uU][cC][tT][iI][oO][nN]|[hH][aA][rR][dD][wW][aA][rR][eE]|[sS][iI][mM][uU][lL][aA][tT][oO][rR])\\b"}}}]}}]}`.
+
+### `[[sibling.environment_files]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `template` | Tracked template file the instance is created from. | string |  | required; pattern [P1](#patterns) |
+| `instance` | Machine-local file created from the template and left out of version control. | string |  | required; pattern [P1](#patterns) |
+
+### `[sibling.derives]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `mcp_sources` | MCP server declaration files this sibling publishes. | array of table: [`[[sibling.derives.mcp_sources]]`](#siblingderivesmcp_sources) |  | required; 1–256 items |
+
+### `[[sibling.derives.mcp_sources]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `path` | JSON file in the sibling with a top-level mcpServers object, as agent tools read from .mcp.json. | string |  | required; pattern [P1](#patterns); at most 4096 characters |
+| `provenance` | Where this MCP source declaration came from. | table: [`provenance` shape](#provenance-shape) |  | required |
+
+### `[ports]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `step` | Offset between consecutive stacks' published ports. | integer | `100` | greater than 0; at most 9007199254740991 |
+| `count` | Number of stacks that can run side by side. | integer | `27` | greater than 0; at most 9007199254740991 |
+| `bases` | Base host port for each port variable; stack n publishes base plus n times step. | table of integer |  | required; each key: pattern `^[A-Z][A-Z0-9_]*$`; each value: 1–65535 |
+
+### `[guards]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `hosted_db_hosts` | Hosted database host names the guards keep agents away from. | array of string | `[]` | at most 128 items; each item: pattern [P3](#patterns) |
+| `vendor_endpoint_hosts` | Real vendor endpoint host names the guards keep agents away from. | array of string | `[]` | at most 128 items; each item: pattern [P3](#patterns) |
+| `protected_branches` | Branches the guards keep agents from pushing to or rewriting. | array of string | `["main","master"]` |  |
+| `allow` | Commands allowed in addition to the built-in rules. | array of table: [`[[guards.allow]]`](#guardsallow) | `[]` | at most 64 items |
+| `deny` | Commands refused in addition to the built-in rules. | array of table, one of: [`[[guards.deny]]` form 1](#guardsdeny-form-1), [`[[guards.deny]]` form 2](#guardsdeny-form-2) | `[]` | at most 64 items |
+
+### `[[guards.allow]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `argv` | Command prefix, as an argument list, that is allowed. | array of string |  | required; 1–32 items; each item: pattern [P4](#patterns) |
+| `reason` | Why the command is allowed. | string |  | required; 1–512 characters; pattern `\S`; pattern `^[^\x00-\x1f\x7f-\x9f]+$` |
+| `cwd` | Allow only when run from this directory, relative to the cockpit. | string |  | either (exactly `"."`) or (pattern [P1](#patterns), at most 4096 characters) |
+
+### `[[guards.deny]]` form 1
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `prefix` | Command prefix, as an argument list, that is refused. | array of string |  | required; 1–32 items; each item: pattern [P4](#patterns) |
+| `reason` | Why the command is refused. | string |  | required; 1–512 characters; pattern `\S`; pattern `^[^\x00-\x1f\x7f-\x9f]+$` |
+| `fix` | Safer command or step to suggest instead. | string |  | 1–512 characters; pattern `\S`; pattern `^[^\x00-\x1f\x7f-\x9f]+$` |
+
+### `[[guards.deny]]` form 2
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `contains` | Argument sequence that is refused wherever it appears in a command. | array of string |  | required; 1–32 items; each item: pattern [P4](#patterns) |
+| `reason` | Why the command is refused. | string |  | required; 1–512 characters; pattern `\S`; pattern `^[^\x00-\x1f\x7f-\x9f]+$` |
+| `fix` | Safer command or step to suggest instead. | string |  | 1–512 characters; pattern `\S`; pattern `^[^\x00-\x1f\x7f-\x9f]+$` |
+
+### `[mcp]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `approved` | Approved MCP servers, each mapped to the sha256 of the declaration a person reviewed; others stay disabled. | table of string | `{}` | each key: pattern `^(?=[\s\S]{0,128}$)(?:^[a-zA-Z0-9][a-zA-Z0-9_-]*$)`; each value: pattern `^[a-f0-9]{64}$` |
+
+### `[work]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `grading` | How an order earns done: independent (an evaluator grades it), checks (cockpit ran every criterion's check and all passed) or self (the agent reports met or unmet with a note). | string | `"independent"` | one of `"independent"`, `"checks"`, `"self"` |
