Getting started with OpsChain
Included from Basic tier
Welcome. OpsChain automates and governs enterprise operations at scale: you model your estate (projects, environments, assets), describe the work as actions and workflows, run that work with full logging and approval gates, and then let events and triggers run the estate for you.
This is the learning path: lessons of 5–20 minutes, each with one outcome you can test, grouped into modules by capability and ordered into tracks by role. Every lesson opens with what you will be able to do, lists what it needs, shows what you should see after each step, and ends with a check and a next step — by the end of your track you will have gone from a fresh install to an estate that runs itself.
How to read this path
The lessons are embedded in the opschain binary itself, so the copy you
are reading always matches the version you are running:
opschain learn # this page — the tracks and modules
opschain learn author # one track, lesson by lesson
opschain learn m3 # one module and its lessons
opschain learn 3.1 # one lesson by id…
opschain learn 3-1-your-first-change # …or by its full name
opschain learn 3.1 | less # the output is pager-friendly
opschain learn export -o ./docs # write the whole set to disk
One library, three kinds of page
The documentation is one library with three kinds of page, and meeting a topic more than once is deliberate — each kind reads it through a different lens:
- The lessons (this path,
opschain learn <id>) are tutorials: one outcome each, hands-on, in the order your track gives them. - The guides (
opschain docs, listed under Guides) are how-to pages with no exercise — the platform at a glance, provider-side setup for identity providers, secrets providers, the GitHub, Jira Service Management and SIEM integrations — readable in any order and linked from the lessons that lean on them. - The reference (
opschain docs) is for looking things up: every component, resource field, CLI verb and concept, precisely and completely.
Learn from the lessons, work from the guides, look up in the reference.
Choose your track
Every track starts with the same first module and ends on the GUI recap; what sits between is your role's order through the modules below.
- Evaluating OpsChain? Take Foundations — the shared core every role assumes, in the order the OpsChain Academy's Foundations exercises verify it. Stop when convinced, or carry on into your role's track.
- Writing actions, packs and workflows? Author.
- Running and watching an estate others author? Operator.
- Installing, securing and keeping the server up? Admin.
- Proving control? Governance.
- Building, enrolling and governing an agent? Agent builder.
Want your progress verified? The OpsChain Academy runs the same path with
checks the examiner can see — opschain academy — and a lesson that has a
verified exercise says so in its "Check yourself". The lessons read the
same with or without it.
Prerequisites
- The
opschainbinary on your PATH (opschain versionprints the build). Lesson 0.0 is how it gets there — a package manager or a verified download. - For most lessons: a running OpsChain server and a login. Lesson 0.1 covers both, including starting your own local server.
- No server yet? Lesson 0.2 explains the local lane — authoring and running
actions works entirely on your own machine with
--local, and the Author track's second module needs nothing else.
The learning path
Six tracks order the same modules for six roles; a module is one capability, three to ten lessons of 5–20 minutes, each with one outcome you can test. A lesson's minutes are its reading time plus its doing time — measured on a walk of the lesson where one exists, marked (estimate) where none has yet. Read a track top to bottom, or pick a module or a lesson.
Tracks
import AcademyTracks from '@site/src/components/AcademyTracks';
Modules
M0 Start here
Get the binary onto a machine, sign in, and learn the two modes and the tools every later lesson assumes.
- 0.0 Install OpsChain — 9m (estimate)
- 0.1 Install and sign in — 7m · verified by the
first-contactexercise - 0.2 Local mode and server mode — 5m
- 0.3 Your tools: contexts, output formats, the API, the docs — 6m
M1 The estate
The node tree everything runs against, the data layered over it, and the licence behind its limits.
- 1.1 Projects, environments, assets — and hosts — 5m
- 1.2 Build and change your own — 5m · verified by the
build-an-estateexercise - 1.3 Properties and settings: the overlay — 7m · verified by the
build-an-estateexercise - 1.4 Editing, history and promotion — 5m
- 1.5 The licence behind the limits — 5m
M2 Author work
Write actions, compose them, use and build packs, and iterate on your own machine before anything touches a server.
- 2.1 Your first action — 6m
- 2.2 Namespaces, composition and inputs — 11m
- 2.3 Waits and gates — the policy way — 5m
- 2.4 Using packs — 11m
- 2.5 Building a pack — 5m
- 2.6 The local development loop — 8m
- 2.7 Lab: author a pack action and run it off the tree — 6m
M3 Run work on a server
Changes against estate nodes with the server keeping the record — gates, remotes, templates, secrets and artifacts.
- 3.1 Your first change — 8m · verified by the
first-governed-changeexercise - 3.2 Gates, retry, cancel — 7m
- 3.3 Git remotes and the identity policy — 7m
- 3.4 Templates and versions — 7m
- 3.5 Secrets and the vault — 10m · verified by the
vault-referenceexercise - 3.6 Artifacts — 8m
M4 Workflows
Orchestrate many actions across many assets, with error semantics and gates you can predict.
