# Open Agent Primitives

> Open-source building blocks for running enterprise AI agents in your own Kubernetes cluster, on the models you choose. OAP checks every action before it runs.

Every page below is the Markdown rendition of a docs page; drop the .md for the HTML. The whole docs set as one file: https://openap.org/llms-full.txt

## Guides

- [Get started: What is OAP?](https://openap.org/docs/what-is-oap.md): Open Agent Primitives — a secure way to run enterprise AI agents, composed from basic building blocks and run in your own Kubernetes cluster on the models you choose.
- [Get started: Install — overview](https://openap.org/docs/install-overview.md): The two install commands, the prerequisites, and what gets stood up.
- [Get started: Installing with oap init](https://openap.org/docs/install-init.md): The one-command bring-up, step by step: build the images, install the platform, seed authorization, health-check, and walk through first-run setup.
- [Get started: Install on Desktop (macOS)](https://openap.org/docs/install-desktop.md): Run the whole OAP stack locally on an Apple-Silicon Mac from a menubar app — no Kubernetes to manage.
- [Get started: Install on a cluster](https://openap.org/docs/install-cluster.md): Installing OAP onto a Kubernetes cluster — local for dev, or a managed cloud for production.
- [Get started: Your first agent](https://openap.org/docs/quickstart.md): Install an agent from a bundle, answer what it asks, and talk to it.
- [Agent builder: The agent builder](https://openap.org/docs/agent-builder.md): An agent that builds agents: describe what you want in a conversation, watch it take shape on a page, test it live, and hand the finished draft to an admin to install.
- [Agent builder: Turn on the agent builder](https://openap.org/docs/agent-builder-install.md): One install flag names who may start the builder. Desktop and oap init clusters add it with a second oap install.
- [Agent builder: Your first custom agent](https://openap.org/docs/agent-builder-first-agent.md): Build an agent by talking to the builder: one description, a few questions, one approval per stage, a live test, and a draft you keep.
- [Agent builder: Testing, delivery, and install](https://openap.org/docs/agent-builder-deliver.md): What the test card tells you, what the saved draft is, and how an admin turns a request into a running agent.
- [Agent builder: Workshops and limits](https://openap.org/docs/agent-builder-workshops.md): Every build runs in its own workshop. A person may keep a few open; a finished one releases itself; a builder can close the others for you.
- [Example agents: codebot](https://openap.org/docs/codebot.md): A passthrough coding agent that plans, gets one scoped approval, and opens a pull request as the person who asked.
- [Example agents: hubspot-companies](https://openap.org/docs/hubspot-companies.md): A read-only HubSpot CRM reporter: a scheduled company digest, with private contacts gated behind the owner of the data.
- [Example agents: reviewbot](https://openap.org/docs/reviewbot.md): An automated pull-request reviewer: triggered by a webhook, read-only by construction, concluded as a GitHub Check Run.
- [Example agents: pm-bot](https://openap.org/docs/pm-bot.md): A read-only product-manager agent that reports how GitHub and Linear work in flight aligns with product goals.
- [Example agents: Agent Builder](https://openap.org/docs/example-agent-builder.md): One build in the real web UI: describe an agent, answer its questions, approve the stage, test it live, and keep the draft.
- [Concepts: Agent definition](https://openap.org/docs/agent-definition.md): An agent is two things: a reviewable template (AgentClass) and a disposable running instance (AgentSession) — not a process.
- [Concepts: Safe tools](https://openap.org/docs/safe-tools.md): An agent can only do what was written down: sandboxed CLI tools and MCP servers, validated against a toolspec and run without a shell.
- [Concepts: Identity & credentials](https://openap.org/docs/identity.md): An agent acts as itself or on a user's behalf, with named credentials resolved by need — a valet key, not the keyring.
- [Concepts: Authorization](https://openap.org/docs/authorization.md): Every action is checked against a SpiceDB graph: can this subject do this, to this resource, right now?
- [Concepts: Channels & continuity](https://openap.org/docs/channels.md): Agents are reached where teams already work; threads continue and approvals live in-channel.
- [Concepts: Memory & knowledge](https://openap.org/docs/memory.md): An agent remembers within reason: an authorized, searchable store with a knowledge-graph layer.