+| `evaluators` | Agent tools that run the independent grader for work grade and cockpit grade, tried in order: codexcli, claudecode, opencode. Defaults to the tools surfaces.tools lists that can evaluate, in that order, with the tool running the command moved last when it is detected (Claude Code or Codex), so another tool grades first. A list given here is used exactly as written. | array of string |  | 1–3 items; each item: one of `"codexcli"`, `"claudecode"`, `"opencode"` |
+| `attempt_cap` | Failed checks or grades before an order is blocked; may be lowered but not raised. | integer | `2` | 1–2 |
+| `wip_cap` | Accepted orders that may be unfinished at once; may be lowered but not raised. | integer | `3` | 1–3 |
+| `verification_timeout_seconds` | Seconds one criterion's check command may run before it is stopped and reported as not run. | integer | `1800` | 1–7200 |
+| `evaluator_timeout_seconds` | Seconds one independent grading run may take before it is stopped. | integer | `900` | 1–7200 |
+| `gates` | Who passes each work-order decision. | table: [`[work.gates]`](#workgates) | `{}` |  |
+
+### `[work.gates]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `accept` | Who accepts a draft work order: agent, person or ci. Default agent. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `amend` | Who accepts a changed contract. Default agent. Removing or rewriting an accepted criterion always needs a person or ci. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `answer` | Who answers an open question on an order. Default agent. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `signoff` | Who closes a graded order. Default agent. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+
+### `[autonomy]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `sync` | Who may run a sync that writes: agent, person or ci. Default agent. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `stale_delete` | Who approves sync deleting files cockpit generated before and no longer generates. Default agent. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `reset` | Who may apply a reset, which deletes stack data. Default person. | string |  | one of `"agent"`, `"person"`, `"ci"` |
+| `mcp_approve` | Who approves a declared MCP server: person records each digest in [mcp.approved]; agent lets sync enable every declared server as declared, so an agent that writes a sibling MCP source starts that process outside the guard. Default person. | string |  | one of `"agent"`, `"person"` |
+
+### `[browser]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `engine` | Browser engine to drive. | string | `"chromium"` | one of `"chromium"`, `"firefox"`, `"webkit"` |
+| `network_exposure` | Network rules the browser may reach beyond loopback; the default is loopback only. | string | `"<loopback>"` | pattern `^[a-z0-9.*:<>\[\],-]+$`; 1–512 characters |
+| `network_exposure_reason` | Why the browser needs wider network access; required when network_exposure is wider than loopback. | string |  | 1–512 characters |
+| `harnesses` | Agent tools, with versions, that are wired to the browser. | array of table: [`[[browser.harnesses]]`](#browserharnesses) |  | required; 1–3 items; unique items |
+| `images` | Pinned container images for the browser. | table: [`[browser.images]`](#browserimages) |  | required |
+| `project` | Node project the browser commands load their Playwright driver from. | table: [`[browser.project]`](#browserproject) |  | required |
+| `endpoint` | WebSocket address of the browser server, using an allowed loopback host. | string |  | format `uri` |
+| `max_clients` | Most browser clients that may connect at once. | integer |  | required; 1–64 |
+| `proxy` | Proxy the browser reaches the application through. | table: [`[browser.proxy]`](#browserproxy) |  | required |
+| `resolver` | Fixed host name to address mappings the browser uses. | array of table: [`[[browser.resolver]]`](#browserresolver) | `[]` | at most 64 items |
+| `authentication` | How browser sessions sign in to the application. | table: [`[browser.authentication]`](#browserauthentication) |  | required |
+| `data` | Statement about the data the browser touches; cockpit cannot observe it. | table: [`[browser.data]`](#browserdata) |  | required |
+| `request_preapproval` | Run browser tools without prompts; allowed only on isolated, non-production, non-restored data. | boolean | `false` |  |
+| `artifacts` | Generated host paths for browser output. | table: [`[browser.artifacts]`](#browserartifacts) |  | required |
+
+- Must match at least one of `[{"properties":{"request_preapproval":{"enum":[false]}}},{"properties":{"data":{"required":["mode","isolated","reaches_production"],"properties":{"mode":{"enum":["empty","seeded"]},"isolated":{"enum":[true]},"reaches_production":{"enum":[false]}}}}}]`.
