Connect the Control Plane

The optional Portal client is off by default. Community/local mode needs no account, Portal key, or Control Plane network access. Running runtime portal sync in that mode is a successful no-op.

Configure Enterprise access

portal:
  enabled: true
  base_url: https://customer-control-plane.example
  path_prefix: /api/v1
  timeout_seconds: 5

Keep the show-once key in the process environment:

export RUNTIME_PORTAL_API_KEY='<show-once-runtime-key>'

The complete environment surface is:

Variable	Purpose
RUNTIME_PORTAL_ENABLED	Enables authenticated Portal calls
RUNTIME_PORTAL_BASE_URL	Company app-api origin; not the public API reference
RUNTIME_PORTAL_PATH_PREFIX	Must be /api/v1
RUNTIME_PORTAL_TIMEOUT_SECONDS	Per-request bound
RUNTIME_PORTAL_API_KEY	One show-once credential bound to this Runtime

runtime portal status is local-only and never prints the key.

Register, then sync

runtime portal register
runtime portal status
runtime portal sync

Registration is the explicit one-time Community-to-Enterprise authority transition. Runtime accepts HTTPS only (HTTP loopback is reserved for local testing), refuses redirects, sends a fresh nonce, and trusts the signing public key only after the signed response binds that nonce, exact origin, organization, installation and Runtime identity to a valid first generation. It then writes enterprise-managed.json and the protected atomic generation under Runtime Home.

Sync is explicit. It downloads only a signed policy/config generation, verifies organization, key ID, signature, schema versions, digests and monotonic version, then swaps the pair atomically. It sends the installed generation identity; an unchanged response transfers and installs no documents. Failure preserves last-known-good. After enrollment, RUNTIME_CONFIG_FILE, RUNTIME_POLICY_FILE, and Runtime Home local config/policy files cannot become effective; invalid managed state fails closed. Runtime restores the pinned Portal origin from enterprise-managed.json. Only RUNTIME_PORTAL_API_KEY remains a live Portal credential input after registration; ambient connection settings cannot repoint the enrolled Home. Generations do not expire in this initial contract; a newer monotonic generation replaces the last verified one.

Normal command execution attempts heartbeat at most once per CLI process after its local audit record is durable. Heartbeat failure does not change command outcome. Transient failures use no more than three jittered bounded-backoff attempts. Registration/sync failures are reported because those commands were explicitly requested.

The Portal client never uploads audit records. Local journal and runtime audit commands remain authoritative; optional external delivery is a separate future OpenTelemetry integration.

See Enterprise setup for key replacement and demo-reset recovery.

Operational examples on this site were verified against Runtime 0.9.8. After bootstrap, the version-exact files in Runtime Home win.