[warp-agent-staging]

What this feature does

Factory network controls restrict outbound access with factory-wide and per-agent policies. Allowances combine, denials take precedence, and built-in policies provide versioned host lists. Kubernetes support is pending. Availability is assumed live as explicitly requested; no stable client release is asserted for this server-backed feature.

Summary

Updates the existing Factory definition syntax reference and adds a discoverability link from infrastructure and security. No new page, navigation change, host inventory, or tracking issue.

Content design plan

• Reader and job: A factory maintainer looking up definition fields to restrict outbound access for all agents or one agent.
• Gap today: The reference lacks network-policy syntax, composition/defaults, built-in names, and version discovery.
• Change: Add one reference section and agent-table entry, linked from infrastructure/security. Exclude built-in host inventories, backend setup, and unrelated rewrites.

The update inherits the reference page's content type (draft_reference); the security page stays conceptual. Gate 0 availability follows the requester's explicit assume-live instruction rather than independent production evidence.

Validation

• npm run typecheck: passed, 0 errors (7 existing hints).
• npm run test:heading-vars: passed, 5 tests.
• npm run build: passed; existing route/plugin/bundle warnings.
• npm run test:heading-tocs: passed, 3,393 entries in 401 HTML files.
• npm run test:homepage-json-ld: passed.
• python3 .agents/skills/style_lint/style_lint.py --changed: 2 files, 6 warnings on pre-existing lines; none introduced.
• python3 .agents/skills/check_for_broken_links/check_links.py --internal-only: passed, 4,498 links in 400 files.
• check_compression_contract.py on both pages (reference and conceptual): passed.
• git diff --check: passed.
• PR-body integrity: authored prose passes; the full-body repetition check flags duplicated long alt text and captions in the tool-generated screenshot block, retained verbatim. Documentation-risk contract passes.
• Initial factory/agent examples at 2bf303d1: validated with the configured server's v1alpha1 parser. State-dependent apply checks were not run. The same examples are rejected as unavailable by the production validator. The new deny-all example parses as an explicitly present empty YAML policy and matches the source resolver/tests; no new server-side or runtime-enforcement check was performed.
• Configured-server catalog request: returned the three documented policy names and version 1.0.0; production catalog request returned HTTP 401 for this run's credential.
• Chromium/Linux preview: rechecked the revised opening, deny-all instruction/example/scope caveat, catalog HTTP request, authentication link, and Kubernetes caveat. The general API reference link opens successfully and contains authentication guidance. Static screenshots below show documentation rendering, not runtime network enforcement.
• Trunk was not installed, so trunk check and trunk fmt were unavailable.

Source grounding and editorial verdict

Source revision: warp-server@98acfaf46d72e3f59300e374eee33dcfe4923cdd. The published production v1alpha1 JSON Schema confirms field placement, accepted keys, and host-format constraints. The parser and its tests confirm factory/agent placement and reject agentDefaults; the runtime resolver and tests confirm union-minus-denials, empty policies, and required-service allowances. The built-in registry and catalog handler/OpenAPI confirm names, selectors, authentication, and response fields. Kubernetes pending support follows the explicit request; pod-level enforcement was not tested. No private rollout details or built-in host inventories are included.

The definition reference owns configuration details; the infrastructure and security page links to it. Review revision 22d154d7 removes the extra placement caveat, makes deny-all configuration explicit without cancelling other-scope allowances, and delegates authentication guidance to the general API reference.

Unverified claims

• Production availability is assumed live per the request, not verified: production example validation reports the capability unavailable, and the catalog request could not authenticate with this run's credential. The configured-server checks do not establish production rollout.
• Kubernetes support is documented as pending per the request; no Kubernetes runtime verification was performed.

Documentation risk

Risk: engineering-review-required
Rationale: Adds configuration examples, network/security semantics, API behavior, and platform-support claims. Production availability follows an explicit drafting assumption.
Source files consulted: warp-server at 98acfaf46d72e3f59300e374eee33dcfe4923cdd: logic/factoryfile/v1alpha1.go, logic/factoryfile/schema/common.go, logic/ai/ambient_agents/networking/network_policy.go, policyregistry/{registry.go,builtins.go} in that directory, router/handlers/public_api/networking.go, public_api/src/base.yaml; published v1alpha1 JSON Schema.
Requested engineering reviewers: none
Engineering review status: pending
Docs override: none

Ownership resolution returned only an engineering team, not one human owner. Per the docs review-routing policy, no team or fallback reviewer was requested. bnavetta commented on 2bf303d1; the three requested changes are addressed in 22d154d7 and await review. The PR remains a draft.

Co-Authored-By: Oz oz-agent@warp.dev

The final three screenshots show the current review revision. The first two are historical captures of the initial draft.

Computer-use screenshots (5)

networkPolicy syntax example and field table

Built-in policy versions, API discovery, and Kubernetes support subsection

Denying all outbound access subsection with networkPolicy: {} example and cross-scope caveat

Full view: Denying all outbound access instruction, networkPolicy: {} example, cross-scope caveat with surrounding reference context

Policy catalog GET example, API reference link, and pending Kubernetes support text

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 22, 2026 6:01pm UTC

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.