NX Warden

public-safe operations demo

NX WARDEN /MISSIONCONTROL

Read-only operations dashboard active.No write actions armed.Public edge online.Protected details sealed.

signal

Public-safe observation layer.

This cockpit remains read-only. It watches public-safe status, sample telemetry, and history signals without exposing a control surface.

Mission Pulse
Observation

Public edge is online, protected systems are sealed, and no write actions are armed.

Access Posture
Read only

Cloudflare protects the edge. Control actions remain outside this public layer.

Infrastructure Map
4 layers

Public Edge, Pages, Access Boundary, and Protected Systems are shown as a high-level topology.

Telemetry Phase
Phase 2

Sample signals and structured history stay inside the observation layer.

Observation APIPublic-safe

Only low-sensitivity sample metrics and checks are shown when the API is reachable.

Visual mockArchitecture only

Map nodes explain the intended system shape and are never counted as live machines.

Local diagnosticsRecorded evidence

Mobile diagnostics describe completed local tests, not a live phone connection.

telemetry center / public-safe demo

Sample telemetry from the observation layer.

Backend mockprotected intakeLast update Just now
Demo signals3

/ 3 sample signals

CPU (avg)29%

Sample average

Memory (avg)41%

Sample average

Disk (avg)38%

Sample average

Observed checks128

Not customer data

Last ingest18:24:31

visual fallback

sample telemetry

Demo signals

SignalCategoryScopeCPUMemoryDiskTempObserved checksLast seen
Sample signal 1Sample edgePublic-safe sample18%32%28%41C5618:24:31
Sample signal 2Sample archivePublic-safe sample42%48%36%47C3818:24:28
Sample signal 3Sample workflowPublic-safe sample26%44%49%38C3418:24:29

Showing 3 of 3 sample signals. Data is a clearly labeled visual fallback.

demo signal trend (24h)

Sample drift

CPU %Memory %Disk %
0%25%50%75%100%18:0000:0006:0012:00

recent trail

View all

Latest system events

Sample telemetry signal accepted18:24:31
Sample status state refreshed18:24:31
Observation endpoint healthyrecent
Demo signal snapshot normalizedrecent
Public observation release activerecent

risk radar

View all

Before control

Auth not wiredConsole is public and read-only until Cloudflare Access is chosen.
Protected systems exposed?Review Access rules before adding any control-plane route.
Backup policy missingSystem history, runbooks, service configuration, and archive retention need a simple backup policy.
Archive pathArchive cleanup rules need a final naming and retention decision.
Browser automation optionalBrowser automation is currently unavailable and does not block observation workflows.
Mobile routing pendingMobile name resolution, routing, and network variants still require the phone test matrix.

system memory

View all

Decision log

Keep console read-only until Cloudflare Access is wired.phase 2 / safety
Treat optional browser automation as non-blocking.phase 2 / workflow
Use browser checks as the visual validation fallback.phase 2 / quality
Build observation layer before protected actions.phase 3 / boundary

access posture

View all

Current protection

Public EdgeProtected by Cloudflare
ConsolePublic read-only
Protected SystemsSealed, no direct exposure
Protected ActionsNot armed

local diagnostics / mobile rescue

Connectivity Diagnostics

No public profiles

This card records public-safe test outcomes only. It does not reveal infrastructure addresses, routing details, sensitive access data, connection hints, subscription links, or protected configuration files.

Mobile profileStarts / latency present

Real browsing is still failing on the test phone.

Server pathHTTP 204 verified

The repaired secure transport path completed a controlled request.

Repair stateCompatibility layer aligned

The required connection compatibility layer and bootstrap resolver are present.

Current blockerMobile routing matrix

Device routing, name resolution, and mobile-network variants still need matrix testing.

Edge listenerNot primary cause

Listener, certificate timing, and server-side transport posture passed prior checks.

Connectivity warningsNon-blocking

Basic reachability warnings do not explain browser resolution failure.

NetworksWi-Fi / mobile data
ProfilesBaseline / compatibility / guarded bootstrap
Next evidenceName resolution, browsing, exit check, and redacted logs

local audit / domain mail

Domain Mail Diagnostics

Mail settings unchanged

This is a public-safe readiness summary. Addresses, provider access data, routing destinations, DNS records, and administrative controls are intentionally omitted.

Receive pathExisting route preserved

The current inbound route remains unchanged during local hardening.

Send pathNot armed

No outbound sender, test message, or delivery cutover was performed.

Mail readiness UIBuilt locally

The frontend and Worker bundle are available for review before approval.

Sender boundaryProtected setting only

Sensitive sender settings are never returned to the browser.

Mail postureUnchanged

No routing, mailbox, or Cloudflare resource was modified.

AdministrationProtected workflow

Mailbox creation and delivery tests remain outside this public console.

map

Infrastructure Map

Signal filters

loops

Operating loops

ObservedDownloads -> Rename -> Archive -> Media library

A guarded media loop cleans noisy filenames, archives completed files, then waits for a selected library scan.

Phase 2Sample signal -> Observation edge -> Latest state -> History

Telemetry enters through a protected intake and becomes a current status signal plus structured history.

LiveWebsite -> GitHub -> Cloudflare Pages

Public changes move through GitHub main, local build checks, and a Pages release.

memory

Recent mission trail

risk radar

Open questions before control.

Auth not wired

Console is public and read-only until Cloudflare Access is chosen.

Focus signal
Protected systems exposed?

Review Access rules before adding any control-plane route.

Focus signal
Backup policy missing

System history, runbooks, service configuration, and archive retention need a simple backup policy.

Focus signal
Archive path

Archive cleanup rules need a final naming and retention decision.

Focus signal
Browser automation optional

Browser automation is currently unavailable and does not block observation workflows.

Mobile routing pending

Mobile name resolution, routing, and network variants still require the phone test matrix.

Focus signal

signals

Current trail

Latest public releaseRecorded
Previous stable releaseRecorded
Release validationPassed
Browser automationOptional / unavailable

control / phase 3 preview

Interactive shell, deliberately unarmed.

Access + mTLS required before arming

These controls define the future command surface without sending, storing, or executing a machine action. The Worker placeholder always returns a locked response.

Sample signal 1Sample edge / Public-safe sample
Read only
CPU 18%MEM 32%DISK 28%
/api/node/sample-signal/action
Sample signal 2Sample archive / Public-safe sample
Read only
CPU 42%MEM 48%DISK 36%
/api/node/sample-signal/action
Sample signal 3Sample workflow / Public-safe sample
Read only
CPU 26%MEM 44%DISK 49%
/api/node/sample-signal/action