Fleet

The Fleet page is the one hosts surface. It lists every host reporting to your tenant, joined to its enrollment record, and it carries the containment actions for those records. Start here when you want a single view of who is reporting, who is healthy, and where attention is needed. A count of total hosts appears next to the page title.

Header pills summarize what needs attention, and appear only when their count is above zero: how many hosts are stale, isolated, unarmed, quarantined, tampered, or not recording. Posture leads, because a host the control plane has lost is the first thing to read.

Columns

Each row is one host. Selecting a row opens that host’s detail page. See Host detail. The columns are:

Column	Meaning
Host	The host’s name, falling back to its host ID when no name has been reported. Hover it to read the host ID either way.
Address	The network address the host is reporting from. Shown as a dash when unknown.
Posture	What the control plane asserts about the host, shown as a pill with the reason and the actor beneath it. See Host posture below.
State	The host’s current health, shown as a colored pill. See the values below.
Sentinel	Whether the in-process sentinel is armed or unarmed. A dash means the sentinel state was not reported.
Capture	The host’s session-recording posture. See Capture posture below. A dash means the host has never reported an arming result.
Enrollment	The host’s enrollment status: enrolled, quarantined, retired, or locked. A dash means the identity is not in the enrollment register, or the control plane did not export it for this host.
φ	Phi, a heartbeat-health score. It stays low while check-ins arrive on their normal rhythm, and climbs as they fall late or irregular. A higher value means the host is more likely to have gone quiet. See the glossary.
Sessions	How many application sessions are active on the host. When above zero, the count is a link to the host’s Sessions tab.
Lockdowns	How many lockdowns are in effect on the host.
Last HB	How long ago the host last sent a heartbeat. A growing value means the host has gone quiet.
Actions	The containment actions this host’s enrollment status allows. See Containment actions below.

Host states

The State pill summarizes the host’s health. It shows one of five words:

success: the host is reporting and within expected bounds.
warning: φ reached 8. Something is elevated and worth a look, but the host still operates.
critical: φ reached 12. The host needs attention now.
lockdown: one or more lockdowns are in effect on the host.
unknown: the host has no active sessions to judge health from, for example a freshly enrolled host that is not yet running a protected application.

Host posture

Posture and State answer different questions, and the console keeps them apart. State is derived from the host’s own heartbeat rhythm. Posture is what the control plane asserts about the host:

lockdown: the host is contained. Its enrollment is locked and its protected workload is not coming back until you unlock it.
stale: the host has been silent past its heartbeat budget, so the control plane no longer knows its state. The reason names how long (“no heartbeat for 180s”), and the row is graded as a finding, not an absence of data.
isolated: the host is running but reports no control-plane contact. Enforcement there has escalated to denying anything it cannot prove.

A pill appears only when the control plane actually asserts a posture. On a healthy host the cell is a dash, hovering to “posture not reported by the control plane”. Under the pill, the console prints the reason and, for an operator-driven move, who asserted it. Hover either for the full text and the time the posture was entered.

A stale, lockdown, or isolated posture grades the whole row, and outranks a capture tamper: a tamper is a finding on a host you are still hearing from, the other three are the host itself being contained or gone.

Capture posture

The Capture column reports whether the host records interactive sessions:

recording: session recording is armed and capturing.
not recording: the host reported that recording is not armed.
arm failed: the host tried to arm recording and failed.
tampered: the host reported interference with session recording. The whole row renders at alert grade, and the host’s Recordings may be incomplete.
retired: recording was torn down when the host was decommissioned. Casts sealed before then remain replayable.

A not recording, arm failed, or tampered posture is a coverage gap: an empty session or recording list on that host is not evidence that nothing happened. The host-detail and recordings pages say so explicitly when it applies.

Enrolled identities without a live session

Below the host table, an Enrolled identities · no live session card lists enrollment-register rows that no reporting host currently claims: hosts that enrolled but are not connected, plus quarantined, retired, and locked identities. The columns are the client identity, its status, its key fingerprint, first enrollment and last contact times, and a contact count.

These rows carry the same containment actions as the host table. A row whose status allows no action shows “no moves available”.

Containment actions

Containment operates on the enrollment record, keyed by the 32-character client identity. Which actions appear depends on the current status:

Status	Available actions
enrolled	Quarantine…, Retire…
quarantined	Release…, Retire…
locked	Unlock…, Retire…
retired	none

Quarantine… contains a suspect host. The control plane refuses it at its next bootstrap and stops delivering bundles to it. Live sessions are unaffected until the host reconnects. Quarantine is reversible.
Release… returns a quarantined host to enrolled. It bootstraps and receives bundles again on next contact. Nothing about the host is re-attested by this action, so release it only once the reason it was contained has been resolved.
Unlock… clears the lockdown the control plane holds over the host: the enrollment goes back to enrolled and the live session is told to resume normal operation. Nothing on the host is touched and nothing is re-attested. It takes a written reason, which lands in the lockdown ledger under your operator identity.
Retire… is a permanent decommission. The host is refused at bootstrap from now on, and this identity cannot return to service. A replacement host must enroll afresh under a new identity. There is no un-retire.

Each action opens a confirmation dialog that echoes the client identity. Type the identity to confirm. Unlock also requires the reason before its button enables. The dialog for retire adds “permanent · irreversible” above its button, which reads Permanently retire host.

A locked status is set by the control plane itself, when a host reports a lockdown or is contained for a stale or compromised session. Quarantine is not offered on a locked host: it would only weaken the containment already in place. The forward moves are unlock and retire.

If the console cannot complete a live read from the control plane, it shows a banner stating that it is displaying cached data, with a short reason when one is available.

When you see this banner, treat the figures on the page as a last-known snapshot rather than the live picture. Refresh once the live read recovers to confirm the current state.

Empty state

If no hosts are reporting, the table shows a single message instead of rows. When the live read is healthy and there are simply no hosts, it adds that the control plane has no enrolled hosts. To populate the fleet, enroll a host. See Onboarding.