Settings
The Settings page is a tenant-level view of how Churchill is configured. Next to the title, a tenant · <your tenant> line names the tenant you are looking at.
Most of Settings is a read surface: each tab shows what the control plane can report right now, and where a value is not readable the console says so plainly rather than showing a fabricated one. The exception is the operators tab, where the tenant owner manages console accounts. Three tabs run across the top of the page.
The tabs
Section titled “The tabs”Policy
Section titled “Policy”The default tab. It holds one card, plus a second for owners:
- CAB governance: whether a CAB is configured, the quorum required, the number of active members, and the member roster. The quorum row shows the configured number once the board is sealed, and
unknownwhen the control plane does not report one. See CAB overview for what those numbers mean in practice.
The roster table has five columns:
| Column | Meaning |
|---|---|
| LABEL | The member’s display label. |
| ALG | The signing algorithm. A WebAuthn credential shows as passkey. |
| FP | The fingerprint of the member’s signing key. |
| STATE | active. The roster lists active members only, so removed members do not appear. |
| ADDED | When the member was added. |
If no members have been added yet, the table says so in a single line.
If you are an owner and your tenant is sealed, a Setup receipt card also appears. It is the exact receipt produced when the CAB ceremony sealed the tenant: tenant name, seal time, approval tally, baseline hash, each member with their key fingerprint, and the algorithms used, with Copy and Export .json buttons. Both act on the receipt exactly as it was recorded at seal time. See CAB onboarding.
Operators
Section titled “Operators”The operator roster: who each operator is, their role (owner or operator), account state, passkey count, and last activity. Your own row is marked (you). The card header counts the accounts.
For the tenant owner, this tab is also where accounts are managed: Invite operator… sends an email invitation for a passkey-only account, and per-row controls Rename, Disable/Enable, and Unlock manage existing ones. A Pending invitations card tracks outstanding invites with Resend and Revoke. The full flow is documented on Operators.
Server
Section titled “Server”Live counters read from the control plane:
| Counter | Meaning |
|---|---|
| Uptime | How long the control plane has been running. |
| Conns accepted | How many connections the control plane has accepted. |
| Conns rejected | How many connections it has turned away. Highlighted when above zero. |
| Kills sent | How many kill commands the control plane has sent to terminate processes. Highlighted when above zero. |
A line beneath the counters shows the snapshot revision and how long ago the figures were captured. If the live control-plane read is stale, the card header shows a degraded pill with a short reason. Treat the counters as a last-known snapshot until the pill clears.
Below the counters sit two more cards.
Bundle composition names the vendor-signed asset tree this control plane composes protection bundles from: the pinned version, its source, and the release certificate serial that signed it. A pill in the corner reads verified, below minimum, or unverified. Verified, the card lists each architecture with its file count and signer serial. Unverified, it names the file that failed, because that is the sentence you act on. Upgrading the tree is a pin change plus an approved redeploy, not something you edit here.
Churchill Host CLI shows the current published version of chrlctl and, for the architecture you pick, the copy-and-paste commands to download it onto a host and verify its hash. This is where you fetch chrlctl when you are preparing to enroll a new host. See Running chrlctl. If no release has been published, the card says “No chrlctl release published.”
Reading the empty cards
Section titled “Reading the empty cards”Where a value is not readable or a feature is not configured, the card says so in a single sentence. This is by design. The console only shows figures it can actually read from the control plane, and states the gap outright when it cannot. This is the same convention as the dashes you see elsewhere in the dashboard: it is the accurate answer, not a loading failure.