# One Cloud

One Cloud is the optional hosted product for teams that want one routine
control surface across projects, environments, providers, authority, releases,
and evidence. The open-source `one` lifecycle remains complete without a
persistent hosted control plane.

This guide describes the end-product contract. The current console supports
read-only local-release imports and a bounded public Playground. Other
authenticated operational workflows are explicitly labelled customer demos:
their disposable local state contacts no provider and issues no authority.
The [console's owning guide](https://github.com/muijf/one/blob/main/cloud/console/README.md)
identifies those boundaries and their executable evidence.

## Work from the same owner records

The console presents system inventory, authored declarations, per-root
closure, provider comparison, plans and costs, approvals, Build, apply and
reconciliation, observations, incidents, causal history, receipts, and
evidence. It consumes the same public versioned operations as CLI, TUI, shell,
SDK, Agent, and MCP clients.

Cloud does not create a parallel manifest, semantic model, provider selector,
authority service, deployment record, or history. A browser action proposes or
invokes an exact public operation and retains its owner result. Missing,
unsupported, unsatisfied, stale, denied, cancelled, partial, and
outcome-unknown states remain visible.

## Inspect local releases read-only

A local operator can import the exact versioned inspection envelope emitted by
`one inspect`. Each import is one immutable local snapshot with its source
digest and file-or-paste provenance.

The console renders only the plan and operation references, artifact and Build
identities, review and tool-trust posture, journal and fence, action states,
receipts, postconditions, reconciliation evidence, and History facts actually
present in that envelope. Importing it is not hosted persistence, independent
owner validation, provider observation, or mutation authority.

An unresolved, stale, or missing-evidence envelope remains an unavailable
snapshot with its exact reason. The console never reconstructs the record it
wished it had.

## Author and evaluate safely

The public Playground teaches the canonical `one.one`, selected `.one` source,
exact lock, diagnostics, semantic tokens, offline `check`, and pure `invoke`
path in a fresh bounded workspace. Pure invocation requires a successful check
and a complete installed distribution; unavailable local tooling remains an
explicit unavailable result.

The browser receives no filesystem path, arbitrary command, dependency,
provider selection, credential, network, Build, apply, or shell authority.
Each workspace and request is bounded and discarded after use. Raw command
evidence appears only in a deliberately opened evidence view.

Structured editors in Cloud use the same revision-checked source transactions
as local editors. Forms, tables, graphs, and diagrams propose reviewable source
patches; they never write hidden trusted IR or silently rebase stale edits.

## Use provider dashboards for depth

One Cloud is the ordinary workflow for One-managed changes. It does not try to
clone every provider-specific diagnostic or administrative surface. When
provider-native depth is useful, Cloud links to the exact resource, deployment,
trace, log stream, or incident coordinate and discloses that external trust
boundary.

A mutation made directly in a provider dashboard is an out-of-band fact. One
observes drift or missing plan, authority, and receipt coordinates and requires
explicit reconciliation; it never retroactively claims to have selected,
authorized, or executed the change.

Provider credentials, privileged APIs, and dashboard sessions never enter
browser application code or URLs.

## Keep hosted authority explicit

Hosted operations authenticate an exact principal and tenant, isolate data and
workloads, enforce quotas and retention, and request grants for exact subjects
and actions. Logging into Cloud does not grant production authority. Approval
does not issue an implicit grant, and a disconnected browser does not prove a
durable effect stopped.

Cloud remains an ordinary framework-native application. Its routes,
components, state, layout, and interaction behavior do not become Experience
contracts merely because it is built by One.

Next: [check, test, and invoke](/one/lifecycle/check-test-invoke), or learn
[multi-tenant platform design](/one/guides/multi-tenant-platforms).