First launch and signing in

The Editor needs a signed-in session with your organisation's Neural Inverse Govern deployment. While you are signed out, a sign-in screen covers the window. After you sign in, your organisation's policies apply to agents, models and tools.

Before you start

You need:

• an account in your organisation's Govern deployment;
• the address of that deployment, unless your administrator has set it for you through managed policy or your organisation installs a build with the address locked in.

The Editor signs in as its own OAuth client, neuralinverse-editor. The Agents app uses neuralinverse-agents and the CLI neuralinverse-cli, so each app has its own session, its own entry in your organisation's device list and its own audit records.

Which server the Editor uses

The Editor takes the first of these that is set:

1. An address locked into the build by your organisation (an enterprise build). Policy and settings are then ignored.
2. The managed policy NeuralInverseKeystoneBaseUrl, set by your administrator.
3. The setting neuralInverse.keystone.baseUrl, for self-hosted deployments. It is an application setting: a workspace (a cloned repository) cannot set it.
4. The address built into the app.

An address that is set but invalid stops sign-in with a reason; the Editor never falls back to a weaker source. When the address came from your own setting, the sign-in screen shows a warning, because anything that can write your settings file could have changed it.

The sign-in screen shows Server: <host> - <region> before you type anything. Check that it is your organisation's server.

Sign in with the browser

1. Start the Editor. The screen reads Sign in to Neural Inverse and Use your Neural Inverse account. Sign-in continues in your browser.
2. Choose Sign In. Your browser opens your organisation's sign-in page and the button reads Waiting for Browser….
3. Sign in in the browser. The browser returns to the Editor on a local address (http://127.0.0.1:<random port>/callback).
4. The screen shows Signed In and the window opens.

If the browser page was closed by mistake, choose Open the sign-in page again. The sign-in uses OAuth 2.0 authorization code with PKCE, and the Editor refuses an answer from a server other than the one it started with.

Sign in with a device code

Use this on a machine with no browser, for example over remote desktop to a locked-down host.

1. On the sign-in screen, choose No browser on this machine? Sign in with a device code. You can also run Sign In to Neural Inverse with a Device Code from the Command Palette.
2. The screen shows a Device code and the address of the approval page. Choose Copy the code and Open the page on any device where you can sign in.
3. On the approval page, sign in, check the app name and the account, and approve.
4. The Editor shows Waiting for approval. The code stops working at a time. When you approve, the window opens.

The approval page belongs to your organisation's server. The Editor refuses a code whose approval address is not on the server's own domain.

Where your session is kept

The refresh token is held by the Editor's main process and stored in your operating system's credential store (macOS Keychain, Windows DPAPI, or the Linux Secret Service). Windows and extensions never receive it. Without a usable credential store, the session is kept in memory and ends when the Editor quits; the sign-in screen tells you when this is the case. On Linux, install and unlock a Secret Service keyring such as GNOME Keyring.

A session is bound to the server that issued it. If the configured address changes, the session ends locally and you sign in to the new server.

See which server and account you use

• Status bar. The Editor's status bar shows one of: signed out, connecting, Keystone: <region>, degraded with a reason code, or policy locked by your organisation. Click it to open the server details.
• Show Neural Inverse Server shows the host, region, jurisdiction, kind of deployment, who chose the address, and whether it is locked.
• Show Neural Inverse Account shows Name, Email, Account, Account ID (12 digits), Account Region, Server, App, Signed in, Session kept in, Policy and Connection. When the account cannot be confirmed for your token's organisation, it reads "Account details unavailable" with a code.

The account menu starts with the same server line.

Sign out

Run Sign Out of Neural Inverse from the Command Palette or the account menu. The Editor revokes the session on the server.

The Editor and the Agents app keep their sign-ins in step: signing out in one signs the other out, signing in with another account in one signs the other out, and signing in to one lets the other offer a one-click sign-in. No secret is shared between them; each app has its own session.

Consent for agents

When an AI agent needs to act for you and your organisation requires your consent, a dialog names the agent, the permissions it needs, and how long consent lasts. Choose Allow for 30 Days or Do Not Allow. Govern accepts only permissions your own account has.

When sign-in fails

Every failure shows a sentence that says what happened and what to do, ending with a code in parentheses. Give the code to your administrator if it keeps happening. Common codes are in Troubleshooting.

For administrators

An older server that does not know the per-app client answers invalid_client. The Editor then stops and says so; it never tries another client by itself. Upgrade the server, or set NeuralInverseKeystoneClientId.

How managed policy is delivered on each operating system is in Settings and policies.