One Cloud is the optional hosted product for teams that want one routine
control surface across projects, environments, providers, authority, releases,
and evidence. The open-source one lifecycle remains complete without a
persistent hosted control plane.
This guide describes the end-product contract. The current console supports read-only local-release imports and a bounded public Playground. Other authenticated operational workflows are explicitly labelled customer demos: their disposable local state contacts no provider and issues no authority. The console's owning guide identifies those boundaries and their executable evidence.
Work from the same owner records
The console presents system inventory, authored declarations, per-root closure, provider comparison, plans and costs, approvals, Build, apply and reconciliation, observations, incidents, causal history, receipts, and evidence. It consumes the same public versioned operations as CLI, TUI, shell, SDK, Agent, and MCP clients.
Cloud does not create a parallel manifest, semantic model, provider selector, authority service, deployment record, or history. A browser action proposes or invokes an exact public operation and retains its owner result. Missing, unsupported, unsatisfied, stale, denied, cancelled, partial, and outcome-unknown states remain visible.
Inspect local releases read-only
A local operator can import the exact versioned inspection envelope emitted by
one inspect. Each import is one immutable local snapshot with its source
digest and file-or-paste provenance.
The console renders only the plan and operation references, artifact and Build identities, review and tool-trust posture, journal and fence, action states, receipts, postconditions, reconciliation evidence, and History facts actually present in that envelope. Importing it is not hosted persistence, independent owner validation, provider observation, or mutation authority.
An unresolved, stale, or missing-evidence envelope remains an unavailable snapshot with its exact reason. The console never reconstructs the record it wished it had.
Author and evaluate safely
The public Playground teaches the canonical one.one, selected .one source,
exact lock, diagnostics, semantic tokens, offline check, and pure invoke
path in a fresh bounded workspace. Pure invocation requires a successful check
and a complete installed distribution; unavailable local tooling remains an
explicit unavailable result.
The browser receives no filesystem path, arbitrary command, dependency, provider selection, credential, network, Build, apply, or shell authority. Each workspace and request is bounded and discarded after use. Raw command evidence appears only in a deliberately opened evidence view.
Structured editors in Cloud use the same revision-checked source transactions as local editors. Forms, tables, graphs, and diagrams propose reviewable source patches; they never write hidden trusted IR or silently rebase stale edits.
Use provider dashboards for depth
One Cloud is the ordinary workflow for One-managed changes. It does not try to clone every provider-specific diagnostic or administrative surface. When provider-native depth is useful, Cloud links to the exact resource, deployment, trace, log stream, or incident coordinate and discloses that external trust boundary.
A mutation made directly in a provider dashboard is an out-of-band fact. One observes drift or missing plan, authority, and receipt coordinates and requires explicit reconciliation; it never retroactively claims to have selected, authorized, or executed the change.
Provider credentials, privileged APIs, and dashboard sessions never enter browser application code or URLs.
Keep hosted authority explicit
Hosted operations authenticate an exact principal and tenant, isolate data and workloads, enforce quotas and retention, and request grants for exact subjects and actions. Logging into Cloud does not grant production authority. Approval does not issue an implicit grant, and a disconnected browser does not prove a durable effect stopped.
Cloud remains an ordinary framework-native application. Its routes, components, state, layout, and interaction behavior do not become Experience contracts merely because it is built by One.
Next: check, test, and invoke, or learn multi-tenant platform design.