Host detail

Host detail is the drill-down view for a single host. Use it when a fleet row looks wrong and you want the full story: what the host’s sessions are doing right now, what evidence it produced, whether a lockdown is in effect, and where its enrollment stands.

Reaching the page

Any host reference in the console leads here:

Fleet: select any row. The Sessions count on a row links straight to this page’s Sessions tab. See Fleet.
Operations: select Open host next to an entry in the anomalies list, or select a host chip on the fleet map.
Lockdowns: select the host on a lockdown row. See Lockdowns.

A Fleet button at the top of the page returns you to the fleet list. The page’s URL carries the host and the open tab (/host-detail?hostId=…&tab=…), so a refresh or a shared link lands on the same view.

The header

The header names the host: its hostname, or the host ID when no name has been reported. Next to the name sit up to three markers: a control-plane posture pill when one is asserted (see Host posture), a state pill carrying the same values as the State column on Fleet, and a φ badge. The φ badge is hidden while the host’s state is unknown, because there is no live figure to show. A meta strip carries the key numbers: host ID, network address, live session count, active lockdown count, and last heartbeat age.

When the host is in lockdown, the entire page takes on an alarm treatment so the state is impossible to miss.

When the host’s capture posture is tampered, an alert strip appears under the header: “session recording tampered”, followed by the reported reason. Treat the host’s session and recording lists as incomplete while this strip shows. See Capture posture.

Tabs

Five tabs cover the host: Overview, Sessions, Evidence, Lockdowns, and Bundle.

Overview

Three cards summarize the host’s live state:

Posture: eight figures at a glance: φ now, posture, state, live sessions, sentinel, capture, lockdowns, and last heartbeat age. φ shows a dash while the host’s state is unknown. Posture is the control plane’s assertion and state is the φ-derived health word; they are separate on purpose. Sentinel reads armed or unarmed. Capture shows the posture labels from Fleet. Under the figures, the card spells out the posture’s reason, who asserted it, and when, rather than leaving it on a hover.
Session counters: the counters for one session: state, φ, heartbeats received, violations, session age, and last heartbeat. With no live session the card says: “No live session. Session counters are only reported while a session is connected.”
Churchill telemetry: what the in-process sentinel reports from inside the application: timing-probe deltas, syscall latency, the hash of the running code, GOT-integrity, memory-layout, and namespace checks, the tracer PID, and effective capabilities. Failing checks render in the critical color.

Sessions

The Live sessions card lists this host’s sessions, one row per protected-process session: the authenticated connection that carries a protected application’s heartbeats. A View recordings button in the card header opens Recordings prefiltered to this host.

The columns are the session’s address, state, φ (two decimals), heartbeats received, violations, age, and last heartbeat. Where the control plane does not export a figure, the cell shows a dash with a hover note saying so, never a guess.

Session states

The state cell draws a strip of pips: five fill left to right as the handshake progresses, then three light only if the session ends. A session moves through five handshake stages in order:

SPA_WAIT: the control plane is waiting for the host’s opening knock, a single authorization packet that precedes any connection.
FW_OPEN: the knock was accepted, and the control plane opened its firewall to the host’s address.
TLS_HANDSHAKE: the mutual TLS handshake is in progress.
ATTESTATION: the last verification step before the session opens.
ESTABLISHED: the session is live and heartbeats flow. A healthy session spends its life here.

Three terminal states end a session:

VIOLATION: the session ended after a protocol violation. The row tints critical.
TIMEOUT: heartbeats stopped arriving and φ crossed the kill threshold, so the control plane wrote the session off. The row tints warning.
HARD_KILL: the control plane sent a kill for the protected process. The row tints critical.

Session detail

Select a row to open the Session detail modal:

Live counters: phi, heartbeats_rx, violations (red when above zero), session_age, and last_hb.
Churchill telemetry: the in-process sentinel’s report, as on the Overview tab.
Host sentinel telemetry: what the host sentinel counts from outside the process: file-access decisions allowed and blocked (blocked tints red above zero), fork, exec, and exit counts, and two flags that read bad when true, lockdown active and cgroup frozen.

There are no write actions on sessions. The view is read-only.

When the list is empty

With nothing running, the tab shows: “No sessions. The control plane is not tracking any sessions for this host.” When the host’s capture posture is a coverage gap, the message adds that the host is not recording interactive logins, so an absent session here is not evidence that none occurred.

Evidence

The last 24 hours of evidence events scoped to this host, newest first. Each row shows the sequence number, time, event type, severity, decision, process, reason, and whether the executable’s hash matched. A counter in the card header shows how many events loaded.

Export (NDJSON): downloads the loaded events as newline-delimited JSON. Disabled while there are no rows.
Open all →: continues on the fleet-wide Evidence page. Selecting any row does the same.

If the window loads its maximum number of events, a notice warns that it was capped and the newest events in the range may not be shown.

Lockdowns

While a lockdown is in effect, an Active lockdown card leads the tab: the worst φ, the lockdown count, and whether the host’s control group is frozen (a frozen pill). The since, mode, and reason fields fill in when the lockdown history has a matching entry, and show a dash otherwise.

Below it, a 30-day history table lists every lockdown with its entered and exited times, duration, reason, and resolution. An ongoing lockdown shows a dash for its exit time and “(ongoing)” on its duration. The Operator column always shows a dash: the control plane does not export operator attribution yet. For the fleet-wide view, see Lockdowns.

Bundle

Two cards:

Bundle attribution: the live code hash reported by this host’s worst-φ session, or a dash when no session is connected. Fuller bundle identity (name, digest, signer, approval receipt) is not exported by the control plane yet, and the card says so.
Protected applications: the registered applications, with name, manifest hash, a governance pill, and a change link that opens the matching change request in Governance. This list is fleet-wide. Per-host application assignment is not exported, and the card header notes it. See Protected apps.

The action rail

A sticky rail on the right stays in view whichever tab you are on:

Recordings: opens Recordings prefiltered to this host.
Evidence: opens the Evidence page.

Below the buttons:

A Lockdown row shows the live status: “active”, with “cgroup frozen” appended when the control group is frozen, or “none active”.
An Enrollment row shows the host’s 32-character client identity, its enrollment status pill, and the containment actions that status allows: Quarantine…, Release…, Unlock…, or Retire…. These are the same actions as on Fleet, with the same typed-confirm dialog, and Unlock… is where you lift a lockdown from this page. When the control plane does not export the identity, the row says so and offers no actions.

When the host is not found

If you open a host the live read does not know about, the page shows: “Host … is not present in the control-plane snapshot.” When the console runs on cached data, it adds that the snapshot is currently degraded and the roster may be incomplete, so the host may still exist. Use the Fleet button to return to the list and check again once the live read recovers.