+
+### `[[browser.harnesses]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `target` | Agent tool the browser is wired to. | string |  | required; one of `"claudecode"`, `"codexcli"`, `"opencode"` |
+| `version` | Version of the agent tool the wiring was checked against. | string |  | required; pattern `^\d+\.\d+\.\d+$` |
+
+### `[browser.images]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `mcp` | Image that serves the browser MCP server. | table: [`[browser.images.mcp]`](#browserimagesmcp) |  | required |
+
+### `[browser.images.mcp]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `reference` | Image reference pinned by sha256 digest. | string |  | required; pattern `^[a-z0-9][a-z0-9./:_-]*@sha256:[a-f0-9]{64}$` |
+| `driver_version` | Playwright driver version the image carries. | string |  | required; pattern [P5](#patterns); at most 128 characters |
+
+### `[browser.project]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `manifest` | package.json for the project; omit to use the one beside the lockfile. | string |  | pattern [P1](#patterns) |
+| `manifest_sha256` | SHA-256 of the manifest; required when manifest is set. | string |  | pattern `^[a-f0-9]{64}$` |
+| `lockfile` | Lockfile that pins the Playwright driver the browser commands load. | string |  | required; pattern [P1](#patterns) |
+| `sha256` | SHA-256 of the lockfile. | string |  | required; pattern `^[a-f0-9]{64}$` |
+| `driver_version` | Playwright driver version the lockfile pins. | string |  | required; pattern [P5](#patterns); at most 128 characters |
+
+### `[browser.proxy]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `host_variable` | Port variable in [ports.bases] that leases the proxy port. | string |  | pattern `^[A-Z][A-Z0-9_]*$`; at most 128 characters |
+| `server_port` | Port the browser server listens on. | integer |  | required; 1–65535 |
+| `proxy_port` | Port the proxy listens on; differs from server_port. | integer |  | required; 1–65535 |
+| `allowed_hosts` | Host and port pairs the proxy allows. | array of string |  | required; 1–64 items; unique items; each item: 1–260 characters |
+| `bind` | Loopback address the proxy binds to. | string | `"127.0.0.1"` | one of `"127.0.0.1"`, `"::1"` |
+
+### `[[browser.resolver]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `hostname` | Host name to resolve. | string |  | required; pattern `^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z][a-z0-9-]*$` |
+| `address` | Address the host name resolves to. | string |  | required; either (format `ipv4`, pattern `^(?:(?:25[0-5]\|2[0-4][0-9]\|1[0-9][0-9]\|[1-9][0-9]\|[0-9])\.){3}(?:25[0-5]\|2[0-4][0-9]\|1[0-9][0-9]\|[1-9][0-9]\|[0-9])$`) or (format `ipv6`, pattern `^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\|([0-9a-fA-F]{1,4}:){1,7}:\|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}\|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}\|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}\|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}\|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}\|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})\|:((:[0-9a-fA-F]{1,4}){1,7}\|:))$`) |
+
+### `[browser.authentication]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `policy` | Whether sessions share no sign-in, take turns on one, or each keep their own. | string |  | required; one of `"none"`, `"serialized"`, `"per-worker"` |
+| `states` | Saved sign-in states, one per worker. | array of table: [`[[browser.authentication.states]]`](#browserauthenticationstates) | `[]` | at most 64 items |
+
+### `[[browser.authentication.states]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `worker` | Name of the worker the state belongs to. | string |  | required; pattern `^[a-z0-9][a-z0-9_-]{0,63}$` |
+| `path` | Saved sign-in state file under the auth artifact root. | string |  | required; pattern [P1](#patterns) |
+
+### `[browser.data]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `mode` | What the data is: empty, seeded by the product, or restored from real data. | string |  | required; one of `"empty"`, `"seeded"`, `"restored"` |
+| `isolated` | True when the data is separate from anyone else's. | boolean |  | required |
+| `reaches_production` | True when browser actions can affect production. | boolean |  | required |
+
+### `[browser.artifacts]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `mcp` | Generated host path for the browser MCP server's files. | string |  | required; pattern [P1](#patterns) |
+| `cli` | Generated host path for command-line browser output. | string |  | required; pattern [P1](#patterns) |
+| `auth` | Generated host path for saved sign-in state. | string |  | required; pattern [P1](#patterns) |
+
+### `[testing]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `stages` | Commands that make up the test gates. | array of table: [`[[testing.stages]]`](#testingstages) |  | required; 1–128 items |
+| `gates` | Named gates that run stages before handing back changes. | array of table: [`[[testing.gates]]`](#testinggates) |  | required; 1–128 items |
+| `native_hooks` | How the repository's own git hooks are handled. | table: [`[testing.native_hooks]`](#testingnative_hooks) | `{"install":"inspect"}` |  |
+| `native_hook_policy` | Policy file for installing the repository's hooks; required for explicit-native. | table: [`[testing.native_hook_policy]`](#testingnative_hook_policy) |  |  |
+
+- Must match exactly one of `[{"properties":{"native_hooks":{"properties":{"install":{"enum":["inspect"]}}}},"not":{"required":["native_hook_policy"]}},{"properties":{"native_hooks":{"properties":{"install":{"enum":["explicit-native"]}},"required":["install"]}},"required":["native_hooks","native_hook_policy"]}]`.
