The GUI, screen by screen
Included from Basic tier
The reference shelf behind lesson 9.1's tour: every entry of the
sidebar, what you do there and the CLI verb that does the same — the
Dashboard's Insights panels, the Governance group entry by entry and the
Operations area panel by panel. Lesson 9.1 (opschain learn 9.1) walks
the eight stops; this guide is where to look a screen up afterwards.
The sidebar
Dashboard and Inbox on top, then two labelled groups in a fixed
order — Estate (projects, workflows, activity, chains, artifacts,
infrastructure) and Governance (evidence, reviews, policies, agents,
security, classification, audit) — and, at the foot beside the version,
Administration (the Operations area) above Documentation. The
Inbox is the one waiting-on-you page, with the perspectives your
roles light — Steps (the steps waiting on you to approve or
continue), Approvals (the governance checklists held for you, lesson
10.3), Security reviews (the role grant review queue, for security
administrators) and Scheduled — and its count sums exactly the
perspectives it shows you, so one number says what is yours to act on. Each row shows its short name with the full
name as the tooltip; the collapsed sidebar is icons only, with the same
tooltips. Entries you are not entitled to are not hidden: an entry
whose pack the licence lacks shows greyed with a lock, naming the pack
in its tooltip, so the sidebar is also the map of what a licence would
unlock (lesson 1.5). What you see is your authority, not a fixed menu:
Administration shows for superusers (and holders of the /admin rule
grant), the Governance entries for the governance roles and pack
entitlements, while the estate, triggers, maintenance, artifacts and
settings screens ride the same path-based access as the API — a node
you may not read is simply not there (lesson 7.1).
Login, the profile menu and the bell
The root URL lands on the login screen; the same username and password
opschain login takes, exchanged for the same tokens against the same
identity plane (lesson 7.5's connections are the buttons beside the
form). The profile menu (top right) names your login with a provider
chip — local, ldap:<code>, oidc:<code> — and an amber banner across
the top says so when you signed in with a break-glass account or with a
local account that shadows a directory identity of the same name
(dismissible for the session). Logging out revokes the session's token
server-side, audited as api:auth:logout (lesson 7.3).
The notification bell (lesson 5.5) carries your unread count and
opens the in-app feed: a change or workflow run you own finishing or
failing (one updating row per run, a failure flood collapsed to one row
naming the blast radius) and, when a subject enters the approval funnel
with your name on a line, awaiting your approval with a link to the
inbox. History keeps what you have read; Mark all read clears the
count. What reaches you is the engine's defaults plus your own
subscriptions (the Notification settings page behind the bell); what
must reach a group is an admin mandate (opschain learn governance-notifications).
The Dashboard's Insights panels
The Dashboard is the estate's pulse — recent and running activity,
failures, what is waiting on a human — with a command-palette search
(/search) over projects, nodes, workflows and policies. Its
Insights tab is a panel grid you arrange per user (and reset) over
the event stream, each panel a counter set over a window with every
figure drilling down to the event listing that produced it:
- Security pulse — authorisation denials, sign-in failures and
throttles, step-up outcomes, break-glass and licence refusals, each
counter naming the event types behind it (lesson 7.1's
warn:authz:deniedas a line rather than a row). - Warnings heat strip —
warn:*density across the window with the top warning families. - Config-change audit — configuration writes by family with last-write times, top actors, and credential extractions as a sensitive counter.
- Identity lifecycle — user and group changes plus leaver-disabled warnings (lesson 7.3).
- Approval throughput — step approval decisions over time with the top approvers (lesson 3.2).
- Automation health — trigger firings against scheduled activity and trigger failures (lessons 5.2, 5.3).
- Feature-refusal demand — licence feature refusals faceted by the refused feature (lesson 1.5).
- Four pack-gated panels — Change governance (the approval funnel, backlog, time-to-quorum, break-glass and category mix), Change calendar (upcoming maintenance windows and active blackouts, lesson 5.6), Governance posture (control coverage and findings) and Agent governance (the governed request lane, recommendation funnel, halts and fleet accountability) — render locked and name their pack when the licence lacks it.
The insight reads are admin-scoped. The CLI equivalents are opschain activities and opschain events stats.
