The GUI, screen by screen
Included from Basic tier
The reference shelf behind lesson 9.1's tour: every entry of the
sidebar, what you do there and the CLI verb that does the same — the
Dashboard's Insights panels, the Governance box entry by entry and the
Operations area panel by panel. Lesson 9.1 (opschain learn 9.1) walks
the eight stops; this guide is where to look a screen up afterwards.
The sidebar
Three boxed sections in a fixed order — Estate (projects, workflows,
chains, artifacts, infrastructure, activity), Governance (reviews,
audit, agents, the governance packs) and Admin (the Operations area)
— with the Dashboard above them and Documentation below. Entries you are
not entitled to are not hidden: an entry whose pack the licence lacks
shows locked and names the pack, so the sidebar is also the map of what
a licence would unlock (lesson 1.5). What you see is your authority, not
a fixed menu: the Operations area shows for superusers (and holders of
the /admin rule grant), the Governance entries for the governance roles
and pack entitlements, while the estate, triggers, maintenance,
artifacts and settings screens ride the same path-based access as the
API — a node you may not read is simply not there (lesson 7.1).
Login, the profile menu and the bell
The root URL lands on the login screen; the same username and password
opschain login takes, exchanged for the same tokens against the same
identity plane (lesson 7.5's connections are the buttons beside the
form). The profile menu (top right) names your login with a provider
chip — local, ldap:<code>, oidc:<code> — and an amber banner across
the top says so when you signed in with a break-glass account or with a
local account that shadows a directory identity of the same name
(dismissible for the session). Logging out revokes the session's token
server-side, audited as api:auth:logout (lesson 7.3).
The notification bell (lesson 5.5) carries your unread count and
opens the in-app feed: a change or workflow run you own finishing or
failing (one updating row per run, a failure flood collapsed to one row
naming the blast radius) and, when a subject enters the approval funnel
with your name on a line, awaiting your approval with a link to the
inbox. History keeps what you have read; Mark all read clears the
count. What reaches you is the engine's defaults plus your own
subscriptions (the Notification settings page behind the bell); what
must reach a group is an admin mandate (opschain learn governance-notifications).
The Dashboard's Insights panels
The Dashboard is the estate's pulse — recent and running activity,
failures, what is waiting on a human — with a command-palette search
(/search) over projects, nodes, workflows and policies. Its
Insights tab is a panel grid you arrange per user (and reset) over
the event stream, each panel a counter set over a window with every
figure drilling down to the event listing that produced it:
- Security pulse — authorisation denials, sign-in failures and
throttles, step-up outcomes, break-glass and licence refusals, each
counter naming the event types behind it (lesson 7.1's
warn:authz:deniedas a line rather than a row). - Warnings heat strip —
warn:*density across the window with the top warning families. - Config-change audit — configuration writes by family with last-write times, top actors, and credential extractions as a sensitive counter.
- Identity lifecycle — user and group changes plus leaver-disabled warnings (lesson 7.3).
- Approval throughput — step approval decisions over time with the top approvers (lesson 3.2).
- Automation health — trigger firings against scheduled activity and trigger failures (lessons 5.2, 5.3).
- Feature-refusal demand — licence feature refusals faceted by the refused feature (lesson 1.5).
- Four pack-gated panels — Change governance (the approval funnel, backlog, time-to-quorum, break-glass and category mix), Change calendar (upcoming maintenance windows and active blackouts, lesson 5.6), Governance posture (control coverage and findings) and Agent governance (the governed request lane, recommendation funnel, halts and fleet accountability) — render locked and name their pack when the licence lacks it.
The insight reads are admin-scoped. The CLI equivalents are opschain activities and opschain events stats.