+
+### `[[testing.stages]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `id` | Name of the stage. | string |  | required; pattern `^[a-z][a-z0-9-]{0,63}$` |
+| `command` | Command to run, as an argument list. | array of string |  | required; 1–128 items; each item: 1–4096 characters |
+| `requires_stack` | True when the stage needs the stack running. | boolean |  | required |
+| `timeout_seconds` | Seconds the stage may run before it is stopped and the gate reports DEGRADED. | integer | `1800` | 1–7200 |
+| `select` | Arguments appended to the command when test-run --select names that kind; {value} becomes the selected value. | table: [`[testing.stages.select]`](#testingstagesselect) |  |  |
+
+### `[testing.stages.select]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `spec` | Arguments that select tests by spec; {value} becomes the selection. | array of string |  | 1–32 items; each item: 1–4096 characters |
+| `file` | Arguments that select tests by file; {value} becomes the selection. | array of string |  | 1–32 items; each item: 1–4096 characters |
+| `test` | Arguments that select tests by test name; {value} becomes the selection. | array of string |  | 1–32 items; each item: 1–4096 characters |
+| `route` | Arguments that select tests by route; {value} becomes the selection. | array of string |  | 1–32 items; each item: 1–4096 characters |
+
+### `[[testing.gates]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `id` | Name of the gate. | string |  | required; pattern `^[a-z][a-z0-9-]{0,63}$` |
+| `tier` | Whether the gate covers targeted changes or the full suite. | string |  | required; one of `"targeted"`, `"full"` |
+| `stages` | Stages the gate runs, by id. | array of string |  | required; 1–128 items; each item: pattern `^[a-z][a-z0-9-]{0,63}$` |
+| `changes` | Kind of change that calls for this gate. | string |  | required; 1–4096 characters |
+
+### `[testing.native_hooks]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `install` | Inspect the repository's hooks, or install them as the policy file declares. | string | `"inspect"` | one of `"inspect"`, `"explicit-native"` |
+
+### `[testing.native_hook_policy]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `path` | Policy file, relative to the cockpit. | string |  | required; pattern [P1](#patterns); at most 4096 characters |
+| `sha256` | SHA-256 of the policy file. | string |  | required; pattern `^[a-f0-9]{64}$` |
+
+### `[environment]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `addressing` | How the product is reached locally: by host name or by leased port. | string |  | one of `"hostname"`, `"port"` |
+| `authentication` | How the product signs in locally: real sign-in, bypassed, or none. | string |  | one of `"real"`, `"bypassed"`, `"none"` |
+| `posture_requirements` | Posture facts the product relies on, each tagged with the posture it depends on. | array of table: [`[[environment.posture_requirements]]`](#environmentposture_requirements) |  | 1–128 items |
+| `machine` | Least the container runtime must offer before the stack starts. | table: [`[environment.machine]`](#environmentmachine) |  |  |
+| `resettable_volumes` | Compose volumes that reset may delete and recreate, named by their Compose key. | array of string | `[]` | unique items; each item: pattern `^[a-z0-9][a-z0-9_.-]*$` |
+| `generated_host_paths` | Host paths cockpit generates and owns, relative to the cockpit. | array of string | `[]` | unique items; each item: pattern [P1](#patterns) |
+| `compose_files` | Compose files, relative to the cockpit, that make up the stack; cockpit runs them as written. | array of string | `[]` | unique items; each item: pattern [P1](#patterns), pattern `^[^:]+$` |
+| `entrypoint_derivatives` | Addresses derived from leased ports, such as application origins and callback URLs. | array of table: [`[[environment.entrypoint_derivatives]]`](#environmententrypoint_derivatives) | `[]` |  |
+| `install_policies` | The build and test commands the guard admits for each toolchain and lockfile. | array of table: [`[[environment.install_policies]]`](#environmentinstall_policies) | `[]` |  |
+| `seed` | Command up runs once the stack is healthy, whenever a resettable volume was created since the last successful seed. | table: [`[environment.seed]`](#environmentseed) |  |  |
+
+### `[[environment.posture_requirements]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `requirement` | Name of the posture requirement the product relies on. | string |  | required; pattern `^[a-z][a-z0-9-]*$`; 1–64 characters |
+| `addressing` | Addressing posture this requirement depends on; set at least one of addressing and authentication. | string |  | one of `"hostname"`, `"port"` |
+| `authentication` | Authentication posture this requirement depends on; set at least one of addressing and authentication. | string |  | one of `"real"`, `"bypassed"`, `"none"` |
+
+- Must match at least one of `[{"required":["addressing"]},{"required":["authentication"]}]`.
