Enough to run a pilot today.

1. Sign in at app.sparringhq.com with Google Workspace. The first user from a new domain becomes the organisation owner.
2. Settings → set your transparency policy, retention, default language and debrief delivery.
3. Invite managers and learners (invite link or domain auto-join).
4. Practice → pick a scenario → spar → Debrief now or Debrief in background (email/webhook).
5. Team → watch the heatmap fill in.

A session is 8–14 player turns. The counterpart's temperature (0–100) and the objectives are shown live. Hint gives one situation-specific nudge (never a script). Ending a session triggers the judge; the debrief appears in 1–3 minutes.

Debriefs contain: verdict with evidence, outcome (success/partial/failure) separate from stars (0–3), objective verdicts with quotes, skill ratings, strengths and weaknesses with quotes, rewrites, the method behind the key move with source, reflection questions. Learners can download report.md and delete sessions.

Safety protocol: disclosures of self-harm, harm to others or abuse stop the session before any model call and show crisis resources. Configure a notification webhook in Settings.

Register an agent (Arena → Register), choose a suite and gate, run. Adapters:

• openai-chat — any /v1/chat/completions endpoint (OpenAI, Azure, vLLM, most frameworks). Set model if the endpoint needs it.
• anthropic-messages — /v1/messages endpoints.
• webhook — we POST { scenarioId, messages: [{role, text}], turn }; you return { text }.

Credentials: use env:NAME to reference a secret we hold in Secret Manager, or paste a literal (not recommended). Transcripts and reports are stored in your tenant.

Create an org API key (Settings → API keys, role manager or above). Then:

npm i -g @sparring/arena   # or npx sparring-arena
export SPARRING_API_KEY=sk_...
sparring-arena run --agent agent.json --suite arena-redteam-core --gate gate.json --junit arena.xml --repeats 2
# exit 0 = gate passed · exit 1 = gate failed · report.md + sessions.json + reports.json written to ./arena-runs/<run id>/

GitHub Actions example on the Arena page. The JUnit file plugs into any CI test reporter.

// agent.json
{ "name": "support-bot v12", "adapter": "openai-chat",
  "endpoint": "https://bots.example.com/v1", "model": "support-v12",
  "authRef": "env:SUPPORT_BOT_KEY",
  "systemPrompt": null }          // optional override for A/B tests

// gate.json
{ "minAvgScore": 75, "minStars": 2,
  "maxBreaches": { "critical": 0, "major": 1 },
  "minObjectiveRate": 0.8 }

Base URL https://app.sparringhq.com/api. Auth: session cookie (UI) or Authorization: Bearer sk_… (org API key). JSON in, JSON out. Rate limit 90 req/min per principal.

GET  /scenarios?context=sales&surface=practice     list scenarios (incl. your Studio scenarios)
POST /sessions            { scenarioId, locale? }      start a practice session
POST /sessions/:id/turn   { text }                     player turn → counterpart reply (JSON)
POST /sessions/:id/turn-stream { text }                same, as text/event-stream (preview + final)
POST /sessions/:id/hint                                 one coach hint
POST /sessions/:id/end    { background?, email? }      end + judge (inline or background job)
GET  /sessions/:id        · GET /sessions/:id/report.md · DELETE /sessions/:id
GET  /jobs/:id                                          background job status
GET  /org/dashboard?days=30                             team metrics
POST /arena/agents        · GET /arena/agents
POST /arena/runs          { agentId, suite|scenarioIds, repeats?, gate? }
GET  /arena/runs/:id      · GET /arena/runs/:id/report.md · GET /arena/runs/:id/compare/:otherId
POST /studio/draft        { material, context, surface, industry? }
POST /studio/scenarios    { scenario }  · PATCH /studio/scenarios/:id { status: "published" }
GET  /org/members · POST /org/invites · PATCH /org/settings · GET /org/usage · GET /org/audit

Studio → paste material (policy excerpt, SOP, product sheet, anonymised notes; ≤ 12,000 characters) → choose context and surface → Draft. Review the draft (every field is editable), Validate, Publish. Published scenarios appear in Practice and Arena for your organisation only and can be exported as JSON for the CLI.

Google Workspace sign-in is built in. Settings → Auto-join domains lets anyone with a matching email join as a learner. Roles: owner (billing, settings, members), admin (settings, members, Studio), manager (team dashboards, Arena, Studio), learner (practice, own debriefs). Invite links carry a role. Microsoft Entra on request.

Settings → Debrief webhook accepts a Slack, Teams or Feishu incoming-webhook URL; every completed debrief posts a summary. Email reports sends the Markdown debrief to the learner. Background debriefs let a learner close the tab; the debrief waits under My debriefs.

Subscribing on Marketplace redirects to our sign-up with a signed token; we create (or link) your organisation to the Google Cloud billing account and activate the entitlement. Usage is reported hourly as practice_session and arena_session. Private offers apply automatically on acceptance. See Marketplace.

Scenarios are JSON validated by a shared zod schema: localized strings ({ en, zh? }), characters[] with stance, hidden, revealWhen, pressure[], limits; objectives[] with skill and evidenceHint; optional guardrails[] with severity and tripwires[] (regex); difficulty 1–3; maxTurns; source. Cross-field rules: every objective's skill must be in skills; every skill's competency must be in competencies; tripwires must compile. Studio produces this shape; the CLI consumes it.