- [Concepts: Artifacts](https://openap.org/docs/artifacts.md): Durable, versioned agent outputs — stored, revised in place, annotated, rendered inert, and delivered as first-class deliverables.
- [Concepts: The life of a session](https://openap.org/docs/session-lifecycle.md): A session is born scoped, runs in turns, waits when it must, sleeps when idle, and ends accountably — each state governed and observable, not an opaque process.
- [Concepts: Subagents & delegation](https://openap.org/docs/subagents-delegation.md): An agent can hand work to other agents — but only to a closed, reviewed roster, within a bounded tree, and never past the people the data belongs to.
- [Concepts: Settings & tiered configuration](https://openap.org/docs/settings-config.md): Operational limits and defaults resolve through tiers — cluster, namespace, agent — where a cluster ceiling can clamp what a class is allowed to loosen.
- [Admin console: The admin dashboard](https://openap.org/docs/admin-dashboard.md): A web console for operating a cluster of agents — live sessions and tool calls, pending approvals, configuration, and the audit trail.
- [Admin console: Live activity](https://openap.org/docs/admin-activity.md): The dashboard's live views — every session in flight, tool calls as they happen, and the approvals waiting on a human.
- [Admin console: Agents, tools & skills](https://openap.org/docs/admin-agents.md): The dashboard's config views for what an agent is made of — the agent classes, the tools they may call, and the skills they can draw on.
- [Admin console: Channels & directory](https://openap.org/docs/admin-connectivity.md): The dashboard's config views for how agents are reached and how the platform learns who belongs to what.
- [Admin console: Identity, users & access](https://openap.org/docs/admin-identity.md): The dashboard's config views for who acts, whose credentials they use, and who is allowed to administer the platform.
- [Admin console: Memory, knowledge & artifacts](https://openap.org/docs/admin-memory.md): The dashboard's read views into what agents have stored and produced — the memory store, the knowledge graph, and rendered artifacts.
- [Admin console: Audit log & budget](https://openap.org/docs/admin-audit.md): The dashboard's accountability views — the cross-session, tamper-evident event log, and estimated spend.
- [Operations: Revocation](https://openap.org/docs/revocation.md): Pull an agent's authority mid-flight — a credential, a grant, a running session — and have it take effect on the very next action, not the next restart.
- [Operations: Health & upgrades](https://openap.org/docs/health-upgrades.md): Check that every platform component is healthy, and upgrade an install by re-running it — the same idempotent apply that stood it up.
- [Security: OWASP Agentic Top 10](https://openap.org/docs/owasp-top10.md): How Open Agent Primitives maps against the OWASP Top 10 for Agentic Applications (2026) — what each primitive addresses, and where the gaps are.

## Reference

- [Agent definition: AgentClass & AgentSession](https://openap.org/docs/agentclass-agentsession.md): The template/instance split, field by field: what an AgentClass declares, what an AgentSession scopes, and the three ways a session starts.
- [Agent definition: The agent loop](https://openap.org/docs/agent-loop.md): How a turn runs — model proposes, tools dispatch through a hook pipeline, results feed back — and where the safety checks sit.
- [Agent definition: Skills](https://openap.org/docs/skills.md): Reusable capabilities an agent can be granted — packaged, sourced from git with provenance, and part of the agent definition.
- [Agent definition: Packaging (.oap bundle)](https://openap.org/docs/packaging-oap.md): Shipping an agent and its whole dependency graph as one signed artifact that declares its secrets and asks what it needs at install.
- [Agent definition: Workspaces](https://openap.org/docs/workspaces.md): A per-session working directory seeded from a declared source — a copy-on-write overlay, so a session gets its own files and can’t disturb the source or another run.
- [Safe tools: Toolspec & validation](https://openap.org/docs/toolspec-validation.md): A tool is a specification, not a function: a deny-by-default allowlist refined with CEL and validated at both authoring and execution time.
- [Safe tools: Sandboxed execution](https://openap.org/docs/sandboxed-execution.md): Tools run in a hardened, isolated pod — non-root, read-only root filesystem, no ambient token — as argv, never a shell.