+
+### `[environment.machine]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `runtime_memory_mb` | Least memory in megabytes the container runtime must offer before the stack starts. | integer |  | required; greater than 0; at most 9007199254740991 |
+| `runtime_cpus` | Least number of CPUs the container runtime must offer before the stack starts. | number |  | required; greater than 0 |
+| `free_disk_mb` | Least free disk space in megabytes the stack needs before it starts. | integer |  | required; greater than 0; at most 9007199254740991 |
+| `cold_start_seconds` | Seconds a first start may take; start fails and reports unhealthy beyond it. At most one hour. | integer |  | required; greater than 0; at most 3600 |
+
+### `[[environment.entrypoint_derivatives]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `name` | Name that identifies this entrypoint in command output. | string |  | required; pattern `^[a-z0-9][a-z0-9-]*$` |
+| `kind` | What the address is used for, such as an application origin or a callback URL. | string |  | required; one of `"entrypoint"`, `"origin"`, `"callback_url"`, `"advertised_listener"`, `"cors_origin"`, `"public_base_url"` |
+| `port` | Port-base variable from [ports.bases] whose leased port this address uses. | string |  | required; pattern `^[A-Z][A-Z0-9_]*$` |
+| `path` | Absolute URL path appended to the origin. | string |  | required; pattern `^\/(?!\/)(?!\.{1,2}(?:\/\|$))(?!.*\/\.{1,2}(?:\/\|$))(?!.*[%\\?#\x00-\x20\x7f]).*$` |
+| `hostname` | Named local URL host, a subdomain of .localhost; omit to use 127.0.0.1. | string |  | pattern `^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+localhost(?![\s\S])`; at most 253 characters |
+| `scheme` | URL scheme, http or https; omit to use http. | string |  | one of `"http"`, `"https"` |
+
+### `[[environment.install_policies]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `toolchain` | Toolchain of the siblings this policy applies to. | string |  | required; one of `"node"`, `"python"`, `"ruby"`, `"go"`, `"rust"`, `"dotnet"` |
+| `lockfile` | Lockfile, relative to the sibling, that selects this policy. | string |  | required; pattern [P1](#patterns) |
+| `build` | Build command, as an argument list, when the product owns one. | array of string |  | 1–32 items; each item: pattern [P4](#patterns) |
+| `test` | Test command, as an argument list, when the product owns one. | array of string |  | 1–32 items; each item: pattern [P4](#patterns) |
+
+### `[environment.seed]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `argv` | Command, as an argument list, that fills the resettable volumes; it runs on the host in the cockpit directory with the leased ports in its environment. | array of string |  | required; 1–256 items; each item: at least 1 character |
+| `timeout_seconds` | Seconds the seed may run before it is stopped. | integer |  | required; 1–3600 |
+
+### `[surfaces]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `tools` | Agent tools whose instructions, skills and settings sync writes and check compares. Defaults to the tools whose guard is measured (claudecode, codexcli, opencode); the other shipped targets are written only when listed. | array of string | `["claudecode","codexcli","opencode"]` | 1–5 items; each item: one of `"claudecode"`, `"codexcli"`, `"opencode"`, `"cursor"`, `"grokcli"` |
+| `overlays` | Team-owned rules, subagents, skills and hooks added to the generated surfaces. | array of table: [`[[surfaces.overlays]]`](#surfacesoverlays) | `[]` | at most 256 items |
+| `harnesses` | Agent tools beyond the shipped ones, with measured capabilities. | array of table: [`[[surfaces.harnesses]]`](#surfacesharnesses) | `[]` | at most 64 items |
+| `bundles` | Bundle formats to publish, such as a Claude plugin bundle. | array of string | `[]` | at most 1 item; each item: exactly `"claudecode-plugin"` |
+| `adopted` | Harness settings files cockpit merges with its own output. | array of table: [`[[surfaces.adopted]]`](#surfacesadopted) | `[]` | at most 3 items |
+
+### `[[surfaces.overlays]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `name` | Name of the declaration; an overlay that reuses a core name replaces it. | string |  | required; pattern `^[a-z0-9][a-z0-9-]*$`; at most 128 characters |
+| `feature` | Kind of surface the overlay provides. | string |  | required; one of `"rules"`, `"subagents"`, `"skills"`, `"hooks"` |
+| `sources` | Files that make up the declaration. | array of table: [`[[surfaces.overlays.sources]]`](#surfacesoverlayssources) |  | required; 1–256 items |
+| `source` | Where the declaration was read from. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `replaces` | Core declaration this overlay replaces; required when the name matches a core one. | table: [`[surfaces.overlays.replaces]`](#surfacesoverlaysreplaces) |  |  |
+
