Managed capture

​

Configure push and CI capture

​

Configure repository mirrors

machine github.com login x-access-token password <fine-grained PAT>

​

Configure inference-call capture

1. Give it a capture token and the HTTPS API URL. Keep provider keys on the gateway.
2. Keep each developer’s chosen model. Configure capture failures so they don’t fail the model call.
3. Make sure the client carries the real Session identifier. The server skips calls without one and logs gateway_ingest_skipped_no_session.
4. Route each agent through the gateway, as described in Distribute gateway routing.

​

Distribute gateway routing

​

Claude Code

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://sediment-llm.example.com"
  },
  "apiKeyHelper": "<credential helper command>"
}

​

Codex

1. A provider in <Codex home>/config.toml:
   [model_providers.sediment]
   name = "Sediment gateway"
   base_url = "https://sediment-llm.example.com/v1"
   env_key = "SEDIMENT_GATEWAY_KEY"
   wire_api = "responses"
   
2. A gateway profile in <Codex home>/gateway.config.toml that selects the provider and disables the image tool, which the LiteLLM bridge rejects:
   model_provider = "sediment"
   
   [features]
   image_generation = false
   
3. SEDIMENT_GATEWAY_KEY in the environment that starts Codex.

​

pi

{
  "providers": {
    "sediment": {
      "baseUrl": "https://sediment-llm.example.com",
      "api": "anthropic-messages",
      "apiKey": "$SEDIMENT_GATEWAY_KEY",
      "models": [{"id": "<existing Anthropic model ID>"}]
    }
  }
}

​

Distribute decision telemetry

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/json
export OTEL_EXPORTER_OTLP_ENDPOINT=https://sediment-api.example.com
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer <capture token>"
export OTEL_LOG_TOOL_DETAILS=1
export OTEL_RESOURCE_ATTRIBUTES='user.id=<developer>'

​

Build the fleet bundle

sediment install --fleet --out sediment-fleet --prefix /opt/sediment

​

Set the owner allowlist

{"auto_install_remotes": ["github.com/acme-corp/"]}

​

Distribute the bundle

1. Deploy the bundle, the system git configuration, the Claude Code managed settings, the Codex fragment, and the optional allowlist through MDM.
2. For existing clones, run git init in place to copy the template hooks, or run sediment install in each one.

​

Verify the rollout

1. Schedule the health check on each machine through MDM:
   sediment doctor --fetch ~/code/repo-a ~/code/repo-b
   
   It exits with a failure when any installed integration is broken.
2. For each gateway and agent combination, run a short test Session. With an operator token, query that Session’s captured calls:
   curl -sf \
     -H "Authorization: Bearer $SEDIMENT_OPERATOR_TOKEN" \
     "https://sediment-api.example.com/v1/facts/session/<session_id>/inference-calls"
   
   The response lists the test call with the expected provider and model.
3. Check the other paths: Developer decisions grow after edits, the remote has refs/notes/sediment after a push, Pushes and CI outcomes grow after forge events, and the API log reports attributions_derived after a mirror refresh.

​

Remove managed capture

1. Retire the MDM deployment policy, or switch it to removal mode. Keep the fleet prefix until nothing references it.
2. Delete the four GitHub webhooks. For another CI system, remove its POST /ingest/ci call and its capture token.
3. Remove each gateway’s Sediment callback and capture token. From client machines, remove the gateway routing that you distributed: the Claude Code ANTHROPIC_BASE_URL and apiKeyHelper settings, the Codex provider and profile, the pi provider, and SEDIMENT_GATEWAY_KEY. Restart the agents.
4. Revoke the retired capture tokens. Never reuse a retired token for another client.
5. Remove the distributed OpenTelemetry and pi variables from shell profiles, MDM, and agent services. Remove only Sediment’s telemetry blocks from Codex profiles, and restart the agents.
6. Remove config.json from the fleet prefix, which turns off automatic installation.
7. Remove Sediment’s PostToolUse entry from the Claude Code managed settings and from each user’s Codex hooks file. Keep unrelated entries.
8. Check the system git values:
   git config --system --get init.templateDir
   git config --system --get-all notes.rewriteRef
   
   If init.templateDir points to the Sediment prefix, remove only the matching values. Replace /opt/sediment if you chose another prefix:
   sudo git config --system --fixed-value --unset-all \
     init.templateDir /opt/sediment/git-template
   sudo git config --system --fixed-value --unset-all \
     notes.rewriteRef refs/notes/sediment
   
9. On each machine that used pi or transcript capture, run Uninstall capture with --agents.
10. Run sediment uninstall /path/to/repo in every other existing clone.
11. Remove the fleet prefix through MDM. When no captured private repository needs them, revoke the server’s mirror credentials.