The estate's node pages
Node pages share one layout — a header and a tab strip — in a deliberate order, the operational pulse first:
- Project: Activity · Chains · Environments · Assets · Actions · Workflows · Triggers · Scheduled activity · Templates · Git remotes · Artifacts · Audit history ‖ Properties · Settings
- Environment: Activity · Chains · Assets · Actions · Scheduled activity · Templates · Artifacts · Audit history ‖ Properties · Settings
- Asset: Activity · Chains · Actions · Scheduled activity · Artifacts · Audit history ‖ Properties · Settings
A project with enrolled agents gains an Agents tab (lesson 12.1):
each agent's detail page carries its chat and its read-class
capabilities — info, healthz, readyz, logs, metrics — as panels under the
capability pills. The Infrastructure entry lists the host nodes of
lesson 6.4. An asset's Actions tab lists its template's action catalog,
each button captioned with the action's summary:; the Run form renders
declared typed inputs as form fields (an enum a select, a boolean a
toggle, a secret a masked secret-vault:// reference), with property
overrides and skip-steps in their own sections. Workflows run the same
way from the project's Workflows tab.
Governance, entry by entry
Gated by governance roles and pack entitlements, never by admin status.
| Entry | What you do there | The CLI equivalent |
|---|---|---|
| Manage security | Users, groups and the authorisation policies of lesson 7.2 — the base identity surface, in the Governance box because access is governance | opschain admin users|groups, opschain admin authz (lesson 7.2) |
| Security administration | The git identity policy and the security-role grants (security_administrator, auditor) | opschain security git-policies|roles (lesson 7.4) |
| Reviews & approvals | The approvals inbox: every subject held for you — a governed change or workflow run, a trust raise, a release promotion, a rollover, a transport grant — one surface for all kinds. The sidebar entry wears a red bubble with the count waiting on you. Each row opens its checklist with the approval context: who raised it, the stated rationale, the recommendation it implements (an agent's), and the correlation chain hop by hop; approve, reject with a reason, or break-glass. The Decided tab beside it is the decision history | opschain approvals list|show|approve|reject|history (opschain learn governance-approvals, opschain learn 10.3) |
| Policies & owners | Approval policies and the subtree asset-owner declarations the funnel resolves approvers from | opschain approval-policies, opschain governance owners (opschain learn governance-asset-owners) |
| Agents | The read-only view of the agent plane for the governance role: the fleet and each agent's detail (identity, disclosures, owner, release), the release catalog and stage ladder, the grants with their approval state, assignments, activity and the trust review — the evidence of lesson 12.3 as screens. The operating verbs (drain, halt, revoke, owner, the trust decisions) stay on the Operations area's Agents panel | opschain admin agents list, opschain admin agent show|activity|trust-review, opschain admin trust list, opschain admin agent-release list (lessons 12.2–12.4) |
| Evidence & controls | The control catalog, the hash-chained evidence ledger (list, verify, attest) and the waivers register | opschain governance controls|evidence|waivers (opschain learn governance-controls-evidence) |
| Compliance | Review campaigns (open, decide, close into an attestation) and the governance posture report | opschain governance campaigns|posture (opschain learn governance-campaigns) |
| Classification | The metadata profiles and the classification register — recorded values with staleness and coverage | opschain metadata profiles|register (opschain learn governance-classification) |
| Audit history | The estate-wide audit trail — the same rows the node and change Audit history tabs show for their subtree. The search box matches text anywhere in the event type (agent finds warn:agent:halted, authz finds lesson 7.1's denials), filters narrow by user, path and time, and a row opens the event in full with its source's context resolved | opschain audit --type-search …, opschain events show <id> (lesson 5.1) |
| Notifications governance | Notification mandates ("this group must see these events") and the delivery evidence that proves they were told | opschain admin notifications mandates|deliveries (opschain learn governance-notifications) |
The Operations area, panel by panel
/admin is the operator console — the deployment itself rather than the
estate.
