Control plane

Every agent task and the state its events put it in, with the risk class of the tools it can reach.

Task states and tool risk classes are read from the API and the generated Hermes surface manifest. Latency and load balancing are not built, so no agent is ranked here.

What each Council agent declares it is for, what it says it cannot do, the shape it promises to answer in, and how it asks to be judged.

Read from GET /agents and, per row on demand, GET /agents/{slug}. Both were complete and had no caller under apps/web until this panel. Capability counts read 'not read' rather than 0 until the detail route answers, because the list route sends no arrays; and is_active is only called a measurement on the detail route, because the list route filters on that very field.

Whether an intent's history is hash chained end to end and whether a signed receipt certifies exactly that chain.

Read from the provenance route added in migration 019. A chain that is intact but incomplete is receipted on trust, and the card says so rather than showing it as verified.

The drafts DEVON wrote for itself from finished work, and the human ruling on each one.

Read from the skill proposal routes on the agent expansion surface. Every field shown comes back from that read. Approving a draft and activating a skill are two separate rulings and the panel sends them as two separate values, because the API defaults promotion to on when the key is left out.

Every question the Council was asked, and the human final call on it.

Read from the decision routes. Until this panel existed nothing under apps/web called any of them, so a ruling made on the deliberate page lived in one browser tab and a reload discarded it. A failed read is drawn as unreadable, never as an empty record, and an exchange whose tracked state could not be read says so rather than reading as not recorded. Recording a call writes to the decision record only: no tool runs from here.

The two doors that can execute, and where secrets do and do not live.

Both shells are live and predate this arc, so this panel points at them rather than embedding a PTY inside the control plane. There is no secret vault, by design, and whether one should exist is a ruling rather than an omission.

The avatar driven by blendshape frames over the presence socket, with client side barge-in.

Frames, the sliding window buffer and the interrupt path are real against the presence service. Cartesia is reached and proven: Tee heard his own cloned voice on 2026-09-09, 113 frames sent and received with none dropped, ten audio chunks scheduled and none late or undecodable. LiveKit is still not configured and this build publishes no audio into a room, so the socket carries the voice. The face is a procedural placeholder until an owned rig exists.

The scope every other read can be narrowed by, and the only place to create or rename one.

Rows, counts and every field shown come from GET /projects, and creating and renaming go to POST /projects and PATCH /projects/{id}. Until this panel existed nothing under apps/web called any of them, so the project_id the knowledge routes and the graph route filter on could only ever be null. A failed read is drawn as unreadable, never as an empty list, and a 200 carrying rows with no usable id is drawn as neither. Archiving is accepted by the patch route and is deliberately not offered here.

The corpus DEVON recalls from, a search that runs against it, and the measured distances between its items drawn as a graph.

Items, the source breakdown and search come from the knowledge routes. The graph below reads GET /knowledge/graph, whose distances are pgvector cosine distance, the minimum over each pair of items chunks. The first attempt at this panel was PULLED on 2026-09-10 for reading a payload shape the route does not send and stating a measurement over a query that had not run; it ships now with its fixtures generated from the route itself, so the two cannot drift apart again. It still refuses to call a simulated or unavailable embedding real, and it names every cap that bit.

The memories and skills every agent plan is handed, and the only place to write one.

Rows and counts come from the two learning routes. Until this panel existed nothing in the estate wrote to either table, so the store was empty by construction. A failed read is drawn as unreadable, never as empty.

Everything stored about you that the Council can recall, and the only place to write, edit, pause or destroy one.

Rows and every field shown come back from GET /memory. The four routes were finished and tested before this panel and nothing under apps/web called them, so the Council's own memories about the owner accumulated where the owner could not read them. DELETE on that route is a hard delete, so deleting here is a two step ruling and the panel names what would be lost. A failed read is drawn as unreadable, never as empty.

The automation engine, the runs it has made, and the human ruling on every step that would write something.

Read from the six workflow paths. Until this panel existed nothing under apps/web called one of the engine's ten operations, so a workflow could not be composed and the approval gate the engine is built around had nobody standing at it. The payload a gate would write is rendered in full and its sha256 seal is sent back with the approval, so the server refuses a ruling given over a payload the run has since moved past. A gate the API reports as diverged carries no approve control at all.

Today's spend against the hard cap that refuses at 429.

Read from the usage route over the provider usage ledger. Warning thresholds are not built, so nothing here claims a warning was sent.

Execution telemetry, retries, queue depth and version sync against GitHub.

GET /n8n/executions reads the configured instances, so recent executions and failure counts are sourced. Retries, queue depth and version sync are not built and are not drawn. Any plan cap is stated by configuration and the spend against it is estimated from the execution id gap, never measured, and is refused entirely when the ids of a window contradict its clock. No date is projected: every date on this tier is observed from an execution row or stated by configuration. Workflow names are NOT in the executions response, so a row is labelled by its workflow id and says so.