Key registry
Pairing offers
The new device enters the offer code; you confirm the claim here, in this session. The secret is shown to the device once.
Service registry
Unified audit timeline
Coverage findings
Exception register (D-A9)
Credential cliffs
Credentials whose expiry is a cliff — a key, cert, token, or subscription that hard-stops on a date. Rows are derived live from the key registry plus the stored rows below; an expiry that cannot be verified is recorded as unknown so the unknown is watched, not forgotten.
Notifications
The notification engine's incident registry: one open incident per event fingerprint, every routing decision recorded on the incident — suppressed deliveries are listed with their reasons, never silently dropped. Acknowledgement is server-side and stops escalation, not the incident.
Preferences
S2/S3 subscriptions are tunable per source. S0/S1 delivery is a structural floor and cannot be raised by preference (GK-5005).
Backup protection
A row is green only with a fresh backup, a restore test inside cadence, and — where required — a working off-box leg. The off-box provider is decision D-A5: Google Drive, for family apps' state/config archives only (uploaded Fernet-encrypted — Google holds ciphertext only). Estate rows (documents, photos, machines) are not D-A5 scope and say so.
Approvals — arbitration
Gatehand arbitrates dockhand token mints: it holds
one dockhand mint credential (dhm_) in the vault and
mints on a requester's behalf only under the standing policy
below or your per-mint approval here. Nothing mints by silence —
a request that is not approved simply expires. Revoking a
dockhand token is not arbitrated: that stays
with dockhand's own master / break-glass path (A′).
Standing policy
Pending approvals
File a mint request
Filing goes through the same pipeline as an agent's request. A read request inside the standing policy executes immediately and its value is shown once. Anything else — every deploy request included, even one you file here yourself — lands in the pending queue above and mints only on your separate approval act in that queue.
History
Intent approvals
The generalized arbitration queue (v2.1.0): typed intent objects from across the estate, decided here or under the standing authorization policy below. Approving an intent mints a single-use approval token held in the vault for the owning app — the value is never shown here and never leaves in an object payload. Intent rows also appear in the mint lists above as projections; their decide controls live only in this section.
Pending intents
In flight
Decided history (last 7 days)
Standing authorization policy
File an intent
Filing goes through the same pipeline as any requester's intent. One inside the standing authorization policy is approved by standing immediately; anything else lands in the pending queue above and is decided only by a separate approval act there.
Act catalogue
Arbitration telemetry
Search
One index over the estate's read models — downloads, library, containers, network, system, and activity. Results are only as fresh as the index below; a stale index is rebuilt server-side before matching.
Modes
Suspension is separate from revocation and needs no re-pairing. The kill switch halts automated paths; manual control here is unaffected.
Upstreams
Passkeys
Recovery codes are shown once when generated; each works for exactly one sign-in. Regenerating invalidates the previous set.
Sessions
Credential vault
Values are never displayed — the vault shows existence, fingerprint, and rotation time only.
Dead-man's switch
Third-party ping service (decision D20). gatehand pings on schedule; silence alerts through the provider's own path. Creating the check is done at the provider.
Backups
Archives are Fernet-encrypted as a whole and verified at creation. Restore stages a boot-swap: it applies at the next restart, after a pre-restore safety backup.