# Settings, secrets, network, and jobs

Declare settings, secret field names, named connections, and jobs in the
manifest before activation. Ordinary settings are namespaced synced or local
JSON. A `secret` field is host-rendered encrypted-secret storage: plugin code
can check presence but cannot read or enumerate plaintext.

Network requests use one declared connection and a user-approved exact HTTPS
origin. The host resolves a declared secret only while constructing the
credential. Do not use ambient `fetch`; browser transport availability is
limited by the reviewed app CSP and provider CORS.

Jobs are lifecycle-owned and abort on disable or workspace change. Manual work
runs on the invoking device. Scheduled network or mutation effects require
explicit device-local runner designation and side-effect approval. The app does
not promise execution while closed, and offline takeover cannot guarantee
exactly once. Use checkpoints, provider idempotency, and note CAS.
