§16a. Visual console (read-only in A)

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

Socket limits. Connections are bounded per uid and in total; a share of the total is reserved for administrators and for callers in a logind session, so services with dynamic uids cannot exhaust it. Work the socket can cause before a proposal is authorized (§12 step 2) is bounded the same way: one build slot per caller class, charged to the caller.

Frontends. Planarian exposes one interface, its socket API. The CLI is always present. The console is one optional frontend, shipped in the personal profile; any other frontend (a web dashboard, a TUI, an agent harness, a fleet console) uses the same API and gets the same identity derivation and policy checks. No frontend is privileged.

iced; COSMIC reference desktop; autostart as a user service on graphical-session.target, minimized unless there is an open incident, a pending approval, a reconciliation record, or the last boot reverted. Views: Graph (desired vs observed vs health per node: three small indicators, not one color; edge style by kind; overridden nodes hatched; Unknown nodes grey with a stale-clock mark), Timeline (transactions with journal states and outcomes), Generations (current, previous, known_good, live_tested, candidate; boot-confirmed marker), Incidents (state, attempts, cooldown). Buttons in A: undo, override/release (Runtime, user-actor). No approval in A. Reads only the daemon socket.