Docs

Open in panel → /app · shaping

Policy

The full render + apply pipeline is in apps/api/src/policyRender.ts and apps/api/src/policyWorker.ts. Today the “Apply policy” action is render managed artifacts + bumpConfigEpoch on each tenant’s kumod.

What we publish today

• managed/dkim — DKIM public key per domain (selector mib).
• managed/egress_data.lua — workspace IPs and pool hints.
• (Release B) managed/shaping.toml — source_selection_rate + provider_source_selection_rate ladders per warm_state.

What we don’t publish yet

• TSIG signing policy.
• EHI / SIEM sink wiring.

Invariant

Never hand-edit live Kumo Lua on a running node. Render → enqueue policy_jobs → worker drain → bumpConfigEpoch.

Related

• docs/build/shaping.md
• docs/operate/POLICY.md

Last verified: Sat Jul 11 2026 17:00:00 GMT-0700 (Pacific Daylight Time). Cross-link maintained byscripts/check-docs-drift.sh (M54).

← All docs