How-to guides
You know roughly what you want to accomplish — these get you there directly.
pipeline-spec.json and a one-file handler
(read -r request; echo "Hello, world! You said: ${request}") that already exercises
identity, admission, channels, and publishing end to end. Unzip it, follow its own
README.md, then swap the handler for your own logic — the same stdin-in/stdout-out
contract [Serve a callable service over a channel](/how-to/serve-a-channel-service/)
covers in more depth. Structure explained, file by file, at
bunsenbrenner.org/template-guide.
How-to guides
Install ct-agent
Direct-host or Docker, and what each setup flag actually does.
Go from Gelb to Grün
Get your tunnel its own certificate instead of the shared one.
Set up an Agent-Fabric channel
Generate identities, derive a link, and admit a member — the direct-address path.
Publish an agent card
Sign a discoverable identity for your agent and get it into the public registry.
Serve a callable service over a channel
Expose a tool one peer can call, and call it from a second, independent process.
Join a published pipeline's role channel
Derive a role's channel id from public information, no pairwise key exchange first.
Run redundant agents for high availability
Two or more agents, one identity — the tunnel survives losing any one of them.
Manage your tunnel from the portal
View, and revoke, your tunnel — and what's still a planned feature.
Publish your own pipeline
Make your workflow's roles discoverable, owned by your own login — no admin token needed.
Bring up a channel member with one command
The copy-paste alternative to setting CT_CHANNEL_* by hand — and why it never puts your private key in shell history.
Authorize a new pipeline hostname (operator side)
Two authorize-host endpoints look interchangeable and aren't — one of them silently blocks Grün later.
Set up a broker-mediated channel, fully click-tested
The path join-a-channel.md flagged as unverified — now run for real, twice, against the production edge.
Self-serve a channel membership grant
Allow-list an e-mail once instead of hand-signing a grant for every new member.
Recover a channel when the operator key is lost
The operator private key can't be recovered — provision a fresh channel instead, without disturbing either member's existing identity.
Run a super-peer for a LAN of channel members
One opt-in relay process lets an entire local network share a single upstream connection to the edge.
Serve a tunnel (Browser Plane) and a channel from the same service
Two independent ct-agent processes, one machine — an HTTPS site plus an Agent-Fabric channel, wired together.
Compose a topology
Wire your agents into an overlay network and bind an operator key so its links actually authorize admission.
Serve your own service, solo (no pipeline, no known peer)
The minimal path when you're both the operator and the only member so far — and the one control-plane step that's easy to miss.
Manage a channel from the portal (no CLI required)
Create a channel, add members, and grant access from a browser — the GUI alternative to the CLI-only path.
Create a service account (API credentials)
Give a bot/bridge/integration its own machine-to-machine credential, separate from your own sign-in.
Buy credits and issue an extra routing token
What credits are actually for, how to buy them, and the one honest gap in the loop today.
Install an agent manifest
ct-agent manifest activate, fetch/verify/install a signed service bundle -- run for real, including the rejection path.
Run a maintenance task with the harness
ct-agent harness run, a bounded local-LLM agent scoped to one manifest's own bundle directory -- run for real, including every rejection path.
Invite someone into your channel with a link
Mint a single-use link bound to a specific identity, instead of pre-allow-listing an e-mail and waiting.