Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .mintignore
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ SEO.md
BUILD-PROMPTS-*.md

# The capability source and the rendered fragments pages embed. A render is a fragment, not a
# page: `docs.mdx` and `docs/production/index.mdx` include them.
# page: `index.mdx` and `docs/production/index.mdx` include them.
capabilities.yaml
generated/

Expand Down
18 changes: 9 additions & 9 deletions IA.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ answer. Later sessions write the pages; this file is what they write against, an
| Principle | Autonomy belongs to the action, not the agent. | Second sentence everywhere; the line people quote |
| Category | The execution safety layer for AI agents. | GitHub About, PyPI summary, site `<title>`, directory listings |
| Opener (long-form only) | Everyone is rushing to ship AI agents without thinking about consequences. | First line of Why and of launch posts; never a heading |
| Promise | A consequential action happens at most once, exactly as approved, and leaves a receipt — and when the outcome is unknown, CTRLRun says so instead of guessing. | Hero subline, README paragraph 2 |
| Promise | A consequential action happens at most once, exactly as approved, and leaves a receipt — and when the outcome is unknown, ctrlrun says so instead of guessing. | Hero subline, README paragraph 2 |
| Hook (posts) | Agents can retry. The real world can't. | Social, talk titles; not the README header |

The rules every page is held to are in `STYLE.md`. The tools that hold them are in
Expand Down Expand Up @@ -157,7 +157,7 @@ row landed with `docs/SPEC-mcp-operator.md`, which is when it stopped being plan

| Path | Purpose | Query |
|---|---|---|
| `docs/mcp/overview` | CTRLRun works with MCP in four ways: enforcement (the gateway in front of any MCP server), answering (the operator server, for approvers), learning (this site is an MCP server), discovery (the registries, once listed). | *MCP gateway* · *MCP server human approval* |
| `docs/mcp/overview` | ctrlrun works with MCP in four ways: enforcement (the gateway in front of any MCP server), answering (the operator server, for approvers), learning (this site is an MCP server), discovery (the registries, once listed). | *MCP gateway* · *MCP server human approval* |
| `docs/mcp/gateway-in-5-minutes` | For a reader who already runs an MCP server: before/after, the two commands, what the agent sees on deny and on approval-required, the supported revisions, the principal-flag choice and its security note. | *protect MCP server* · *MCP tool call approval gateway* |
| `docs/mcp/approve-from-your-assistant` | For the person who answers approvals rather than the one who deploys: what `ctrlrun mcp-operator` is, the two flags, a client configuration, a real transcript ending in the receipt that names the approver, and the five things it will not do. | *approve MCP tool call from an assistant* · *MCP human approval server* |
| `docs/mcp/use-the-docs-from-your-editor` | The exact configuration for this site's MCP server, three questions an assistant can then answer, a screenshot spec. | *ctrlrun mcp docs* |
Expand Down Expand Up @@ -199,7 +199,7 @@ turn readers into users.
| `docs/guides/verify-in-ci` | The GitHub Action, the two shapes of report, the N/A line and what it means, the badge. | *verify AI agent safety configuration CI* |
| `docs/guides/export-to-opentelemetry` | `OTelEventSink`: one span per action, one event per step, argument values opt-in. | *opentelemetry AI agent actions* |
| `docs/guides/langgraph-adapter` | Route an approval through `interrupt()`: the operator builds the `Control`, `wait=True`, `Command(resume=...)`, and prevention versus attribution. | *langgraph interrupt human approval tool call* |
| `docs/guides/openai-agents-adapter` | Route an approval through the SDK's tool-approval interruption: `protected_tool`, `gate.run`, why a rejection leaves no CTRLRun evidence. | *openai agents sdk tool approval* |
| `docs/guides/openai-agents-adapter` | Route an approval through the SDK's tool-approval interruption: `protected_tool`, `gate.run`, why a rejection leaves no ctrlrun evidence. | *openai agents sdk tool approval* |

## Cookbook (session 4)

Expand Down Expand Up @@ -256,9 +256,9 @@ short table. No vendor name in a heading.
| Path | Purpose | Query |
|---|---|---|
| `docs/compare/framework-hitl` | A framework's interrupt lets a human say yes; it does not bind the yes to the arguments that execute, refuse a retry after a lost response, or leave a receipt. Use both: the adapter routes through the interrupt. | *langgraph human in the loop vs* · *agent framework approval limitations* |
| `docs/compare/guardrail-libraries` | Guardrails inspect inputs and outputs; CTRLRun sits at the boundary between intention and effect. Different layer; use both. | *AI guardrails vs execution control* |
| `docs/compare/governance-toolkits` | Governance toolkits catalogue, monitor and report; CTRLRun refuses, in the execution path, per action. | *AI agent governance vs runtime enforcement* |
| `docs/compare/durable-workflows` | Durable workflow engines retry until success and make that safe with idempotent activities; CTRLRun refuses to retry an unknown outcome and binds approvals. Complementary. | *temporal vs ctrlrun* · *durable execution AI agents idempotency* |
| `docs/compare/guardrail-libraries` | Guardrails inspect inputs and outputs; ctrlrun sits at the boundary between intention and effect. Different layer; use both. | *AI guardrails vs execution control* |
| `docs/compare/governance-toolkits` | Governance toolkits catalogue, monitor and report; ctrlrun refuses, in the execution path, per action. | *AI agent governance vs runtime enforcement* |
| `docs/compare/durable-workflows` | Durable workflow engines retry until success and make that safe with idempotent activities; ctrlrun refuses to retry an unknown outcome and binds approvals. Complementary. | *temporal vs ctrlrun* · *durable execution AI agents idempotency* |
| `docs/compare/idempotency-keys` | An idempotency key deduplicates at one remote that supports it; an effect key deduplicates at the agent side across remotes, refuses on unknown, and is bound to an approval. The page that says *idempotency* precisely. | *idempotency keys AI agents* · *stripe idempotency key vs* |

