docs(factories): document infrastructure and security - #523
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR adds the Warp Factories infrastructure and security documentation and updates related Factory/Automation Platform navigation and terminology scaffolding. The security-oriented content is appropriately cautious about control-plane, execution-plane, inference, storage, secrets, governance, and billing boundaries, and I did not find a separate security vulnerability in the changed docs/config.
Concerns
- The new infrastructure/security page links to Factory detail pages that are not present in the diff or the base checkout, which would ship broken internal documentation links.
- No approved or repository spec context was supplied, so there were no spec commitments to compare against.
Verdict
Found: 2 critical, 0 important, 0 suggestions
Request changes
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
|
|
||
| An environment can define execution defaults, while a run can select a runner explicitly when the work needs a different operating system, architecture, image, or compute size. Otherwise, Warp uses the environment's configured execution defaults and ultimately the system default. See the [runner reference](../platform/runners) for full resolution behavior. This separation lets one repository setup serve both routine tasks and resource-intensive builds without duplicating the environment. | ||
|
|
||
| Use [environments](../platform/environments) to define repositories, setup, secrets, and provider access. Use [runners](../platform/runners) to define execution compute. The [factory definitions as code](./factory-as-code) page explains how a factory references these resources. |
There was a problem hiding this comment.
🚨 [CRITICAL] ./factory-as-code resolves to src/content/docs/factories/factory-as-code.mdx, but that page is not added in this diff or present in the base checkout, so this ships a broken internal link; link to an existing page or remove the reference until the page lands.
| * **Factory changes** - Review version-controlled factory definitions through the same change-management process you use for other operational code. | ||
| * **Credential changes** - Limit provider, storage, and execution credentials to designated administrators and rotate them under your organization's policy. | ||
|
|
||
| These are workflow and repository policy decisions, not factory-specific RBAC enforcement. Humans remain responsible for specifications, merges, and infrastructure changes. See [factory agents](./factory-agents) for agent responsibilities and [measure and improve](./measure-and-improve) for evidence used to review factory changes. |
There was a problem hiding this comment.
🚨 [CRITICAL] ./factory-agents and ./measure-and-improve both resolve to missing Factory pages, so this sentence creates broken internal links; point these references at existing docs or hold them until those pages are added.
add3264 to
7590778
Compare
7590778 to
8f8d2c8
Compare
8f8d2c8 to
32888cb
Compare
|
/oz-review |
|
I'm re-reviewing this pull request in response to a review request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
There was a problem hiding this comment.
Overview
This PR replaces the Factories infrastructure/security stub with a full conceptual page and updates the self-hosting overview's BYOLLM cloud-agent support language. The new content is generally clear, and I did not find a direct security issue in the changed docs.
Concerns
⚠️ [IMPORTANT] The diff updatessrc/content/docs/platform/self-hosting/index.mdxto say AWS Bedrock supports cloud agents, but the existingsrc/content/docs/platform/self-hosting/security-and-networking.mdxBYOLLM section still says cloud-agent BYOLLM support is coming. Because that related page is not in the attached diff, this is not inline-commentable, but the docs would publish conflicting guidance unless this PR updates the related page too.- Changed comments: none. Changed tests: none.
Verdict
Found: 0 critical, 1 important, 1 suggestions
Request changes
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
| --- | ||
|
|
||
| [STUB — pending content from HYC/content team for the 8/18 closed-beta soft launch. Owner: HYC. | ||
| Warp Factories separates coordination from execution. Your team can choose where a factory runs code, which supported providers serve model requests, where supported factory data is stored, and which credentials each agent receives. Available controls depend on your team's configuration and agreement with Warp. |
There was a problem hiding this comment.
💡 [SUGGESTION] Fix the subject-verb agreement in the opening sentence.
| Warp Factories separates coordination from execution. Your team can choose where a factory runs code, which supported providers serve model requests, where supported factory data is stored, and which credentials each agent receives. Available controls depend on your team's configuration and agreement with Warp. | |
| Warp Factories separate coordination from execution. Your team can choose where a factory runs code, which supported providers serve model requests, where supported factory data is stored, and which credentials each agent receives. Available controls depend on your team's configuration and agreement with Warp. |
32888cb to
1258795
Compare
|
/oz-review |
|
I'm re-reviewing this pull request in response to a review request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
There was a problem hiding this comment.
Overview
This PR replaces the Factories infrastructure and security stub with a concise architecture and boundary explanation, then updates the self-hosting pages to reflect current BYOLLM, cloud-agent, and data-handling behavior. I reviewed the changed documentation for link quality, docs style conventions, factual consistency with adjacent docs, security-sensitive overclaims, and spec drift; the attached spec context contains no approved or repository spec to validate against.
Concerns
- No blocking concerns found.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
Co-Authored-By: Warp Agent <agent@warp.dev> Co-Authored-By: Warp <agent@warp.dev>
1258795 to
edd03ac
Compare
|
/oz-review |
|
I'm re-reviewing this pull request in response to a review request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
There was a problem hiding this comment.