- [Safe tools: MCP servers & sidecar toolboxes](https://openap.org/docs/mcp-servers.md): Bringing external MCP tools under the same allowlist, validation, and authorization as native ones — remote or as a sidecar.
- [Safe tools: Content guards & egress](https://openap.org/docs/content-guards-egress.md): Inspecting what flows into and out of a tool — prompt-injection detection and URL allowlists on tool I/O.
- [Safe tools: Budgets, rate limits & circuit breakers](https://openap.org/docs/budgets-breakers.md): Default-on circuit breakers, optional rate limits, and per-tool data-volume budgets that keep a misbehaving tool from running away.
- [Safe tools: Supply-chain pinning](https://openap.org/docs/supply-chain-pinning.md): Content-hashing the tools, images, skills, and subagents an agent is allowed to run — so a dependency can't change out from under it.
- [Identity: Identity modes](https://openap.org/docs/identity-modes.md): The four ways an agent sources its tool credentials — agent, userPassthrough, ask, and dynamic.
- [Identity: User-passthrough vs. agent-identity](https://openap.org/docs/passthrough-vs-agent.md): The two ways an agent authenticates: as an operator account it owns, or on the user's behalf with the user's own linked credentials.
- [Identity: Choosing identity per session](https://openap.org/docs/choosing-identity.md): How ask and dynamic present the identity choice at session start — you pick, or the agent suggests and you confirm.
- [Identity: Giving an agent credentials](https://openap.org/docs/giving-credentials.md): How an agent's credentials are described (AgentIdentity), what types exist, and the guided flows that set them up.
- [Identity: Enterprise managed auth](https://openap.org/docs/enterprise-auth.md): Deriving an upstream service token from a user's enterprise identity, instead of asking them to paste one.
- [Identity: Managing your connections](https://openap.org/docs/managing-connections.md): The self-service portal to link, review, and revoke the credentials an agent uses on your behalf.
- [Identity: Identity providers & sign-in](https://openap.org/docs/idp-signin.md): How a human signs in to the platform — a local admin password on Desktop, or a connected OIDC provider on a cluster — and becomes the subject every request is authorized against.
- [Authorization: Multiplayer sessions in Slack](https://openap.org/docs/multiplayer-sessions.md): How more than one person shares a single agent session in a Slack thread — and the two owner gates that keep it safe: who may take part, and which actions run.
- [Authorization: Plan gating & approvals](https://openap.org/docs/plan-gating.md): How an agent proposes a multi-step plan, a human approves it once, and that approval is scoped to exactly the plan — and the exact repo — it named.
- [Authorization: Shared permissions](https://openap.org/docs/shared-permissions.md): How data that belongs to a resource with an owner can only be shared with the owner's approval — and how the request is routed to that owner, not to whoever asked.
- [Authorization: Information leakage & egress](https://openap.org/docs/information-leakage.md): Authorizing data by its audience: the right data reaching the wrong person is a permission question, gated per-datum and routed to the data owner.
- [Channels: Slack](https://openap.org/docs/slack.md): The flagship channel: a wizard that provisions the Slack app, threaded sessions, in-channel approvals, and an App Home hub.
- [Channels: Browser web chat](https://openap.org/docs/browser-chat.md): The built-in chat served by the web daemon at /sessions — the fastest way to talk to an agent with no external setup.
- [Channels: Local terminal](https://openap.org/docs/terminal-chat.md): A full-screen terminal chat (oap agent chat) with a live transcript, inline tool sessions, and approvals — zero external setup.
- [Channels: Continuity & interactions](https://openap.org/docs/continuity-interactions.md): How threads persist across turns, how approvals/notices/status render on every channel kind, and how non-human triggers start sessions.
- [Channels: Triggers: webhooks & schedules](https://openap.org/docs/triggers.md): Not every session starts with a human typing — a signed webhook (a pull request) or a schedule (a cron) can start one, verified and attributed before the agent runs.
- [Memory: Storage, search & the knowledge graph](https://openap.org/docs/memory-storage-search.md): The three-layer memory stack — durable storage, ranked search, and a knowledge-graph layer — and the two kinds of recall.
- [Memory: Facts & observations](https://openap.org/docs/facts-observations.md): Durable knowledge attached to resources — not just a transcript — with a trust grade baked into where each fact came from.
