Tenant Reference
The flat lookup, not the story: every literal fact you might need to copy a value out of, rather than read a narrative about. Tenant concepts's five pages explain what each thing is and why it's shaped that way; the task guides explain how to act on it; this page is where you come back for the exact state, threshold, or default once you already know the shape.
Billing lifecycle + grace
The five states of your tenant's billing lifecycle are decided exclusively by the control plane's own reconciler sweep, never by a webhook handler directly:
| State | Entered when | Grace before escalating |
|---|---|---|
provisioning | Signed up via GitHub OAuth; no completed Stripe Checkout yet. | None |
active | Stripe reports that the subscription is covered. | None |
past-due | A payment fails. | 7 days, then escalates to suspended. |
suspended | past-due's grace elapses with no recovery. | 14 days, then escalates to decommissioning. |
decommissioning | suspended's grace elapses, or you cancel explicitly from the Billing Portal while active (skipping past-due/suspended entirely). | Terminal in v1; no path back; see Close your account. |
past-due/suspended recover straight back to active the moment Stripe reports the subscription covered again (updating your card in the Billing Portal); see Manage billing.
Stack Plans
Choose Standard, Plus, or Pro for your first Stack at Checkout. Prices are monthly in USD before applicable tax. Plan Changes are available only while Stripe reports an active subscription, including from the first day. You may also add Stacks from the first day, up to your Stack Cap.
| Plan | Price | Hosted resources | Run Cap | Reserve Cap | Watched Projects Cap |
|---|---|---|---|---|---|
| Standard | $40 | 2 shared vCPU, 4 GB memory, 40 GB storage | 1 | 1 | 3 |
| Plus | $50 | 4 shared vCPU, 8 GB memory, 80 GB storage | 3 | 1 | 6 |
| Pro | $60 | 8 shared vCPU, 16 GB memory, 160 GB storage | 5 | 2 | 12 |
See Manage Billing for proration, eligibility, and what moves during a Plan Change.
The two quotas
The two v1 quotas have a sharp boundary: one flows to your Stack's own admission gate, while the other never leaves the control plane. See Quotas for why each is enforced where it is.
| Quota | Default | Enforced |
|---|---|---|
Concurrent-Run cap (stacks.run_cap) | 1 | Your Stack's own admission gate; rendered into desired state, applied by your Dispatcher. |
Watched-Projects cap (stacks.watched_projects_cap) | 3 | Control-plane-side only; never rendered to your Stack; checked when a Project is registered. |
Export-archive contents
Every entry the Export Your Data download bundles, in the order it's written, starts with a manifest so its contents are checkable from the archive alone:
| Entry | Contents |
|---|---|
manifest.json | What's inside and why; generation time, the journal's size, and one row per bundled Thread (its id, Project, issue, and size). |
journal.db | A raw, unencrypted copy of your Stack's own append-only Event journal; unlike the automatic backup, no encryption step, since this is you pulling your own data over your own already-authenticated session. |
bundles/<threadId>.bundle | One fetchable git bundle per Thread currently holding an Unshipped attempt; commits that never reached your remote, recoverable independent of the Thread or its Workspace still existing. |
Credential kinds
The full closed set of Credential kinds POST /credentials/:name accepts is keyed by named Credential rather than inferred from its Provider. See Auth & Consent for why the consent column below is shaped the way it is.
| Kind | Consent required | Injected as |
|---|---|---|
oauth_token | Yes | Claude's CLAUDE_CODE_OAUTH_TOKEN; your own personal subscription. |
auth_file | Yes | Codex's uploaded ~/.codex/auth.json; your own personal subscription. |
api_key | No | Claude's ANTHROPIC_API_KEY, Codex's auth.json OPENAI_API_KEY field, or an OpenRouter key for OpenCode. Metered inference is charged on top of the flat hosted fee; a solo tenant usually saves money with a subscription kind where one is available. |
ambient | Yes | A Claude or Codex Runtime login referenced in place. Available only on a Local Stack using the host Executor; Zozo stores no authentication value. |
Each Provider accepts only these kinds:
| Provider | Accepted kinds | Subscription Credential |
|---|---|---|
| Claude | oauth_token, api_key, ambient | Yes, oauth_token or ambient. |
| Codex | auth_file, api_key, ambient | Yes, auth_file or ambient. |
| OpenCode (OpenRouter) | api_key only | None. OpenCode holds no subscription Credential. |
Credential Runtime Profile
Each Credential stores one optional model and effort pair for each activity:
| Activity | Work covered | Blank model or effort |
|---|---|---|
| Intake + Wayfinder | Intake Sessions and all Wayfinder work | Uses the Provider's declared default. |
| Dispatch | Ordinary dispatched Runs | Uses the Provider's declared default. |
| Guide | Stack-wide Guide Sessions | Uses the Provider's declared default. |
An explicit model or effort supplied for one Run or session takes precedence over the selected Credential's value. Zozo binds the resolved values when it creates a Thread. A fallback Credential brings its own profile, so fallback selection may change model and effort as well as billing identity.
Guide Credential
The Guide Credential is one Stack-level Credential used for every Guide Session. Choose it on the Dashboard's Credentials page. Guide model and effort come from that Credential's Guide Runtime Profile entry. Project Credential Routes never participate, so the normal Project resolution tier does not apply.
Zozo clears this selection when the Credential is archived, deleted, disabled by subscription policy, or fails validation, and the Dashboard shows the reason. A Guide request with no usable selection stops with an error. It never falls back to another Credential.
Credential identity and deletion
A named Credential keeps the Provider it was created with. Provisioning the same name again can rotate its authentication material, including its kind, when the Provider is unchanged. Moving that name to another Provider requires a new Credential name.
Remove current routes first
The Dashboard blocks deletion while a Project's current intake or dispatch Credential Route names the Credential as its Primary or Fallback. The response lists every Project, activity, and route position that must be changed.
Historical Thread bindings don't block deletion permanently. When no current configuration names the Credential, the Dashboard reports how many historical Threads will become non-resumable and requires a separate confirmation before deleting it.
Label Vocabulary
Label Reference lists every Control and Classification Label, its meaning, and its effect on a dispatch pick.
Blocked means one thing
A native GitHub dependency; a blocking edge added through GitHub's own issue-relationship UI; and a ## Blocked by reference written in the issue body resolve to the exact same verdict: either both gate a dispatch pick, or, once every blocker either source names has closed, both release it. Neither form means something the other doesn't.
Related
- Tenant concepts; the narrative version of every table above: Two surfaces, Work model, Auth & consent, Quotas, and Data & privacy.
- Manage billing, Export your data, Close your account; the task guides these tables back.
- Understanding Credentials: which Provider a Project or session actually uses. The Credential-kind table above is what its health check reads, not what selects a Provider.
- Connect a Personal Subscription Credential and Connect OpenCode with OpenRouter cover connecting the available Credential kinds. Understanding Credentials covers the Credential-keyed surface (
GET /credentials,POST /credentials/:name) and the per-Credential Runtime tuning those Credentials carry. - Label Reference lists the complete label vocabulary.
- Watch a Project is the task guide that vocabulary supports.
- How Dispatch Decides and Abort, Pause, Resume, Steer, Delete; how the labels above actually get read and written, mid-loop and mid-incident.