The operator console

The control plane is a desktop operator app (Tauri + Svelte) that talks directly to the orchestrator over gRPC. It is a dense, multi-pane console, not a chat window: you drive sessions, read the live agent tree, manage the model and credential plane, and watch spend. This page is the deep, per-surface reference — what each surface shows, and when you reach for it. If you have not opened the app yet, start with the console tour; this page assumes you are past that.

Prerequisites

A healthy local stack — see The local stack. The console dials the orchestrator’s gRPC listener at http://127.0.0.1:50051.
bun for the dev app.

Launch it

Run the dev app from the repo root:

cd ui/control-plane
bun run dev:app

dev:app is a worktree-aware launcher: Vite serves the webview, Cargo builds the Rust bridge, and Tauri opens the native window. The main checkout uses Vite port 1420; each linked git worktree gets its own port and isolated app-data, so several worktrees run side by side without colliding on port or sharing layout and settings state. The first run compiles the bridge and is slow; later runs are incremental. Leave it running — it is a live dev process.

To produce a packaged desktop build instead, run bun run tauri build, which bundles a native apomesh installer for your platform.

Connect and auth posture

On launch the app re-opens the channel to your last endpoint and comes up connected; a fresh install first seeds the loopback stack’s orchestrator (local, http://127.0.0.1:50051) so the console is online with no setup. The endpoint chip in the connection bar shows the target and a status dot — green connected, pulsing while it dials, red on error.

When no channel is live, the three runtime modes render a connect prompt instead of a broken workspace, in one of three honest states: no endpoint registered (Register an orchestrator → Infrastructure ▸ Endpoints), an endpoint present but not connected (Connect), or a dial that errored (Retry, plus Manage endpoints). Settings stays reachable throughout, since it needs no orchestrator.

An endpoint’s auth posture — the authentication backend (None, API key, OAuth, or mTLS), TLS, a pinned server CA, and an SNI domain — is set per endpoint and shown in Infrastructure ▸ Endpoints, where a Probe reports round-trip latency and the backend the orchestrator answered with. See Identity & authorization for what those backends mean.

The shell

Every window shares one frame:

A connection bar across the top — the active endpoint and its status dot, the current tenant, the selected session’s id, a LIVE pulse while that session runs, and the ⌘K hint.
A narrow nav rail down the left with four modes: Execution, Catalog, Infrastructure, and Settings.

Execution

Execution is the runtime-operations view — where you drive a session and watch it run. With no session selected it shows a Fleet overview: rollups (active, stalled, tracked, pending gates, cost burn), your recent sessions, and quick actions to start a run or manage endpoints. Select a session and the mode becomes a three-pane workspace over a bottom timeline.

The sessions rail

The left rail lists sessions under three tabs. Live is the in-memory tail of sessions running (or run) in this app session. History lazily loads completed sessions from the durable log; selecting one rehydrates its event tail so every facet reads its real turns. Recov. lists recoverable sessions you can resume from their last checkpoint. + New session opens the Catalog to configure and launch one.

The agent graph

The center canvas renders the session’s agent spawn tree, headed Execution graph · N agents. Switch layout with the Tree / Radial / Flow / List toggle (Flow is the default and your choice persists); flip Detail ↔ Scale · N to collapse a wide fan into ×N clusters for a large run; cycle the heat encoding across cost / tokens / latency; and pan/zoom with − / + / Reset / Fit. In Scale mode a breadcrumb (root › cluster ×N › worker) plus Reset view track your focus. Click any node to scope the inspector to that agent — the canvas ring and the inspector share one focus.

Flow’s swimlanes are named for the loop that is actually running. A live session reports its coordinator, so a debate reads Coordinate → Debate → Judge → Reduce and a self-consistency run reads Coordinate → Sample → Judge → Reduce, rather than every session being narrated in VMAO’s Plan → Execute → Verify → Synthesize vocabulary. A programmatic session runs its control flow inside its own resident runtime, so it has no substrate skeleton phase to name and its bands stay descriptive.

The right pane is an eight-facet inspector — Overview, Events, Cost, Memory, Tools, Output, HITL, Chat — re-scoped to the graph selection. Each facet answers a different question.