+### `[[surfaces.overlays.sources]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `path` | Path of the source file. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `bytes` | Full text of the source. | string |  | required; at most 65536 characters |
+
+### `[surfaces.overlays.replaces]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `name` | Name of the core declaration being replaced. | string |  | required; pattern `^[a-z0-9][a-z0-9-]*$`; at most 128 characters |
+| `sha256` | SHA-256 of the original core declaration, recorded so a later change to it is reported. | string |  | required; pattern `^[a-f0-9]{64}$` |
+
+### `[[surfaces.harnesses]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `name` | Name of the custom harness; cannot reuse a shipped one. | string |  | required; at most 128 characters; pattern `^[a-z0-9][a-z0-9-]*$`; pattern `^(?!(?:claudecode\|codexcli\|opencode\|cursor\|grokcli)$)` |
+| `capabilities` | One row per surface feature saying what the harness supports. | array of table, one of: [`[[surfaces.harnesses.capabilities]]` form 1](#surfacesharnessescapabilities-form-1), [`[[surfaces.harnesses.capabilities]]` form 2](#surfacesharnessescapabilities-form-2), [`[[surfaces.harnesses.capabilities]]` form 3](#surfacesharnessescapabilities-form-3) |  | required; exactly 6 items |
+
+### `[[surfaces.harnesses.capabilities]]` form 1
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `feature` | Surface feature this row describes. | string |  | required; one of `"rules"`, `"mcp"`, `"subagents"`, `"skills"`, `"hooks"`, `"permissions"` |
+| `measured_on` | Date the capability was measured. | string |  | required; format `date`; pattern [P2](#patterns) |
+| `spelling` | File the harness reads for this feature. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `control` | Path of the deliberately broken control file the capability was measured against. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `mechanism` | Code that emits the surface. | table: [`mechanism` shape](#mechanism-shape) |  | required |
+| `state` | Whether the harness enforces, only instructs, or lacks this capability. | string |  | required; exactly `"enforced"` |
+| `evidence` | Evidence that the harness enforces the capability. | table: [`[surfaces.harnesses.capabilities.evidence]`](#surfacesharnessescapabilitiesevidence) |  | required |
+
+### `[surfaces.harnesses.capabilities.evidence]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `reference` | Probe record or file, relative to the cockpit. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `sha256` | SHA-256 of the evidence. | string |  | required; pattern `^[a-f0-9]{64}$` |
+
+### `[[surfaces.harnesses.capabilities]]` form 2
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `feature` | Surface feature this row describes. | string |  | required; one of `"rules"`, `"mcp"`, `"subagents"`, `"skills"`, `"hooks"`, `"permissions"` |
+| `measured_on` | Date the capability was measured. | string |  | required; format `date`; pattern [P2](#patterns) |
+| `spelling` | File the harness reads for this feature. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `control` | Path of the deliberately broken control file the capability was measured against. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `mechanism` | Code that emits the surface. | table: [`mechanism` shape](#mechanism-shape) |  | required |
+| `state` | Whether the harness enforces, only instructs, or lacks this capability. | string |  | required; exactly `"instructed"` |
+
+### `[[surfaces.harnesses.capabilities]]` form 3
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `feature` | Surface feature this row describes. | string |  | required; one of `"rules"`, `"mcp"`, `"subagents"`, `"skills"`, `"hooks"`, `"permissions"` |
+| `measured_on` | Date the capability was measured. | string |  | required; format `date`; pattern [P2](#patterns) |
+| `state` | Whether the harness enforces, only instructs, or lacks this capability. | string |  | required; exactly `"unavailable"` |
+| `reason` | Why the capability is unavailable. | string |  | required; pattern `\S`; 1–4096 characters |
+
+### `[[surfaces.adopted]]`
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `path` | Harness settings file that was adopted. | string |  | required; one of `".claude/settings.json"`, `".codex/config.toml"`, `".codex/hooks.json"` |
+| `source` | Where the adopted copy now lives, under cockpit/adopted/. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `sha256` | SHA-256 of the bytes that were moved, as a record for review. | string |  | required; pattern `^[a-f0-9]{64}$` |
+| `adopted_on` | Date the file was adopted. | string |  | required; format `date`; pattern [P2](#patterns) |
+| `provenance` | Where the adoption came from; its kind must be declared. | table: [`provenance` shape](#provenance-shape) |  | required |
+
+## Shapes
+
+These tables recur in several places; each place links here instead of repeating the keys.
