Compare available control boundaries
Assess Mimir and the native integrations against the same requirements.
Open this resource →Mimir handbook
Add Mimir when its runtime fits the task
Connect the optional runtime, choose supported provider access, and inspect its signed-policy and repository context.
Mimir is an additional runtime choice. Existing Claude Code and Codex connections continue to work without it.
01 / Mimir handbook
Check the runtime and distribution first
Compare required controls with Mimir’s supported native gates. Select this runtime when those boundaries match the rollout. Native agent connections remain independent.
Check macOS or Linux, Node.js 22 or later, and npm. Obtain a personal enrollment code. Confirm the approved setup and Mimir releases.
Automatic downloads cover macOS arm64, macOS x64, and Linux x64. Setup validates the release checksum before installing the selected binary.
npx @betterloop/setup setup --harness mimirIf the selected runtime is missing, read the installation request. Confirm the intended installation. Then finish the available account-access route.
Device enrollment authorizes the team connection. It does not create an OpenAI or Anthropic account. Keep provider authentication separate in the setup record.
02 / Mimir handbook
Select the provider-access route your deployment supports
The account picker can route Codex or ChatGPT users to native Codex integration. It can route Claude Code users to the native Claude Code integration.
An API key is a separately billed access route. Subscription access does not become an API credential. Choose the route appropriate to your provider account.
New ChatGPT plan-usage OAuth is deferred. The Cursor choice provides information and an alternative API-key route. This release does not supply Cursor-to-Mimir transport.
Supply API access through the supported environment
Select the api account route. Select OpenAI or Anthropic as provider. Load BETTERLOOP_PROVIDER_API_KEY through the process environment using your approved secret-loading method.
Exclude the key from command arguments, repository files, and shell history. Setup passes it to the runtime through stdin.
npx @betterloop/setup setup --harness mimir --account api --provider openaiFor the supported Anthropic route, select --provider anthropic. Existing valid Mimir credentials are preserved. New enrollment alone does not require replacing them.
If provider access fails, repair that account route. A provider problem does not by itself require revocation of the working team device connection.
03 / Mimir handbook
Check feature minimums against the installed build
| Capability | Minimum Mimir version | What depends on this support |
|---|---|---|
| Supported native policy gates | 0.21.0 | The enrolled runtime evaluates supported signed tool, shell, model, and reasoning actions. |
| Native lifecycle observation | 0.22.0 | Events can be observed conditionally. Delivery of the resulting reports remains best effort. |
| Signed resource bundles with project knowledge | 0.24.0 | The runtime can consume the applicable signed bundle and knowledge-map formats. |
| Optional library resources | 0.26.0 | The runtime can read the signed manifest for developer-selected approved resources. |
| Explicit unapproved-repository behavior | 0.27.0 | The runtime can apply the organization’s reviewed choice for unmatched repositories. |
These version numbers describe feature minimums. They do not establish release publication. Obtain the approved available build from the deployment owner.
Support is also specific to the action, lifecycle event, and catalog version. An incompatible combination remains unsupported even when another feature works.
npx @betterloop/setup doctor --harness mimir --project /path/to/repositoryA native gate evaluates verified signed policy at a supported action. Skills remain advisory instructions. Runtime checks do not independently attest the whole device.
A finished turn is not a verified outcome. The separate verification workflow can create explicit receipts for eligible learning outcome reports.
04 / Mimir handbook
Follow the context chosen for each repository
One device enrollment serves repository sessions. Mimir prepares managed environments by project and resolves the signed knowledge that applies to each repository.
An unmatched repository follows the organization setting. Report-only behavior omits company controls and learning. Team-default behavior omits company knowledge without a matching project.
If several knowledge projects match, obtain the intended identifier from the administrator. Select that identifier explicitly for the repository.
betterloop sync --harness mimir --project /path/to/repository --knowledge-project PROJECT_IDA source reference does not provide credentials or private document contents. External Git, HTTPS, and MCP resources require their own authorized access.
Background work captures installation identity. After changing a device connection, start fresh sessions. Old subprocesses do not demonstrate readiness under the replacement connection.
Illustrative addition beside an existing Codex connection
A Harbor developer already uses the team connection with Codex. They rerun setup for --harness mimir. They retain the existing device enrollment.
They select an available account route and open Mimir in search-api. They inspect doctor for Mimir. The earlier Codex result remains a separate record.
A native Mimir gate can support a control that Codex reports as conditional or unsupported. The administrator assesses the required controls for each runtime separately.
05 / Mimir handbook
Restore the affected connection without discarding credentials
| Reported issue | Supported investigation |
|---|---|
| Provider account unavailable | Finish the selected provider route. Retain the team connection while restoring model access. |
| Required signed capability unsupported | Compare the runtime with the approved minimum. Obtain a compatible build through the deployment release process. |
| Signed release stale | Refresh the Mimir repository context. Read the new doctor result. |
| Multiple knowledge matches | Supply the intended PROJECT_ID through setup or sync. |
| Existing connection conflicts | Explicitly disconnect the previous organization/team connection before a new enrollment. |
betterloop sync --harness mimir --project /path/to/repository
betterloop doctor --harness mimir --project /path/to/repositoryUninstall removes the Mimir integration and revokes its harness credential and linked fleet credentials. Owned enterprise state is archived.
Model credentials and unrelated native state remain. Legacy files remain when ownership is unclear or their contents have changed. Do not treat those retained files as current authorization.
An unexpired valid cache can survive a temporary network outage. Coverage decreases when policy becomes invalid or expired, or a known revocation applies. Recheck required controls after connectivity returns.
A revoked enrollment credential cannot reconnect. Obtain fresh enrollment. Private archives preserve recovery state rather than restoring permission to use the former connection.
Approved skills remain guidance. Installing Mimir does not resolve the existing gap around exclusion of all unapproved skills.