Overview
This PR replaces the Factories infrastructure stub with a concise infrastructure and security page, and updates related self-hosting pages to align BYOLLM, cloud-agent inference, and data-boundary language. I did not find correctness, structural, broken-link, or security blockers in the attached diff.
Concerns
- No approved or repository spec context was available, so there was no implementation/spec drift to assess.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
|
/oz-review |
|
I'm re-reviewing this pull request in response to a review request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
There was a problem hiding this comment.
Overview
This PR replaces the Factories infrastructure stub with an architecture and security page, then updates self-hosting pages to reflect current inference and data-boundary behavior. I reviewed the attached diff, docs style guidance, security-impacting claims, and the provided spec context; no approved spec context was present, so there was no implementation/spec drift to flag.
Concerns
- No blocking concerns found.
- No source comments or tests were added or changed in this documentation-only diff.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
…arity
Rewrites dense, hedged phrasing in plain language while preserving all
verified claims:
- Replace "available controls depend on your team's configuration and
agreement with Warp" with the concrete gating: self-hosted execution
and customer-supplied inference are Enterprise features; customer-owned
storage is enabled for eligible teams.
- Spell out jargon: "supported principal" -> agent API key, "worker
implementations" -> worker platforms, "hosted shape" -> instance shape
(vCPUs and memory), "the write path" -> Warp writes to your bucket.
- Break the dense self-hosting paragraph into a numbered deploy flow and
move the data-locality warning into a :::caution callout.
- Normalize table bolding, clarify column headers ("Boundary changed" ->
"What it changes"), and add lead-in sentences before tables.
- Clarify retention wording in the self-hosting security note (what is
stored and for how long, and who governs provider-side retention).
Validation: style lint 0 errors on changed pages, npm run build (377
pages), internal link check 0 broken.
Co-Authored-By: Warp <agent@warp.dev>
|
Pushed an editorial pass (ec7c866) for readability — no factual changes, all verified claims preserved. The main fix: the intro's "Available controls depend on your team's configuration and agreement with Warp" was too vague to act on. It now states the actual gating: managed self-hosted execution and customer-supplied inference require an Enterprise plan, and Warp enables customer-owned storage for eligible teams. Other changes, all in the same spirit:
Re-validated: style lint 0 errors on the changed pages, |
Per feedback, bring back the original ownership framing for the page description, replacing "data exhaust" with "run data" and using the singular verb to match the page prose. Co-Authored-By: Warp <agent@warp.dev>
…ancy - Plan/eligibility gating moves from the intro paragraph into a :::note. - Dedupe restatements of "run content still flows through Warp": the post-diagram paragraph carries the detail once, and the caution and independence lead-in each shrink to one sentence. - Drop the duplicate runner-reference link and the section sentence now covered by the callout (kept as a short parenthetical). Co-Authored-By: Warp <agent@warp.dev>
- Replace the coordination/execution opener with plain language that leads with infrastructure flexibility - Move the Enterprise plan gating note down next to the execution, inference, and storage choices - Rename the 'Typical contents' table column to 'Key settings' - Link the control room mention to the control room page - Drop the redundant self-hosting caution (covered by the data-flow section) - Link 'cloud agents' to the cloud agents overview - Make the metering paragraph matter-of-fact - Keep provider-specific support (Bedrock, Gemini Enterprise) on the provider pages instead of the self-hosting index and security pages - Restore the ZDR reference on 'Routes through Warp's backend' and shorten the retention note by moving the customer-supplied inference detail into the LLM inference and BYOLLM section Co-Authored-By: Warp <agent@warp.dev>
|
Addressed the review feedback in a57f26f:
|
1 participant
Summary
Explains the control/execution/data boundaries with one architecture diagram and compact decision tables for environments/runners, hosting, execution/inference/storage, and credentials. Enterprise, platform, data-flow, governance, and metering caveats remain explicit.
Final size: 891 prose words. Across the section, the senior editorial pass reduced prose from about 14,600 to 7,649 words while preserving verified behavior and security caveats.
Foundation
Shared navigation, route placeholders, Early Access badge support, and guide migrations are merged in #537. This PR now contains only its feature-owned files and passes CI independently.
Validation
npm run typecheck: passednpm run build: 377 pages built successfullyLatest source refresh
Corrects linux/amd64 + linux/arm64 self-hosting, declarative workerHost, Settings-based Runners, and hosted instance-shape limits.
Verified against Warp
e72fd7aacand warp-server9be39e484b. Broken, placeholder, partial, and spec-only surfaces remain excluded.Proposed reviewers
Based on the Warp Factories Soft Launch (August 18th) tracker. For planning only; no review requests have been sent.
@bnavetta@vorporeal@harryalbertScreenshots
Not included. The revision uses sourced tables, Mermaid diagrams, and verified code/config examples; no safe approved Factory UI assets exist yet.
Unverified claims
None — all UI labels, defaults, eligibility claims, diagrams, and configuration details were verified against source or deliberately omitted.