docs: align Agentic Platform guidance with the Console (#26422)

The Agentic Platform docs referenced outdated Secrets controls and
omitted steps needed to configure MCP clients, network rules, and SSH
access. This updates the navigation and task guidance from the October
23 UI audit, including sandbox restore actions, kit filters, naming and
compute selection, and delayed usage reporting.

Each of the 11 audit findings has a separate commit. Feature
availability is qualified where it varies by account. Signup
requirements and pause/process semantics remain unchanged; process
restoration still needs product confirmation.

All seven changed Markdown files passed rumdl and Vale with no errors,
warnings, or suggestions.

@netlify /agentic-platform/

Generated by Codex

content/manuals/agentic-platform/get-started.md

@@ -221,11 +221,12 @@ or compute size. Configure these options before selecting **Run**:
 
 | Option | What to choose |
 | --- | --- |
+| Sandbox name | Select **randomly** to enter a name, or keep the generated name. |
 | Agent credentials | Add the API keys or tokens your kit needs. Saved credentials are reused by default; deselect optional credentials you don't want to include. See [Secrets](secrets.md). |
 | GitHub token | Provide a token for Copilot or for cloning private repositories and pushing changes. Copilot uses the same token for both. Repository access is optional for other agents. See [GitHub credential](secrets.md#github-credential). |
 | Network policies | Review the hosts and services the sandbox can reach. See [Network policies](policies.md). |
 | MCP tools | Choose the servers your agent can use and authorize them if prompted. See [MCP](mcp.md). |
-| Compute and platform | Choose CPU and memory resources. Under **Platform**, use **auto** or a platform supported by the kit's image. See [Sandbox platforms](sandboxes.md#choose-a-platform). |
+| Compute and platform | Choose a size based on the CPU and memory your task needs, from Micro for light tasks to XL for larger workloads. The picker shows each size's resources and hourly price. Under **Platform**, use **auto** or a platform supported by the kit's image. See [Sandbox platforms](sandboxes.md#choose-a-platform). |
 | Timer | Under **Run for**, choose 1 to 24 hours. Under **When the time is up**, choose **Stop**, **Delete**, or **Restart** if offered. See [Lifecycle actions](sandboxes.md#manage-the-lifecycle). |
 
 The launcher remembers your policy selections from the previous launch in the

content/manuals/agentic-platform/kits.md

@@ -27,7 +27,10 @@ When available, Docker Hub details include the publisher, pull and star counts,
 last update, architectures, and a security attestations indicator.
 
 1. Open **Kits** in the Console.
-2. Search by name or description.
+2. Search by name or description. If your account has custom kits enabled,
+   use **v2 kits** and **v3 kits** to choose which formats to show, and select
+   **Community kits** to include community results. Use pagination to browse
+   additional results.
 3. Select **Run** on a kit to open the sandbox launcher with that kit selected.
 4. Review its credentials, network policies, tools, compute size, and
    timer, then select **Run** in the launcher to create the sandbox.

content/manuals/agentic-platform/mcp.md

@@ -32,14 +32,20 @@ release doesn't support MCP-specific policies.
 
 To connect a server that is not predefined:
 
-1. Open **MCP**.
-2. Choose the option to add a server and enter its URL.
-3. Connect the server and authorize access if prompted.
+1. Open **MCP** and find **Add a server**.
+2. Enter a streamable HTTP MCP endpoint in **Remote MCP URL**.
+3. Select **Add**. Public servers are ready immediately. For servers that
+   require an account, authorize access after adding the server.
 
 ## Use tools from another client
 
 On the **MCP** page, use **MCP Gateway endpoint URL** to connect your external
 MCP client to the gateway. Select **Add to your client**, choose your
 client, and follow the connection and authorization instructions. Supported
-options include VS Code and Codex CLI. The VS Code instructions include an
-install link and a manual configuration example.
+options are Docker Sandboxes (SBX), Claude Code, Codex CLI, Cursor, VS Code,
+and MCP Inspector. The first connection opens browser sign-in. There is no
+token to copy.
+
+Sign-in is confirmed only for the listed clients. Follow the instructions for
+your client, including any exact flag or setting shown. Other clients may
+fail sign-in with an error page that looks like a password problem.

content/manuals/agentic-platform/policies.md

@@ -34,6 +34,15 @@ You can select zero, one, or several additional user policies. By default,
 **Open** is marked **Always applied**, unlike local sandboxes where you choose a
 network preset.
 
+On **Policies**, use the **Always applied** switch in the user-policy table
+to change this account setting, including for read-only presets. The setting
+is saved and controls which policies are required for future sandbox launches.
+Turning it off makes the policy optional in the launcher. Review your saved
+selections before launching.
+
+To use a preset as an editable starting point, select **Duplicate** on its
+row, edit the copied name and rules, and save the custom policy.
+
 ## How policies combine
 
 Allow rules from all applicable user policies and the kit are combined. A
@@ -76,9 +85,13 @@ as source control services, package registries, and model providers.
 ## Create a policy
 
 1. Open **Policies** and select **New policy**.
-2. Give the policy a name that describes what it's for.
-3. Add allow and deny rules for the required destinations.
-4. Review the rules and save the policy.
+2. Enter a **Name** that describes what the policy is for.
+3. For each rule, enter a **Rule name**, choose **allow** or **deny**, and
+   select **TCP**, **UDP**, or both. TCP is selected by default. To create a
+   UDP-only rule, select **UDP** and deselect **TCP**.
+4. Enter the destination patterns under **Targets**. Select **Add rule** to
+   configure another rule.
+5. Review the rules and save the policy.
 