The estate's node pages
Node pages share one layout — a header and a tab strip — in a deliberate order, the operational pulse first:
- Project: Activity · Chains · Environments · Assets · Actions · Workflows · Triggers · Scheduled activity · Templates · Git remotes · Artifacts · Audit history ‖ Properties · Settings
- Environment: Activity · Chains · Assets · Actions · Scheduled activity · Templates · Artifacts · Audit history ‖ Properties · Settings
- Asset: Activity · Chains · Actions · Scheduled activity · Artifacts · Audit history ‖ Properties · Settings
A project with enrolled agents gains an Agents tab (lesson 12.1):
each agent's detail page carries its chat and its read-class
capabilities — info, healthz, readyz, logs, metrics — as panels under the
capability pills. The Infrastructure entry lists the host nodes of
lesson 6.4. An asset's Actions tab lists its template's action catalog,
each button captioned with the action's summary:; the Run form renders
declared typed inputs as form fields (an enum a select, a boolean a
toggle, a secret a masked secret-vault:// reference), with property
overrides and skip-steps in their own sections. Workflows run the same
way from the project's Workflows tab.
Governance, entry by entry
Gated by governance roles and pack entitlements, never by admin status.
| Entry | What you do there | The CLI equivalent |
|---|---|---|
| Security | Users, groups and the authorisation policies of lesson 7.2 — the base identity surface, in the Governance group because access is governance. Its Administration tab (shown to security administrators, auditors and superusers) holds the git identity policy and the security-role grants (security_administrator, auditor) | opschain admin users|groups, opschain admin authz (lesson 7.2); opschain security git-policies|roles (lesson 7.4) |
| Reviews | The governance record: the Decided tab is the decision history, the Campaigns tab holds the review campaigns (open, decide, close into an attestation) and Cadences what opens them. The waiting checklists themselves — a governed change or workflow run, a trust raise, a release promotion, a rollover, a transport grant, one surface for all kinds — are the sidebar's Inbox → Approvals: each row opens its checklist with the approval context (who raised it, the stated rationale, the recommendation it implements — an agent's — and the correlation chain hop by hop); approve, reject with a reason, or break-glass. The old approvals-tab link redirects there | opschain approvals list|show|approve|reject|history (opschain learn governance-approvals, opschain learn 10.3); opschain governance campaigns (opschain learn governance-campaigns) |
| Policies | Approval policies and the subtree asset-owner declarations the funnel resolves approvers from | opschain approval-policies, opschain governance owners (opschain learn governance-asset-owners) |
| Agents | The agent plane for the governance role: the fleet and each agent's detail (identity, disclosures, owner, release), the release catalog and stage ladder, the grants with their approval state, assignments, activity and the trust review — the evidence of lesson 12.3 as screens — and the Trust tab: grants, assets-under-management assignments, type ceilings and node-classification ceiling rules. Read-only for the governance role; an administrator writes grants (also from an agent's sheet), approves, rejects and revokes, assigns and unassigns, and sets or removes ceilings there. The operating verbs (drain, halt, revoke, owner) stay on the Operations area's Agents panel | opschain admin agents list, opschain admin agent show|activity|trust-review, opschain admin trust …, opschain admin agent-release list (lessons 12.2–12.4) |
| Evidence | The control catalog, the hash-chained evidence ledger (list, verify, attest) and the waivers register | opschain governance controls|evidence|waivers (opschain learn governance-controls-evidence) |
| Classification | The metadata profiles and the classification register — recorded values with staleness and coverage | opschain metadata profiles|register (opschain learn governance-classification) |
| Audit | The estate-wide audit trail — the same rows the node and change Audit history tabs show for their subtree. The search box matches text anywhere in the event type (agent finds warn:agent:halted, authz finds lesson 7.1's denials), filters narrow by user, path and time, and a row opens the event in full with its source's context resolved | opschain audit --type-search …, opschain events show <id> (lesson 5.1) |
The governance posture report is opschain governance posture
(opschain learn governance-campaigns).
The Operations area, panel by panel
/admin is the operator console — the deployment itself rather than the
estate.