| Panel | What you do there | The CLI equivalent |
|---|---|---|
| Overview | The whole deployment on one screen: server card, runner groups with demand, agents, unsatisfiable queue, halt/licence/maintenance banners — plus the emergency halt/resume and system-quiesce controls (reason required; the reason is the audit record) | opschain admin status, opschain admin platform status|halt|quiesce|resume (lesson 8.4) |
| Runners | Groups and members with derived state, drain/resume/forget, the fleet-queue backlog with placement verdicts | opschain admin runners list, opschain admin runner drain|resume|forget, opschain admin runner-group (lessons 6.1–6.3) |
| Registration tokens (on Runners and Agents) | Mint and inspect runner/agent registration tokens — scope, uses, expiry; the value shows once | opschain admin runner-token create|list, opschain admin agent-token create|list (lesson 6.2) |
| Queue | The dispatch view: ready-queue depth, the oldest waiting step, live job leases, every entry with its owning work item and chain; sweep parked orphans, terminate an entry through its owner | opschain admin queue list|sweep|terminate (lesson 6.3) |
| Server | Build, replicas (live/stale split), leader, readiness checks, active changes, a queue-depth line linking to the Queue page | opschain admin status, opschain admin changes active (lessons 8.6–8.7) |
| Diagnostics | The redacted support-bundle download | opschain support bundle (lesson 8.2) |
| Configuration | The config.yaml key catalog with set/default state (secrets redacted), a read-only file view, compose-and-validate — never a write-back path | opschain docs config (the catalog), opschain server configure (writes the file; lesson 0.1) |
| Settings | The runtime, database-authoritative settings editor, versioned compare-and-set with history and diff | opschain settings show|edit|history (lesson 1.3) |
| Maintenance | The estate console for maintenance windows: schedule/start/extend/end/cancel, deferred firings per window | opschain maintenance … (lesson 5.6) |
| Users & Groups | Local identity: create/disable/enable/reset-password, break-glass designation, local groups and membership — filterable by user or group, with an explicit Create group action; a disable warns which automations the user ran | opschain admin users, opschain admin groups (lessons 7.2, 7.3) |
| Identity providers | The federated sign-in catalog — LDAP, OIDC and GitHub connections, their group mappings, test and sweep | opschain admin identity providers|mappings (lesson 7.5) |
| Agents | The agent fleet: online/halt state, drain/halt/forget/revoke, owner assignment, the agent sheet with its manifest disclosures and release identity, trust summary and activity | opschain admin agents list, opschain admin agent … (lessons 12.2, 12.5) |
| Model providers | The model-provider catalog AI agents' model calls are brokered through — no model key on any agent host | opschain admin model-providers (lesson 12.6) |
| Secrets providers | The secrets-provider connections and the scope bindings that route secret-vault:// resolution by node position | opschain admin secrets providers|bindings (lesson 3.5, opschain docs getting-started/secrets-providers) |
| Transport providers | The transport providers brokered remote-host access resolves through, their bindings and grants | opschain admin transport-providers, opschain admin transport-grants (lesson 6.4) |
| Git credentials | The credential records git remotes reference — stored once, masked everywhere | opschain git-remotes (lesson 3.3), opschain docs resources/git_credential |
| Packs | The installed pack store: signed bundles, versions, pins | opschain admin packs list|install|pin (lesson 2.4) |
| Notifications | The notification spine's instance-level side: channel connectors (webhook, Slack, Teams) and the feed and evidence retention horizons | opschain admin notifications connectors|retention (lesson 5.5) |
| Licence | The stored documents, tier, limits and renewal state; apply a licence file | opschain admin licence show|apply|features (lesson 1.5) |
| Activity | The operational event stream, lensed over the ops vocabulary (warnings first) | opschain events (lesson 5.1) |
| Database | Per-table stats, autovacuum/analyze recency, on-demand ANALYZE / VACUUM runs, the quiesce state | opschain admin database status|analyze|vacuum (lesson 8.5) |
Two conventions the panels share: liveness is honest (online: false
means "has not polled for 3 minutes", always paired with a last-seen age
— a clean goodbye renders differently from aged-out silence; lesson
6.1), and destructive flows are reason-first (halt dialogs refuse
without a reason, because the reason is the audit record).
Documentation
Below the sidebar, Documentation serves this same embedded corpus in
the browser — every lesson and every reference page, at /docs/<slug> —
so a screen that cites a page deep-links to it. It is the same text
opschain learn and opschain docs print, from the same binary.
Related pages
opschain learn 9.1— the tour this guide is the shelf for.opschain docs getting-started/core-platform— the platform at a glance.opschain docs config— thegui:keys (gui: {enabled: false}for a deployment that fronts the GUI separately).