Operate cockpit

When something looks wrong in production, you want one screen that answers: are my fleets healthy, which bundle is each Auth Site serving, and did that revocation actually land? The Operate cockpit — the console’s landing screen — is that screen: fleet visibility, bundle distribution, revocation propagation, and audit evidence for the selected scope, built from same-origin Control reads. In the current console release this screen is read-only; it reports the operations that the rest of the console and Control carry out.

Select your context first

The cockpit is scoped by environment, fleet, and Auth Site. The “Operate context” panel at the top carries a “Read-only” badge and shows four fields:

• Environment — the selected environment, or “Environment required” if none is selected.
• Fleet — the selected fleet, or “Fleet optional”.
• Session — “Resolved by Control” when your session is valid.
• Control API — “Reachable through BFF” when Control responds through the same-origin BFF.

Context is required in stages:

• Without an environment, the cockpit shows an “Environment required” notice: Operate uses environment-scoped fleet, bundle, revocation, and audit reads, so you must select an environment (or pass environment_id in the URL).
• Without a fleet, a “Fleet context optional” notice explains that Auth Site readiness needs a selected fleet_id, while fleet totals still render from the environment-scoped fleet list.
• With multiple Auth Sites in scope, an “Auth Site context required” notice asks you to select one with site_id before the cockpit loads promoted generation, target key, protected surface, API, or route detail. If the requested site_id is outside the selected environment and fleet, the cockpit says so explicitly — no other Auth Site is used as a fallback. If no Auth Site exists in the selection, it reports that too. In all of these cases the readiness table below still renders.

If the page data itself cannot load, the cockpit shows an “Operate cockpit not loaded” notice instead of partial content.

Headline metrics

Four metrics summarize the selected scope:

• Fleets — count of fleets in the environment.
• Sites ready — sites whose status is active, ready, or healthy.
• Sites stale — sites whose status is stale, unavailable, or retired.
• Revocations active — current revocations for the selected distribution target that are not yet completed or failed.

When an underlying read fails, the metric shows the read’s status instead of a number: “Denied”, “Unavailable”, “Not configured”, or “Not loaded”.

Fleet and Auth Site readiness

The “Fleet and Auth site readiness” table lists fleets and sites together with columns: Kind, Name, Status, Location / mode, Last seen / updated, and Identifier. Fleet rows show the bundle pull mode; site rows show the location hint and last-seen time. Status badges are toned by state — good for active/ready/healthy, warning for pending/stale/paused/propagating, critical for failed/blocked/unavailable.

If Control does not return fleet state, an “Auth fleets unavailable” notice appears; if it does not return site state for the selected fleet, “Auth sites unavailable” appears.

Bundle publications and distribution

A second metrics row covers distribution:

• Current bundle — the selected bundle version, or “0 / not published” when Control returned an empty publication list.
• Publication — the publication status of that bundle.
• Targets — 1 when a distribution target is selected, otherwise 0.
• Target key — the number of registered target keys, or “not registered” when the read succeeded but returned none.

The “Bundle and distribution state” table shows up to five publication rows for the selected bundle version with columns: Bundle, Publication, Sequence, Digest, Freshness, and Distribution target. When Control returns no publications, the cockpit says so plainly (“Bundle publications: 0 / not published — Control returned an empty bundle publication list for this environment”); when the read fails, it shows “Bundle publications unavailable”.

When a distribution target is selected, a “Selected distribution target” panel (badged “Public metadata”) shows the Target, Fleet, Site, and Status — “promoted” when a bundle version is selected, otherwise “pending promotion”.

Revocation propagation

Revocation state is split into current propagation for the selected target and historical records, because they carry different levels of evidence.

The revocation metrics count current selected-target revocations by state: Pending bundle, Awaiting exact ACK, Completed / acknowledged, and Blocked / failed.

Selected-target current revocations

The “Selected-target current revocations” table shows up to 16 rows with columns: Revocation, Target, Bundle, Target config, Expected / activated (instance counts), Exact match (an “Exact acknowledgement” or “Not exact” badge), Acknowledged (timestamp, or “not acknowledged”), and State. A revocation only counts as Completed / acknowledged when the acknowledgement exactly matches the promoted configuration; otherwise it stays in an awaiting or pending state:

• Pending bundle
• Published / exported
• Awaiting exact activation acknowledgement
• Completed / acknowledged
• Blocked / failed

Current propagation is shown only for the selected Auth Site distribution target. Without a selected target the cockpit shows “Selected target required for current revocations” and asks you to choose an exact Auth Site before interpreting current propagation. If current revocation records exist for a different target, a note counts them and states they are intentionally not counted as selected-target propagation.

Historical revocations

Historical records render in a separate table titled “Historical revocations — exact acknowledgement not recorded”, with the same columns and up to 32 rows. Their state label is “Historical — exact acknowledgement not recorded”: Control retains the record, but an exact activation acknowledgement was never captured for it, so treat these as history rather than propagation proof.

If the revocation read fails, the cockpit shows “Revocations unavailable”; if Control returns none at all, “No revocations returned”.

Audit evidence

The “Audit evidence” panel summarizes runtime authorization decisions: Total decisions, Allowed, Blocked, and Protection rate. An “Open audit” link takes you to the full Audit screen. If Control does not return the summary, the panel shows “Audit summary unavailable” instead of zeros.

Next steps

• Auth Sites — inspect per-site distribution readiness in depth
• Audit — full runtime authorization evidence
• Control console overview — how the cockpit fits the rest of the console