- [Memory: Per-subject authorization](https://openap.org/docs/memory-authorization.md): Memory is gated by the same graph as tools: reads need session membership, writes need the creator, behind an unforgeable capability door.
- [Memory: The tamper-evident audit log](https://openap.org/docs/audit-log.md): The record of what happened is append-only and cryptographically signed — a hash-chained ledger you can verify offline.
- [Artifacts: Revisions & versioning](https://openap.org/docs/artifact-revisions.md): Every change is a new immutable revision; the artifact tracks its history and a moving `latest`, so you can revise in place and still address an exact version.
- [Artifacts: Annotations & tags](https://openap.org/docs/artifact-annotations.md): Two ways to mark up an artifact — annotate what it says (notes that go back to the agent) and label its versions (named tags).
- [Artifacts: Rendered inert](https://openap.org/docs/artifact-safety.md): An artifact is content the agent produced, so it is treated as untrusted: sanitized, constrained with CSP, and served from an isolated origin so its scripts can never run.
- [Artifacts: Delivery & completion](https://openap.org/docs/artifact-delivery.md): Producing an artifact is not the same as delivering it — and a session can be required to actually hand its work over before it completes.
- [CLI: oap CLI reference](https://openap.org/docs/cli-reference.md): Every oap command family, generated from the CLI itself.
- [CLI: oap agent](https://openap.org/docs/oap-agent.md): oap agent: Manage and run AgentClass resources. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap artifact](https://openap.org/docs/oap-artifact.md): oap artifact: Inspect versioned artifacts and their revisions. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap audit](https://openap.org/docs/oap-audit.md): oap audit: Verify the tamper-evident audit log of a session. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap build](https://openap.org/docs/oap-build.md): oap build: Build (and load) Docker images. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap channel](https://openap.org/docs/oap-channel.md): oap channel: Manage Channel CRs (Slack, browser, GitHub webhooks, schedules, ...). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap check](https://openap.org/docs/oap-check.md): oap check: Verify namespace, CRDs, services, and every registered component's health. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap class](https://openap.org/docs/oap-class.md): oap class: Inspect SpiceboxClass resources (sandbox image + capability descriptors). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap clean](https://openap.org/docs/oap-clean.md): oap clean: Remove everything oap installed (CRs → operator → CRDs → namespace). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap desktop](https://openap.org/docs/oap-desktop.md): oap desktop: Run the oap macOS menubar app (local VM + built-in chat; macOS/Apple Silicon only). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap directory](https://openap.org/docs/oap-directory.md): oap directory: Configure directory-sync sources (RelationshipSource): Slack, GitHub, 1Password, ... Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap identity](https://openap.org/docs/oap-identity.md): oap identity: Manage AgentIdentity resources. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap idp](https://openap.org/docs/oap-idp.md): oap idp: Manage the cluster identity provider. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap image](https://openap.org/docs/oap-image.md): oap image: Work with local Docker images and the current cluster. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap init](https://openap.org/docs/oap-init.md): oap init: Bring up agent-primitives end-to-end (build + install + check). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap install](https://openap.org/docs/oap-install.md): oap install: Install the operator + CRDs into the configured cluster. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap kg](https://openap.org/docs/oap-kg.md): oap kg: Query the knowledge graph. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap login](https://openap.org/docs/oap-login.md): oap login: Log in to this cluster's identity provider and cache the assertion. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap logout](https://openap.org/docs/oap-logout.md): oap logout: Remove the cached identity assertion. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap memory](https://openap.org/docs/oap-memory.md): oap memory: Inspect and manage session memory entries. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap pin](https://openap.org/docs/oap-pin.md): oap pin: Inspect and update dependency pin baselines. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap plangate](https://openap.org/docs/oap-plangate.md): oap plangate: Inspect what the plan gate recorded for a session. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap platform](https://openap.org/docs/oap-platform.md): oap platform: Manage platform-level admin access (the admin UI gate). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap preferences](https://openap.org/docs/oap-preferences.md): oap preferences: Inspect a session's resolved per-user preferences. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap sandbox](https://openap.org/docs/oap-sandbox.md): oap sandbox: Inspect SpiceboxSession resources (per-bundle running sandbox pods). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap session](https://openap.org/docs/oap-session.md): oap session: Inspect AgentSession resources. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap settings](https://openap.org/docs/oap-settings.md): oap settings: Manage cluster-wide agent settings (security defaults wizard + apply). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap skill](https://openap.org/docs/oap-skill.md): oap skill: List, view, create, and delete agent Skills and SkillSources. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap spicedb](https://openap.org/docs/oap-spicedb.md): oap spicedb: Apply schema and check permissions against the system SpiceDB. Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap tools](https://openap.org/docs/oap-tools.md): oap tools: Manage tools used by agents (kind-agnostic). Every subcommand, flag, and example, generated from the CLI.
