Production mode

​

What you need

• A Reticle service that issues activation tickets (POST /v1/production-mode/tickets). A service without this route answers 404, and the lease says “the server does not offer production mode”.
• This project linked to that service: reticle connect, or RETICLE_API_KEY.
• A site whose server redeems the ticket. The service signs the ticket, and only that service can check it. Today the Reticle dashboard is the only site that does this. Another site cannot start production mode yet.
• A browser that is signed in to the site, as the person whose API key asks for the ticket. The service redeems a ticket only for that person, in that workspace. A leased browser starts signed out, so give the lease your session cookies in seedStorage (see below).
• The site loads @reticlehq/browser lazily, only when an activation is present, and calls:
  reticle.connect({
    port, // from the activation
    token: nonce, // the session nonce, never the pairing token
    allowInProduction: true,
    allowNonLocalhost: true,
    env: 'production',
    scope, // "observe" or "act"
  });
  

​

Activate a drive

{
  "action": "acquire",
  "url": "https://app.example.com/",
  "seedStorage": { "cookies": { "<session cookie name>": "<value>" } },
  "production": {
    "workspaceId": "ws_123",
    "scope": "act",
    "intent": "create a project, then delete it"
  }
}

1. It mints a single-use session nonce for the site’s origin. The nonce expires after 60 minutes.
2. It asks the service for a ticket with the linked API key: { workspaceId, nonce, bridgePort, scope }. The service decides who may activate, and signs the ticket.
3. It opens https://app.example.com/?reticle_activate=<ticket> in a leased browser.

​

What the policy refuses

• The control. Its name, text, value, test id, link and form target.
• The request. Its method and path, from a policy list. The service can send its own list with the ticket. Without one, the daemon uses DEFAULT_PRODUCTION_POLICY from @reticlehq/core.

• navigation on the activated origin (leaving the origin is refused);
• reading, filters, tabs and panels;
• deleting something the drive itself created. The daemon notes the ids that the drive’s own creates returned (a 2xx POST or PUT whose body has an id).

​

What a refusal looks like

refused: production policy: send an invite or email. A production drive does this only when its
declared intent names it (reticle_lease production.intent).