+
+### `mechanism` shape
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `module` | Module that implements the capability. | string |  | required; pattern [P1](#patterns); pattern [P6](#patterns); at most 4096 characters |
+| `export` | Export of the module that implements the capability. | string |  | required; pattern `^[A-Za-z_$][A-Za-z0-9_$]*$`; at most 128 characters |
+
+### `provenance` shape
+
+| Key | Meaning | Type | Default | Constraints |
+| --- | --- | --- | --- | --- |
+| `source` | File or place the value came from, relative to the repository. | string |  | required; pattern [P1](#patterns); at most 4096 characters |
+| `observed_on` | Date the source was looked at; required unless kind is declared. | string |  | format `date`; pattern [P2](#patterns) |
+| `kind` | How the value was established: declared by this file, measured, or inferred. | string |  | required; one of `"declared"`, `"measured"`, `"inferred"` |
+| `reason` | Why the value is what it is. | string |  | required; pattern `\S`; 1–4096 characters |
+| `confirmed` | Set to true once a person has confirmed an inferred value; inferred values require it. | boolean |  |  |
+
+- Must match at least one of `[{"properties":{"kind":{"enum":["declared"]}}},{"properties":{"kind":{"enum":["measured"]}},"required":["observed_on"]},{"properties":{"kind":{"enum":["inferred"]},"confirmed":{"enum":[true]}},"required":["confirmed","observed_on"]}]`.
+
+## Patterns
+
+Long patterns that several keys share, cited by name in the tables.
+
+| Pattern | Regular expression |
+| --- | --- |
+| P1 | `^(?!\/)(?![A-Za-z][A-Za-z0-9+.-]*:)(?!.*(?:^\|\/)\.{1,2}(?:\/\|$))(?!.*\\)(?:[^/\x00-\x1f\x7f]+\/)*[^/\x00-\x1f\x7f]+$` |
+| P2 | `^(?:(?:\d\d[2468][048]\|\d\d[13579][26]\|\d\d0[48]\|[02468][048]00\|[13579][26]00)-02-29\|\d{4}-(?:(?:0[13578]\|1[02])-(?:0[1-9]\|[12]\d\|3[01])\|(?:0[469]\|11)-(?:0[1-9]\|[12]\d\|30)\|(?:02)-(?:0[1-9]\|1\d\|2[0-8])))$` |
+| P3 | `^(?:\*\.)?(?=[a-z0-9.-]{1,253}(?![\s\S]))[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?![\s\S])` |
+| P4 | `^[^\x00-\x1f\x7f-\x9f\uD800-\uDFFF]{1,128}(?![\s\S])` |
+| P5 | `^(?:0\|[1-9]\d*)\.(?:0\|[1-9]\d*)\.(?:0\|[1-9]\d*)(?:-(?:0\|[1-9]\d*\|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0\|[1-9]\d*\|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$` |
+| P6 | `^(?!.*(?:^\|\/)(?:\.git\|internal\|node_modules)(?:\/\|$)).+$` |
+
+## Checks beyond the schema
+
+cockpit checks these rules when it loads the configuration (`x-cockpit-runtime-checks` in the JSON Schema). An editor validating against the JSON Schema does not report the ones marked in the last column (`x-cockpit-editor-limitations`).