- [CLI: oap user-identity](https://openap.org/docs/oap-user-identity.md): oap user-identity: Manage UserIdentity resources (per-user credential catalogs). Every subcommand, flag, and example, generated from the CLI.
- [CRD reference: CRD reference](https://openap.org/docs/crd-reference.md): Every OAP custom resource, generated from the installed CRD schemas.
- [CRD reference: AgentClass](https://openap.org/docs/crd-agentclass.md): AgentClass is the reviewable template an agent is defined by: model, system prompt, tools, skills, identity, channels, budget and authz policy.
- [CRD reference: AgentIdentity](https://openap.org/docs/crd-agentidentity.md): AgentIdentity is the named credential set an agent acts as: reusable static and OAuth credential descriptors that toolkits and MCP servers request by name.
- [CRD reference: AgentSession](https://openap.org/docs/crd-agentsession.md): AgentSession is one running instance of an AgentClass: a conversation with its own runner Pod, budget, channel bindings and lifecycle phase.
- [CRD reference: AgentSessionGrants](https://openap.org/docs/crd-agentsessiongrants.md): AgentSessionGrants is the per-AgentClass declaration of the (resourceType, permission) pairs that must exist as grant_<perm>_<resType> relations on the SpiceDB…
- [CRD reference: AgentSettings](https://openap.org/docs/crd-agentsettings.md): AgentSettings is the namespace tier of agent governance settings: limits that narrow what agents in this namespace may do, and defaults that fill in fields a…
- [CRD reference: AgentUI](https://openap.org/docs/crd-agentui.md): AgentUI is a bundle-authored DECLARATION of an agent-defined view: a page tree in which generative hooks are the agent's regions, plus the tools and actions…
- [CRD reference: ArtifactRender](https://openap.org/docs/crd-artifactrender.md): ArtifactRender is one request to turn agent-supplied bytes into a deliverable artifact -- an HTML page, an SVG, an image -- through a named renderer plug-in.
- [CRD reference: Channel](https://openap.org/docs/crd-channel.md): Channel binds one transport conversation -- a Slack channel, a scheduled Bento feed, a terminal, a browser view -- to one AgentClass, and declares how inbound…
- [CRD reference: ClusterAgentSettings](https://openap.org/docs/crd-clusteragentsettings.md): ClusterAgentSettings is the cluster-wide top tier of agent governance settings: the limits and defaults every namespace inherits, plus the model catalog.
- [CRD reference: ClusterIdentityProvider](https://openap.org/docs/crd-clusteridentityprovider.md): ClusterIdentityProvider configures cluster-wide human login: which registered idp.Kind authenticates people (pkg/platform/identity/idp), its OIDC client…
- [CRD reference: ClusterSkill](https://openap.org/docs/crd-clusterskill.md): ClusterSkill is a cluster-scoped Skill, visible to every namespace.
- [CRD reference: ClusterSkillSource](https://openap.org/docs/crd-clusterskillsource.md): ClusterSkillSource is a git repo that materializes cluster-scoped ClusterSkills.
- [CRD reference: CredentialUpdateRequest](https://openap.org/docs/crd-credentialupdaterequest.md): CredentialUpdateRequest is an agent's REQUEST that a human replace a credential it believes has stopped authenticating.