| Panel | What you do there | The CLI equivalent |
|---|---|---|
| Overview | The whole deployment on one screen: server card, runner groups with demand, agents, unsatisfiable queue, halt/licence/maintenance banners — plus the emergency halt/resume and system-quiesce controls (reason required; the reason is the audit record) | opschain admin status, opschain admin platform status|halt|quiesce|resume (lesson 8.4) |
| Runners | Groups and members with derived state, drain/resume/forget, the fleet-queue backlog with placement verdicts; create or edit a group's placement contract (attributes, bindings, exclusive); register placement attribute keys and their allowed values; quiesce and resume a server node or a whole site | opschain admin runners list, opschain admin runner drain|resume|forget, opschain admin runner-group set|delete, opschain admin runner-attributes set|remove, opschain admin server node quiesce|resume, opschain admin server site quiesce|resume (lessons 6.1–6.3, 8.6, 8.7) |
| Registration tokens (on Runners and Agents) | Mint and inspect runner/agent registration tokens — scope, uses, expiry; the value shows once | opschain admin runner-token create|list, opschain admin agent-token create|list (lesson 6.2) |
| Queue | The dispatch view: ready-queue depth, the oldest waiting step, live job leases, every entry with its owning work item and chain; sweep parked orphans, terminate an entry through its owner | opschain admin queue list|sweep|terminate (lesson 6.3) |
| Server | Build, replicas (live/stale split), leader, readiness checks, active changes, a queue-depth line linking to the Queue page | opschain admin status, opschain admin changes active (lessons 8.6–8.7) |
| Diagnostics | The redacted support-bundle download | opschain support bundle (lesson 8.2) |
| Configuration | The config.yaml key catalog with set/default state (secrets redacted), a read-only file view, compose-and-validate — never a write-back path | opschain docs config (the catalog), opschain server configure (writes the file; lesson 0.1) |
| Settings | The runtime, database-authoritative settings editor, versioned compare-and-set with history and diff | opschain settings show|edit|history (lesson 1.3) |
| Maintenance | The estate console for maintenance windows: schedule/start/extend/end/cancel, deferred firings per window | opschain maintenance … (lesson 5.6) |
| Users & Groups | Local identity: create/disable/enable/reset-password, break-glass designation, local groups and membership — filterable by user or group, with an explicit Create group action; a disable warns which automations the user ran | opschain admin users, opschain admin groups (lessons 7.2, 7.3) |
| Identity providers | The federated sign-in catalog — LDAP, OIDC and GitHub connections, their group mappings, test and sweep | opschain admin identity providers|mappings (lesson 7.5) |
| SIEM connections | The SIEM forwarder registry: list, create, edit, delete and test, each connection's record page with its delivery health and a link to its usage dashboard | opschain admin siem … (lesson 13.3) |
| GitHub | The GitHub App connections (allowed mint scope, webhook provisioning, test) and the trust policies with their scope prefix | opschain admin github-connections …, opschain admin github-trust-policies … (lesson 13.1) |
| Agents | The agent fleet: online/halt state, drain/halt/forget/revoke, owner assignment, the agent sheet with its manifest disclosures and release identity, trust summary and activity | opschain admin agents list, opschain admin agent … (lessons 12.2, 12.5) |
| Model providers | The model-provider catalog AI agents' model calls are brokered through — no model key on any agent host | opschain admin model-providers (lesson 12.6) |
| Secrets providers | The secrets-provider connections and the scope bindings that route secret-vault:// resolution by node position | opschain admin secrets providers|bindings (lesson 3.5, opschain docs getting-started/secrets-providers) |
| Transport providers | The transport providers brokered remote-host access resolves through, their bindings and grants | opschain admin transport-providers, opschain admin transport-grants (lesson 6.4) |
| Git credentials | The credential records git remotes reference — stored once, masked everywhere | opschain git-remotes (lesson 3.3), opschain docs resources/git_credential |
| Packs | The installed pack store: signed bundles, versions, pins | opschain admin packs list|install|pin (lesson 2.4) |
| Notifications | The notification spine's instance-level side: channel connectors (webhook, Slack, Teams) and the feed and evidence retention horizons | opschain admin notifications connectors|retention (lesson 5.5) |
| Notifications governance | Notification mandates ("this group must see these events") and the delivery evidence that proves they were told — in the Platform group beside the connectors | opschain admin notifications mandates|deliveries (opschain learn governance-notifications) |
| Licence | The stored documents, tier, limits and renewal state; apply a licence file | opschain admin licence show|apply|features (lesson 1.5) |
| Activity | The operational event stream, lensed over the ops vocabulary (warnings first) | opschain events (lesson 5.1) |
| Database | Per-table stats, autovacuum/analyze recency, on-demand ANALYZE / VACUUM runs, the quiesce state | opschain admin database status|analyze|vacuum (lesson 8.5) |
Two conventions the panels share: liveness is honest (online: false
means "has not polled for 3 minutes", always paired with a last-seen age
— a clean goodbye renders differently from aged-out silence; lesson
6.1), and destructive flows are reason-first (halt dialogs refuse
without a reason, because the reason is the audit record).
Documentation
At the foot of the sidebar, Documentation serves this same embedded corpus in
the browser — every lesson and every reference page, at /docs/<slug> —
so a screen that cites a page deep-links to it. It is the same text
opschain learn and opschain docs print, from the same binary.
Related pages
opschain learn 9.1— the tour this guide is the shelf for.opschain docs getting-started/core-platform— the platform at a glance.opschain docs config— thegui:keys (gui: {enabled: false}for a deployment that fronts the GUI separately).