+
+| Path | Rule | Not reported by editors |
+| --- | --- | --- |
+| `sibling[].slug` | `unique` |  |
+| `sibling[].dir` | `unique` |  |
+| `sibling[].var` | `unique` |  |
+| `sibling[].environment_files[].instance` | `unique` | yes |
+| `environment.resettable_volumes[]` | `unique` |  |
+| `environment.resettable_volumes[]` | `declared_compose_volume_key` |  |
+| `environment.generated_host_paths[]` | `unique` |  |
+| `environment.compose_files[]` | `unique` |  |
+| `environment.entrypoint_derivatives[].name` | `unique` | yes |
+| `environment.install_policies[].toolchain+lockfile` | `unique` | yes |
+| `environment.posture_requirements[].requirement` | `unique` | yes |
+| `environment.entrypoint_derivatives[].port` | `declared_in_ports.bases` | yes |
+| `browser.artifacts` | `exact_environment.generated_host_paths_coverage` | yes |
+| `browser` | `matches_environment_addressing_authentication_and_client_cap` | yes |
+| `browser.images` | `mcp_driver_shares_major_minor_with_project_driver` | yes |
+| `testing.gates[].stages[]` | `references_declared_testing_stage` | yes |
+| `sibling[].environment_files[]` | `template_and_instance_differ` | yes |
+| `sibling[].derives.mcp_sources[].path` | `unique_within_sibling` | yes |
+| `environment.seed` | `requires_resettable_volumes` | yes |
+| `ports` | `count_times_base_count_within_shared_input_budget` (limit 4096) |  |
+| `surfaces.overlays[].name` | `unique` | yes |
+| `surfaces.overlays[].sources[].path` | `unique` | yes |
+| `surfaces.overlays[].sources` | `feature_namespace_and_complete_skill_definitions` | yes |
+| `surfaces.overlays[].sources[].bytes` | `utf8_byte_length_at_most_65536` | yes |
+| `surfaces.overlays[].replaces.name` | `matches_declaration_name` | yes |
+| `surfaces.harnesses[].name` | `unique` | yes |
+| `surfaces.harnesses[].capabilities` | `one_row_per_surface_feature` | yes |
+| `surfaces.harnesses[].capabilities[].spelling` | `unique_when_emitted` | yes |
+| `surfaces.adopted[].path` | `unique` | yes |
+| `surfaces.adopted[].source` | `equals_cockpit/adopted/<path>` | yes |
+| `surfaces.adopted[].provenance.kind` | `declared` | yes |
+
+## Skill size limits
+
+Agent tools load every skill's frontmatter into each session and its entry point whenever the skill is used, so cockpit caps both and keeps the detail in a procedure file the agent reads only when it needs it. The limits come from `packages/cockpit/surfaces/skills/collection.json`, SHA-256 `d5ae65d3f69fbb6a33db2e8a63f93b936a37c8c0566cabdc3f248de6018ed7da`.
+
+| Target | Measured as | Limit | Detail moved to |
+| --- | --- | --- | --- |
+| claudecode | frontmatter_bytes | 8192 | each skill's procedure |
+| codexcli | frontmatter_bytes | 8192 | each skill's procedure |
+| opencode | frontmatter_bytes | 8192 | each skill's procedure |
+| cursor | frontmatter_bytes | 8192 | each skill's procedure |
+| grokcli | frontmatter_bytes | 8192 | each skill's procedure |
+
+| Skill entry point | Measured as | Limit | Detail moved to |
+| --- | --- | --- | --- |
+| `packages/cockpit/surfaces/skills/cockpit-setup.skill.md` | lines | 14 | `packages/cockpit/surfaces/skills/procedures/setup.md` |
+| `packages/cockpit/surfaces/skills/cockpit-explain.skill.md` | lines | 7 | `packages/cockpit/surfaces/skills/procedures/explain.md` |
+| `packages/cockpit/surfaces/skills/cockpit-fix.skill.md` | lines | 12 | `packages/cockpit/surfaces/skills/procedures/fix.md` |
+| `packages/cockpit/surfaces/skills/cockpit-work.skill.md` | lines | 9 | `packages/cockpit/surfaces/skills/procedures/work.md` |
+
+Each procedure is read on demand and has no size limit: `packages/cockpit/surfaces/skills/procedures/setup.md` (SHA-256 `0ef32e4d7d2304d5f9b150a59e90edbd825159386d89ee0ea19fe5142c06e366`), `packages/cockpit/surfaces/skills/procedures/explain.md` (SHA-256 `dce839b290d2a584fc5592c895c20425414e9201a4c35c2460ff0539d545f2bb`), `packages/cockpit/surfaces/skills/procedures/fix.md` (SHA-256 `a91365d5a79404d506e95a7d7a64fa50460dfc842265d1040402185767f527af`) and `packages/cockpit/surfaces/skills/procedures/work.md` (SHA-256 `b3e6b8de3a249e73e65f84624c991416933086308073ff979f10632aae988791`).
+
+<!-- cockpit:ref schema=cockpit.guide_cap --> `cockpit.guide_cap` limits always-loaded guidance to 200 lines by default. The measured cost depends on each configuration's sibling guides, so it is not listed here.