- 4.1 Anatomy and the step kinds — 11m (estimate)
- 4.2 Store, browse, run — 9m · verified by the
workflow-runexercise - 4.3 Error semantics — 14m (estimate)
- 4.4 Gates, policies and retirement — 7m (estimate)
- 4.5 Operating the catalog — 5m (estimate)
M5 Events and automation
The record the platform keeps, and the triggers, schedules, webhooks, notifications and windows that run the estate from it.
- 5.1 The record: events and chains — 10m · verified by the
read-the-recordexercise - 5.2 Triggers — 10m · verified by the
trigger-firesexercise - 5.3 Time and the outside world: schedules and inbound webhooks — 9m (estimate)
- 5.4 Custom events — 8m (estimate)
- 5.5 Notifications: watches, channels, the bell — 12m (estimate)
- 5.6 Maintenance windows — 13m (estimate)
- 5.7 Lab: the hand-off pattern — 12m (estimate)
M6 The execution estate
Where work runs — runners and fleets, and the hosts you install nothing on.
- 6.1 How a runner works, and what happens when one dies — 8m (estimate)
- 6.2 Your first runner — 6m · verified by the
runner-onlineexercise - 6.3 Fleets, groups and placement — 14m (estimate)
- 6.4 Hosts without a runner: brokered access — 17m (estimate)
- 6.5 Model a fleet properly — 10m (estimate)
M7 Who may act
Users, groups, rules and policies; tokens and automation principals; security roles, step-up and federated sign-in.
- 7.1 Denied means not found; the denial event — 5m (estimate)
- 7.2 Users, groups, rules, policies — 9m · verified by the
least-privilegeexercise - 7.3 Tokens, automation principals and the review export — 10m (estimate)
- 7.4 Security roles and step-up — 7m · verified by the
step-upexercise - 7.5 Federated sign-in — 7m (estimate)
M8 Operate the server
Backup and restore, definitions under change control, the posture ladder, database care, upgrades, replicas and sites.
- 8.1 Backup, restore and prove it — 11m (estimate)
- 8.2 Definitions under change control — 9m (estimate)
- 8.3 Decommission — 7m (estimate)
- 8.4 The posture ladder — 11m (estimate)
- 8.5 Database care — 10m (estimate)
- 8.6 Upgrade and roll — 13m (estimate)
- 8.7 Replicas and sites — 17m (estimate)
M9 The GUI
Everything you just learned, through the browser — the recap every track ends on.
- 9.1 The GUI tour — 7m (estimate)
M10 Change governance
Approval policies and the change funnel, asset owners, the approval context an approver reads, waivers — and a change advisory board composed from them. Requires packs:change-governance; the prose reads without it.
- 10.1 Approval policies and the change funnel — 13m · verified by the
first-approval-policy,funnel-heldexercise - 10.2 Asset owners and impacted-owner approval — 9m (estimate)
- 10.3 The approval context — 8m (estimate)
- 10.4 Waivers — the exceptions register — 5m (estimate)
- 10.5 Lab: run a change advisory board on OpsChain — 5m (estimate)
M11 Security governance
Classification and the register, controls and the evidence ledger, review campaigns, and notification mandates. Requires packs:security-governance; the prose reads without it.
- 11.1 Classification and the register — 11m (estimate)
- 11.2 Controls and the evidence ledger — 14m (estimate)
- 11.3 Review campaigns and remediation work items — 11m (estimate)
- 11.4 Notification mandates and delivery evidence — 5m · verified by the
first-mandateexercise
M12 Agents
Felix, hire to retire — what an agent is, enrolling and governing one, its evidence, releases and rollover, kill switches, model providers, building your own, the bundled SMEs and MCP. Requires packs:agents; the prose reads without it.
- 12.0 Meet Felix — 6m (estimate)
- 12.1 What an agent is; the two kinds — 6m (estimate)
- 12.2 Enrol, own, assign, grant, ceiling — 10m · verified by the
enrol-and-grantexercise - 12.3 Evidence: activity, trust review, transcripts — 6m (estimate)
- 12.4 Releases, stages and the rollover — hire to retire — 14m · verified by the
release-stage-floor,rolloverexercise - 12.5 Kill switches and offboarding — 8m (estimate)
- 12.6 Model providers and budgets — 8m (estimate)
- 12.7 Build one: the SDK and
agent dev— 9m (estimate) - 12.8 The bundled SMEs — 10m (estimate)
- 12.9 An AI assistant as a client: MCP — 5m (estimate)
M13 Integrations
GitHub, Jira Service Management and SIEM export as governed integrations, and the three rules every integration follows; inbound webhooks are lesson 5.3.
- 13.1 GitHub — 14m (estimate)
- 13.2 Jira Service Management — 11m (estimate)
- 13.3 SIEM export — 7m (estimate)
- 13.4 Lab: how OpsChain governs integrations — 5m (estimate)
M14 Packs
The licensed action packs — MintPress ships here; AWS, Azure and Ping AIC lessons ship with their packs. Requires packs:mintpress; the prose reads without it.
- 14.1 The MintPress action pack — 8m (estimate)
Guides
The how-to guides — the platform at a glance, the GUI screen by screen, identity-provider setup, secrets providers, the GitHub, Jira Service Management and SIEM integrations — live in the reference under Guides, and a lesson links the guide it leans on.