 To apply the policy, select it under **Egress policy for this sandbox** when you
 create a sandbox.

content/manuals/agentic-platform/sandboxes.md

@@ -55,8 +55,10 @@ After you select **Run**, the Console shows provisioning progress. When the
 sandbox is ready, its detail page opens. Use the terminal to work with your
 agent or shell. Reloading the launch page resumes tracking the launch.
 
-Open **Sandboxes** to review each sandbox's name, type, status, hourly rate,
-expiration, and age. Select a sandbox to reopen its detail page and terminal.
+Open **Sandboxes** to find a sandbox by name using search, or filter by
+**Running**, **Creating**, **Paused**, **Error**, or **Expired** status. Review
+its **Kit**, **Cost**, **Time left**, and **On Timeout** action. Select a
+sandbox to reopen its detail page and terminal.
 
 The **New** page also lists **Recent sandboxes**. Select a sandbox to reopen it,
 or select **See all sandboxes** to open the full list.
@@ -75,8 +77,20 @@ own tab while you run commands in another.
 
 If the sandbox detail page shows **Connect**, open it to find SSH connection
 options. The panel includes a Docker Sandboxes CLI option and a connect script.
-For the script, manage your public SSH key under **Settings**. Follow the
-instructions in the panel for your chosen connection method.
+For the script, register your public SSH key first. Follow the instructions
+in the panel for your chosen connection method.
+
+### Register an SSH key
+
+1. Open the user menu and select **Settings**.
+2. Under **Sandbox SSH key**, optionally enter a **Name** for the key.
+3. Paste your public key into **Public key**, then select **Add key**. Use the
+   contents of your public key file, such as `~/.ssh/id_ed25519.pub`. Never
+   paste your private key.
+
+Only the public key is stored. It takes effect immediately, without restarting
+a sandbox. Check **Registered key** to review it. Adding another key replaces
+the registered key. To remove it, select **Delete key** and confirm deletion.
 
 ### Access a service by port
 
@@ -96,8 +110,8 @@ action next to its port.
 A sandbox can be running or paused:
 
 - Pause a running sandbox to stop it without deleting its files.
-- Resume a paused sandbox to continue working with it. Resuming starts a fresh
-  timer with the original duration.
+- To resume a paused sandbox, select **Restore to connect** in the list or
+  on its detail page. Resuming starts a fresh timer with the original duration.
 - Delete a sandbox when you no longer need it.
 
 When you create a sandbox, set a timer from 1 to 24 hours and choose

content/manuals/agentic-platform/secrets.md

@@ -67,14 +67,15 @@ separate selection step. If a required credential is missing when you select
 
 ## Add a custom secret
 
-Use a custom secret for a service outside the built-in provider list.
+Use a custom secret for a service outside the built-in provider list. This
+option is available only for accounts with custom secrets enabled.
 
-1. Open **Secrets** and select **New secret** in the **Custom** section.
+1. Open **Secrets** and, under **Add a secret**, select **Custom secret**.
 2. Enter the hosts that may receive the credential.
 3. Set the request header and value format, such as `Authorization` and
    `Bearer %s`, then enter the secret value.
 4. Optionally, set an environment variable name for the credential.
-5. Name the secret and save it.
+5. Name the secret and select **Create secret**.
 
 Expand the secret's row to copy its generated placeholder. Use that placeholder
 where your client expects a credential. The sandbox proxy substitutes the real
@@ -83,13 +84,13 @@ sandbox.
 
 The launcher includes all your custom secrets when you create a sandbox. To
 edit a custom secret, enter its value again; saved values can't be retrieved.
-You can also remove custom secrets from the **Custom** section.
+You can also remove custom secrets from the **Saved secrets** table.
 
 ## Manage secrets
 
-The **Secrets** page shows each secret ID and the sandboxes that use it. Select
-the copy icon to copy the secret ID, or select the edit icon to change the
-stored value.
+The **Saved secrets** table on the **Secrets** page lists each secret's name,
+type, compatible kits under **Works with**, and last update. Select the copy
+icon to copy the secret ID, or select the edit icon to change the stored value.
 
 Agents see a secret ID instead of the actual key or token. For requests that
 match the secret's configured service, the sandbox proxy substitutes the real

content/manuals/agentic-platform/signup.md

@@ -52,9 +52,14 @@ Cloud sandboxes use pay-as-you-go compute with no recurring subscription fee.
 Docker meters compute in seconds, based on sandbox runtime and the CPU and
 memory configuration. Your model provider bills inference separately.
 
-Open [Usage & billing](https://agentic-platform.docker.com/usage) in the Console
-to review pricing, usage, and available credits. Compute credits offset
-eligible cloud compute usage; they don't cover model-provider charges.
+From the Console user menu, open
+[Usage & billing](https://agentic-platform.docker.com/usage) to review runtime
+quantities, estimated totals, and available credits. Usage can take up to
+48 hours to update. Under **Payment & account**, select **Manage in Docker
+Billing** to manage your account and payment details.
+
+Compute credits offset eligible cloud compute usage; they don't cover
+model-provider charges.
 
 Billing is monthly, on the day you subscribed. Your invoice reflects usage
 accrued during the previous billing period. Stop or delete sandboxes you no