Rules, costs and the record

These four screens sit in the Fleet group (Advanced: Fleet · Govern), beside Agents and Sessions.

Rules

(Advanced name: Policies.) What agents may reach on the internet, which commands they may run, and who may sign in — three tabs:

For each document the screen says where it lives — on this host at a path, shipped inside the binary, or from a policy library and assigned to nothing — and the validator's verdict, in the validator's own words when it refuses. "This one loads. Nothing turns on until it is assigned." is what a valid, unassigned document says.

⚠ The Rules screen is read-only. It shows what is on the host and whether it loads; it does not assign, admit or merge a rule-set, and a Merge… button it draws says that no engine act performs it yet. Egress is closed by default and changed on the host — see Egress control; permission classes are in Configuration.

⚠ People lists no one: the register of people and their sign-ins lives in the authorization server's own administration, outside the engine, and this console has no reader for it. See Authorization server and Identity.

Costs

(Advanced name: Ledger · Costs.) Money, read from the record. Every figure carries its billing class: Metered is money somebody is billed; Subscription allowance is a shared quota nobody is billed for. A figure whose class the record does not carry is shown as a list-price equivalent and says so.

Two tabs:

• Costs by day, for Today, 7 days, 30 days or All.
• Runs · quote vs actual — each run's quote against what it actually cost, and the drift: under, at quote, over, in flight, no quote, not priced.

The money line at the foot of the sidebar is read from the same record. See Operations for how work is quoted and capped before it is spent.

Documents

(Advanced name: Documents · train · wagon.) Every document the store holds — plans, orders, reports, reviews — arranged train → wagon → document, latest work first. Filter by train, date and actor, or search titles, file names and text across every train.

Each document names its train, its wagon, who wrote it and when, and its signature verdict: Signed, Not signed, Changed since it was signed, Signature does not check out, or Not checked. A document that does not say which train it belongs to is listed under No train until it names one.

Audit

Every signed record in the ledger, in order — read-only. Search by record, actor, train or reference; filter by kind, actor and date. A record opens with its fields, its signature — checked when you open it — and the raw record.

Export… writes the current filter or the whole ledger as JSONL with signatures or CSV without them, optionally with a verification manifest. An export is a read: it signs, changes and removes nothing.

⚠ The list itself does not verify a hash chain over the records: the store keeps none yet, and the screen says not measured rather than showing a chain as checked.