> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/cinema-proof-agent/getting-started.md).

# Getting Started

The shortest verified path from DSG Workroom to governed Cinema/BrowserOS execution with visible evidence.

### 1. Open DSG Workroom

Go to:

`https://dsg.pics/dsg/workroom`

Unauthenticated access is expected to redirect to login. A signed-in end-to-end Workroom acceptance is still an open verification gate.

### 2. Authenticate

Authentication establishes account identity and entitlement. It does not bypass plan authorization.

### 3. Select the workspace and connect the governed Agent

The Agent proposes work; it does not receive direct provider authority.

### 4. Review the exact requested action

Spacetime binds plan, Route, target, payload, identity, permission and approval requirements before provider execution.

### 5. Approve only when required

Changed work requires a changed binding. Approval for one exact action must not authorize a different action or payload.

### 6. Execute through the governed provider

For each step:

* `ALLOW` → execute the exact authorized step.
* `WAITING_PERMISSION` → resolve the missing capability without silently changing scope.
* `BLOCK` → do not execute.

Cinema/BrowserOS and RDC are provider surfaces; Spacetime remains the governance/execution authority.

### 7. Inspect evidence

The user-facing result should show action, plan alignment, permission, evidence, and execution/audit state.

### 8. Treat incomplete acceptance honestly

Current open acceptance gates include authenticated Workroom user E2E, authenticated Cinema/BrowserOS E2E, promoted-source public governed MCP closeout, and XR promoted-source smoke.

### Current production references

| Purpose               | Verified reference                                                      |
| --------------------- | ----------------------------------------------------------------------- |
| Product               | `https://dsg.pics/`                                                     |
| Workroom              | `https://dsg.pics/dsg/workroom`                                         |
| Production MCP        | `https://aws.dsg.pics/mcp`                                              |
| OAuth metadata        | `https://aws.dsg.pics/.well-known/oauth-protected-resource`             |
| Cinema runtime health | AWS internal `:8000/health` → HTTP 200, `status=ready`, `backend=ready` |

The retired Azure Container Apps dashboard URL is historical only.