COMMAND CENTER
Administration,
authorized by the server.
This page is a static shell over the same sdi_* RPCs the native Admin uses. Nothing here grants access: every call is checked server-side for an enabled administrator role, MFA, a live session, the capability for that area and a recent re-authentication for sensitive changes. Without admin-config.js it reports the state below and sends no request anywhere.
The command center is not configured.
No backend origin is set, so there is no sign-in and no data. This page keeps no cookies, no local storage and sends no request until the owner configures it.
Sign in
Administrator accounts are provisioned server-side with MFA. A matching email or handle grants nothing.
Console
User directory
Search by username or account id (users capability). Plan appears only for administrators with the finance capability; feed report counts only with moderation.
Account action
Suspend, ban, restore, sign-out and reset flags take effect on the server immediately, revoke sessions where stated and need a recent second factor; every action requires a reason and is audited. The member receives a fixed-text account notice that never repeats your reason; a note is internal and sends nothing. Reset flags dismisses the open reports on the member's posts (your own reports stay for another reviewer). Administrator accounts cannot be changed here.
Agent run history and audit
Searchable, paged (50 per page). Finished runs are kept 180 days and audit entries 400 days; audit entries cannot be edited.
Agent proposals
Actions an agent proposed above its caps wait here (owner only, recent MFA required). Approving hands the proposal to the worker; rejecting records the reason. Nothing runs until a decision, and pending proposals expire after fourteen days.
Publishing stages
Every official-channel job with its stage (queued, uploading, provider processing, published with the provider link, failed with the stored reason, cancellation, withdrawal or reconciliation), as the publishing worker last recorded it (publishing capability). Withdrawal and retry stay in the native Admin.
Diagnostics
Aggregated, anonymous counters per day, platform and build (sdi_diagnostics_admin, overview capability): totals, crash spikes against the prior week and failed agent runs. No member identity is collected.
Announcements
Compose a draft, then schedule or cancel it (users capability; scheduling and cancelling need a recent second factor). Product and marketing notices reach only members who turned them on, within their daily cap; account and service notices always reach active members. Every change needs a reason and is audited. Ids and revisions are in the Announcements panel above.
Agent controls
Owner only, with a recent second factor and a reason; each change is audited and bumps the agent's revision (shown in the Agents panel). Pausing stops the agent's running work; resuming needs published instructions and no emergency stop. Caps are configuration, not spending.
Finance records
Finance capability; every record needs a recent second factor and a reason and is written to the finance audit. Amounts are whole minor units (cents). Expenses are entered positive and stored as money out. Nothing here moves money.
Emergency stop
Stops every automated agent (owner only, recent MFA required). Drafts are kept; nothing is deleted.
What this shell does and does not do
- Reads: health and queues, approvals, users, moderation, publishing, support, finance records, agents, announcements, marketing, consent versions, through the existing RPC contracts. Each panel shows the server's answer, including
forbiddenorstep_up_required, verbatim. - Writes: the emergency stop, owner decisions on agent proposals, agent controls (pause, resume, caps, permissions, instructions and rollback), account actions (note, sign-out, suspend, ban, restore, reset flags), finance records (expense, import, correction, reconciliation) and announcements (draft, schedule, cancel), each with a required reason and server-side audit. Render approvals, moderation decisions and publishing withdrawals stay in the native Admin, where the exact render is played before a decision.
- Backups, restore drills, releases and retention are shown as reported outcomes only; no control or terminal endpoint exists on this page.
- Sessions live in page memory only; reloading signs you out. Tokens are never written to storage.
- No secrets: the configuration holds the backend origin and the publishable key only. Service keys, provider credentials and host details never reach this page.
Owner gate: backend project, administrator provisioning (sdi_provision_owner, service role, no password in source) and MFA enrolment remain open items (#246, #277). Status read from source on October 18, 2026.