## FAQ
Expand All @@ -273,7 +273,7 @@ signature · what is not covered. Query: *ctrlrun faq* and each question verbati

| Path | Purpose | Query |
|---|---|---|
| `security/threat-model` | What CTRLRun defends against, what it does not, and the fail-closed rules that follow; renders `docs/THREAT_MODEL.md`. | *ctrlrun threat model* |
| `security/threat-model` | What ctrlrun defends against, what it does not, and the fail-closed rules that follow; renders `docs/THREAT_MODEL.md`. | *ctrlrun threat model* |
| `docs/security/verify-guarantees` | The guarantee catalogue G1–G11, what each exercises, what N/A means, what verify cannot see. | *ctrlrun verify guarantees* |
| `docs/security/receipt-chain` | Each receipt carries the hash of the one before; what the chain detects, what it does not prove, and the two statements that erase the end of the log. Alteration, not authorship. | *tamper evident audit log AI agent* |
| `security/how-this-is-built` | Spec-first, every MUST mutation-tested with the real numbers, independent review sessions, CLAIMS.md, N/A is not a pass, AI coding agents used throughout with the constraints that make that safe, and what has not been done: no external audit yet. Session 1b. | *is ctrlrun trustworthy* · *how ctrlrun is tested* |
Expand All @@ -283,7 +283,7 @@ signature · what is not covered. Query: *ctrlrun faq* and each question verbati

| Path | Purpose | Query |
|---|---|---|
| `architecture/overview` | The boundary CTRLRun owns, the canonical flow (normalize · decide · approve · reserve · execute · record), the module map; renders `docs/ARCHITECTURE.md`. | *ctrlrun architecture* |
| `architecture/overview` | The boundary ctrlrun owns, the canonical flow (normalize · decide · approve · reserve · execute · record), the module map; renders `docs/ARCHITECTURE.md`. | *ctrlrun architecture* |
| `docs/architecture/specifications` | The six specifications, unchanged, with one line each on what the version asked; plus the OWASP and ACS readings. | *ctrlrun spec* |

## Changelog
Expand Down Expand Up @@ -402,7 +402,7 @@ Two sources with opposite emphases, and the tree above follows both:

What this means concretely for these pages, and what `STYLE.md` enforces: **answer-first
first paragraphs** and one **definitional sentence** per Concepts page, written for a human;
**consistent entity naming** (CTRLRun, effect key, action hash, AMBIGUOUS); **comparison
**consistent entity naming** (ctrlrun, effect key, action hash, AMBIGUOUS); **comparison
tables** on every Compare page; **FAQ structured data** on the FAQ page; quotable, plain
claims with a `CLAIMS.md` row behind each; and the generated `llms.txt` left to Mintlify. What
it does not mean: keyword density, chunked pages, or a second writing style for machines.
Expand Down
10 changes: 5 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# CTRLRun documentation
# ctrlrun documentation

The source of [ctrlrun.dev](https://ctrlrun.dev): the pages, the tools that render them from
the library's own source, and the tests that check them.
Expand Down Expand Up @@ -80,13 +80,13 @@ Apache-2.0, the same as the library. See [LICENSE](LICENSE).

## The site, file by file

- `index.mdx` serves `/`: the homepage, the hallucinated-refund example, the execution
boundary and its four rules, and the integration entry point.
- `index.mdx` serves `/`: the one Overview. The hero and the hallucinated-refund example, the
seven-step diagram, and below them the technical overview `docs.mdx` used to carry at
`/docs` until the two were merged on 2026-09-16. `/docs` redirects here.
- `execution-boundary.mdx` serves `/execution-boundary`: the boundary in three sections -- the drawing, the three
ways it goes into a codebase, and the four steps by which autonomy widens. The drawing lives
in `snippets/execution-boundary.jsx` and is chosen by one control, the domain: it carries the
action, the five checks and the refusal each one raises, so the prose beside it stays short.
- `docs.mdx` serves `/docs`: the technical overview.
- `docs/` is every technical page, published under `/docs/...`.
- `execution-boundary.mdx` is a custom-mode page. The two commercial pages it sat beside,
`risk-check.mdx` and `protect-my-agent.mdx`, were removed when the site became technical only.
Expand Down Expand Up @@ -124,7 +124,7 @@ sources to their destinations, which makes them self-redirects.
The Medical Affairs workbench uses `medical-workbench.js`, styles scoped to
`#cr-medical-workbench`, and the library's `examples/medical_workbench.py`. Keep its embedded
`MODULE` equivalent to that Python source; `tests/test_medical_workbench.py` checks the copy
against the library checkout. The browser loads CTRLRun on demand. Evidence and synthesis are
against the library checkout. The browser loads ctrlrun on demand. Evidence and synthesis are
synthetic; release decisions and receipts execute in Python.
`assets/verify-medical-workbench.cjs` exercises browser Python, both downloads, error
recovery and all six stages at three viewport widths.
Expand Down
Loading