Overview

The agent’s identity at a glance: capability tier, the running loop’s current phase, live state, self and subtree cost, a token-budget bar, and its parent/children/tools/current-activity rows. For a completed or time-travelled selection it also shows the resolved config the agent actually ran with. Reach for it first to orient on a node.

Events

The raw envelope stream scoped to the selection, one row per event (sequence, time, variant pill, summary); consecutive streaming chunks fold into one counted row, and a click expands any row to its raw JSON. Reach for it to see exactly what the substrate emitted, in order. Grounded in the event log.

Cost

The authoritative spend rollup: self vs subtree, the by-provider / by-profile / by-model / by-tool breakdowns, and prompt / completion / cached token counts. The figures come from the substrate’s own rollup rather than from anything the console re-derives. Reach for it to attribute spend across a run’s subtree. See Budgets & cost.

Memory

The four memory tiers — Working / Episodic / Semantic / Procedural — for the selection, toggleable between This agent and the whole Session, each showing its access mode and bound space. Current-state only; there is no temporal scrub for memory. Reach for it to see what an agent knew, retrieved, and stored. See the memory plane.

Tools

Every native and MCP tool call for the selection with its full input and result, badged Native or MCP, errors flagged; a root selection aggregates its child workers’ calls. Reach for it to inspect what an agent actually invoked and what came back.

Output

The terminal verdict (complete / failed / accepted-partial), the full synthesized deliverable (with Copy as Markdown), any citations, and reproducibility provenance. A deep-research run renders its structured report. Reach for it for the run’s deliverable.

HITL

The human-in-the-loop decision surface (see below). Its tab pulses and pulls focus when a gate is pending, so a blocking decision is never missed.

Chat

The session as a conversation: the goal as the opening turn, the agent’s turns, and the terminal card, with a composer to draft a follow-up (⌘↵ to send). Reach for it to read a run as dialogue rather than as an event stream.

Turns render rich markdown — LaTeX via KaTeX, mermaid diagrams hydrated in place (with the source kept visible if the diagram fails to render), diff blocks with per-line highlighting, and a collapsible reasoning disclosure for models that emit it. Prose dollar signs stay prose, and the sanitizer’s style allowance is scoped to the math subtree rather than widened for everything.

Responding to a HITL gate

When a run pauses for a decision, the inspector pulls focus to HITL and its tab pulses. The gate shows the trigger, the proposed action, and accrued cost, with three responses: Grant more (approve — for a stall, grant additional iterations, or a per-dimension budget of tokens / time / cost, with optional free-text guidance to the resumed planner), Accept partial (take the work so far), and Reject (which requires a reason). Resolved gates list below with their resolution.

The timeline, cancel, and resume

The bottom timeline scrubs the session through time. Drag or step (‹‹ / ››) back to a past position and the workspace reconstructs the structural state — topology, resolved config, cost, and memory provenance — as of that point, badged REPLAY; events, tools, and output stay current. Jump to live re-pins to now. The phase legend (Plan / Execute / Verify / Synthesize) colours the track. To cancel a running or pending session, press ⌘. or use the command palette. To resume a killed run, pick it from the sessions rail’s Recov. tab. The mechanics are covered in replay & history and reconstruction & recovery.

Catalog

Catalog is the discovery and authoring surface for agents. Its sub-rail has five sections.

Agents — browse the base agent definitions, open one to its detail (VMAO role structure, tool surface, allowed models, default skills, per-role plane, strategy lock), and act on it. Configure & launch opens the per-role composer; Publish seals it (below). Grounded in the agent-configuration plane.
Published — the versioned, addressable published agents. Each name fans out to its immutable versions with a visibility scope; a version’s detail shows its locked shape, its sealed bundle, its running sessions, and a serving exposure toggle (Internal ↔ Served — Served admits the shape to the A2A card catalog). Launch session starts a run from the pinned shape. See Published agents.
Strategies — the versioned strategy configurations an agent can bind, each a coordinator skeleton plus locked params. + New configuration authors and publishes one. See Coordination loops.
Models — a read-only browse of the model catalog.
Skills — browse and inspect registered skills, and publish a skill you own at a pinned version and visibility scope.

Configure & launch

From an agent’s detail, Configure & launch opens the per-role composer. Set a session goal, an optional session model fall-through, and a strategy configuration, then tune each of the four VMAO roles — Planner / Worker / Validator / Synthesizer — over its own tab: model, tools, skills, memory scope, budget, episodic sharing, confer relevance floor, and generation knobs. Unset controls inherit the strategy/substrate default. Launch session starts the run and switches you to Execution. The vocabulary here maps to manifests & launch.