- [CRD reference: MCPServer](https://openap.org/docs/crd-mcpserver.md): MCPServer declares one MCP endpoint an agent may call: where it lives (spec.server), the allowlisted tools, per-tool CEL argument constraints, the credential…
- [CRD reference: PublicEndpoint](https://openap.org/docs/crd-publicendpoint.md): PublicEndpoint is how this cluster is reached from the public Internet.
- [CRD reference: RelationshipSource](https://openap.org/docs/crd-relationshipsource.md): RelationshipSource declares one upstream directory (Slack first) to poll and sync into SpiceDB.
- [CRD reference: SessionHold](https://openap.org/docs/crd-sessionhold.md): SessionHold parks an AgentSession for forensic review and gates its return to running on a human decision.
- [CRD reference: SessionUserIdentity](https://openap.org/docs/crd-sessionuseridentity.md): SessionUserIdentity is one session's narrowing of a user's UserIdentity catalog down to just the credentials that session's agent asked for, for…
- [CRD reference: SidecarToolbox](https://openap.org/docs/crd-sidecartoolbox.md): SidecarToolbox declares a user-supplied MCP server that runs as a sidecar container alongside the agent runner pod: its image, sandbox shape, tool allowlist…
- [CRD reference: Skill](https://openap.org/docs/crd-skill.md): Skill is one agentskills.io skill: a SKILL.md (frontmatter + body) plus optional bundled files.
- [CRD reference: SkillSource](https://openap.org/docs/crd-skillsource.md): SkillSource is a git repo that yields one or more Skills.
- [CRD reference: SpiceDBBootstrap](https://openap.org/docs/crd-spicedbbootstrap.md): SpiceDBBootstrap declaratively seeds SpiceDB state: an optional schema fragment and/or a set of relationships TOUCHed into SpiceDB.
- [CRD reference: SpiceboxClass](https://openap.org/docs/crd-spiceboxclass.md): SpiceboxClass is the template a tool sandbox is cut from: image, resources, network mode, mounts, and the toolspecs and toolchains available inside it.
- [CRD reference: SpiceboxSession](https://openap.org/docs/crd-spiceboxsession.md): SpiceboxSession is one live sandbox instantiated from a SpiceboxClass: the long-lived pod that this session's ToolCalls execute inside, plus its workspace…
- [CRD reference: SpiceboxToolchain](https://openap.org/docs/crd-spiceboxtoolchain.md): SpiceboxToolchain is a language or tooling overlay a sandbox can mount -- a compiler, an SDK, a linter -- delivered by a registered backend and mounted at…
- [CRD reference: SpiceboxToolkit](https://openap.org/docs/crd-spiceboxtoolkit.md): SpiceboxToolkit is the machine-readable description of one CLI a sandbox tool can be built from: its subcommands, flags, env, parser config and default…
- [CRD reference: SpiceboxToolspec](https://openap.org/docs/crd-spiceboxtoolspec.md): SpiceboxToolspec is one sandbox tool as the agent sees it: a SpiceboxToolkit reference narrowed to an allowed subcommand set, with CEL argument constraints…
- [CRD reference: SubagentRequest](https://openap.org/docs/crd-subagentrequest.md): SubagentRequest is a runner's request to delegate a task to a child session.
- [CRD reference: ToolCall](https://openap.org/docs/crd-toolcall.md): ToolCall is one execution of one sandbox tool inside a SpiceboxSession: the tool name, its args, non-secret env, stdin, and credential references -- never…
- [CRD reference: UserIdentity](https://openap.org/docs/crd-useridentity.md): UserIdentity is a human's credential catalog: the credentials one person has linked, keyed by their canonical SpiceDB subject, used by…
- [CRD reference: Workshop](https://openap.org/docs/crd-workshop.md): Workshop is one builder session's isolated build space: the durable record of its namespace, RBAC, SpiceDB tuple, tokens and sidecar identity, created by the…
- [CRD reference: WorkshopProbe](https://openap.org/docs/crd-workshopprobe.md): WorkshopProbe is the tool-discovery probe object for an agent-builder workshop: the operator runs one pod against spec.image (or spec.script's baseImage, or…
- [CRD reference: WorkspaceSource](https://openap.org/docs/crd-workspacesource.md): WorkspaceSource declares a named, pluggable origin that per-session workspaces are cut from.