Skip to main content

Overview

Branch configuration records secret-free runtime intent: a connection label, model, tool allow-list, and bounded execution policy. It never stores API keys, DSNs, headers, or environment values. Writes use the version returned by the previous read, so concurrent callers must re-read rather than overwrite.

Example

Key Points

  • show() returns only explicitly configured branch values; effective() resolves policy precedence and reports the source of every field.
  • set() and delete() require an expected version. Re-read and retry when a concurrent writer has changed the record.
  • Connection values are labels resolved against Tell presets. Keep credentials in the environment, workspace .env, or Tell credential store.