Publishing an agent

Publish promotes a working agent to the registry at an immutable (name, version). A pre-flight panel — “Publishes this shape” — lists the referenced skill closure (each badged as published-in-your-tenant or not) and the strategy lock; an unpublished reference warns but never blocks, because the substrate resolves the full closure server-side. Set the published name (e.g. io.descoped/deep-research), a MAJOR.MINOR.PATCH version, and a visibility scope, then Publish version. A version is forever — republishing is always a new version, never an overwrite.

Launching a published agent

Under Published, the registry lists each published name with its version count and latest visibility; pick a name, then a version from its group, to open that shape’s detail — its locked per-role plane, context bindings, strategy configuration, sealed bundle, and any running sessions. Launch session opens a form that exposes only the run knobs: goal, optional title and success criteria, budget, on-stall posture, replan/coverage caps, operator prompts, and a test-run flag. The shape itself — tools, model, strategy, per-role plane, context — is locked to the published version, so there is no tool or model picker here. Launch switches you to Execution with the live run.

Infrastructure

Infrastructure is the admin plane behind the catalog. Its sub-rail groups seven sections into config and fleet. Every section is the same searchable master-detail surface: filter the list at the top, click a row to open its detail on the right, and act from there; Refresh re-polls the substrate.

Config

Models — the per-tenant model catalog: create, edit, and reset model specs, including per-class routing defaults and rate rows.
Providers — provider profiles; each binds a provider kind to a credential. Add one with + New profile.
Credentials — the sealed per-tenant secret store. Entry is write-only: the list shows only a redacted row (kind, provenance, fingerprint), a secret travels in on save and is never read back, and editing rotates it (a fresh value is required). See the credential plane.
Tools & MCP — two facets under one section. Tools is the read-only registry (substrate + MCP-discovered + operator tools) with each tool’s category, source, and JSON-Schema input. MCP servers is full CRUD — register, edit, and probe stdio or HTTP servers; the auth header is write-only.

Fleet & probe

Workers — the cluster-wide worker fleet, a read-only live poll of each worker’s tiers, lifecycle, load, hosted tools, and heartbeat. See Workers.
Endpoints — the orchestrator registry admin: probe an endpoint’s health, promote one active, connect / disconnect, and remove. The detail shows its URL, TLS, auth backend, server CA, and SNI. See the orchestrator.
Playground — a provider/model probe tester in Chat or Embedding mode: pick a provider and model, send a probe, and read the response, cost, latency, and the outbound auth mode.

Settings

Settings persists to local disk and needs no orchestrator, so it works while disconnected. It has four sections:

Appearance — theme (Light / Dark / System), font scale, table density, and date format. Theme applies without a restart.
Behavior — the default on-stall policy, confirm-before-cancel and confirm-before-delete guards, and the per-session event-tail buffer cap. A Notifications card is present but inert until the notification plugin lands.
Network & Logging — the connect timeout (wired through to the channel today), plus keep-alive and retry knobs and a log level that persist but are not yet active.
About — the control-plane version, an inert update toggle, and a Reset to defaults that leaves your endpoint registry and layout untouched.

Keyboard and the command palette

Three window-level chords work anywhere in the console:

Chord	Action
`⌘K`	Open the command palette.
`⌘/`	Show the keyboard cheat sheet.
`⌘.`	Cancel the selected running session.

Within a text field two more apply: ⌘↵ sends the Chat facet’s follow-up, and Esc closes the palette or cheat sheet.

The command palette (⌘K) is the fastest way around. Type to filter, then ↑↓ to move, ↵ to run, Esc to close. Its results group into Navigate (jump to any mode and section), Sessions (jump straight to a live session), and Actions (new session, connect/reconnect endpoint, toggle theme, jump to Execution, cancel the current session, show the shortcuts).

Where this shows up

Budgets & cost — the Cost facet and how spend is capped.
Sessions, events & durability — the event model the Execution mode projects.
Credential plane — what the Credentials section manages.
Coordination loops — the strategies a launch binds.
Monitoring — watching the stack beyond a single session.