Console overview

The Churchill operator console is the web dashboard you use to run your fleet. From here you enroll hosts, register applications for protection, watch live activity, review evidence, manage lockdowns, replay session recordings, run governance, and manage your own account.

This page is a map of the console. Each area has its own page with the details. If you are not signed in yet, start with Signing in. After sign-in, the console lands on Operations.

Top bar

The bar across the top of every screen carries the controls you use most often, from left to right:

• Churchill brand: marks the console.
• Breadcrumb: shows where you are, written as the current group followed by the current page (for example, Operations › Fleet). It updates as you move.
• Search box: opens the command palette, described below. Select it, or press Ctrl+K.
• UTC clock: the current time in UTC. The console shows all times in UTC.
• Operator menu: a chip with your initials and name. Open it to see your operator identity and tenant, switch between dark and light themes, or Sign out.

The console starts in the dark theme unless your system prefers light. Once you pick a theme from the operator menu, that choice persists for the browser.

Sidebar

The sidebar is your primary navigation. It has three groups.

Operations

Day-to-day monitoring and response.

• Operations: the live overview and the default landing page. See Operations.
• Fleet: every enrolled host, its current state, and its enrollment record. See Fleet. Selecting a host opens its host detail page, which includes the host’s live sessions.
• Evidence: the hash-chained event log. See Evidence.
• Lockdowns: which hosts are contained, and why. See Lockdowns.
• Recordings: sealed TTY session captures with in-browser replay. See Recordings.

Governance

Policy, approvals, and the record of what happened.

• Protected apps: the registry of applications enrolled for protection. See Protected apps.
• Provisioning codes: the register of one-time enrollment codes. See Provisioning codes.
• CAB: your Change Advisory Board workspace. See CAB overview.
• Audit: the tamper-evident record of console activity. See Audit log.

Note

Until your tenant’s CAB baseline is sealed, Protected apps, application registration, and application detail stay closed. The console refuses them from the sidebar, from the command palette, and from direct URLs. Complete the CAB ceremony first. See CAB onboarding.

System

Your account and console preferences.

• Profile: your operator profile. See Profile.
• Settings: console settings. See Settings.

At the foot of the sidebar, Collapse shrinks it to an icons-only rail, and Expand restores it. The console remembers that choice per browser. The console version is shown beneath it.

Command palette

Press Ctrl+K (Cmd+K on macOS) from anywhere, or select the search box in the top bar. Type to filter, move with the arrow keys, and press Enter to run the highlighted entry. Press Escape, or select outside the palette, to close it.

The palette holds one entry per sidebar page plus Sign out. That is the full command set. The search box’s placeholder mentions hosts, sessions, and hashes, but the palette does not search your data. It matches page names and command names only. To find a specific host, go to Fleet.

Deep links

Every console page keeps its state in the URL. The address bar always reflects the page you are on, plus the context you drilled into. A refresh returns you to the same place, browser back and forward work, and you can share a URL with another operator.

The routes and their parameters:

URL	Opens
/operations, /fleet, /evidence, /lockdowns, /recordings, /protected, /provisioning-codes, /governance, /audit, /profile, /settings	The matching sidebar page.
/host-detail?hostId=…&tab=…	One host’s detail page, on the named tab (for example tab=sessions).
/app-detail?appId=…	One protected application’s detail page.
/evidence?hostId=…&evidenceSeq=…	Evidence scoped to a host, with one event’s detail open.
/recordings?hostId=…&sessionId=…	Recordings filtered to a host, with one cast loaded in the player.
/governance?changeId=…	The CAB page with one change request’s detail open.
/audit?auditQuery=…	The audit log with the search box seeded.
/register-app?registrationId=…	The registration wizard, resuming an existing registration.

Banners

When the console’s view of the fleet degrades, a banner appears above the page content. There are two, and they are independent:

Cached data

Showing cached data — live control-plane read unavailable, sometimes followed by a short reason in parentheses. The console could not complete a live read from the control plane, so it serves the last good snapshot instead of going blank. Single blips do not flap the banner. While it is up, treat the figures on every page as a last-known snapshot, not the live picture.

Reconnecting

Live updates interrupted — reconnecting… The console’s own live connection dropped. It retries on its own, so a brief drop heals without a reload. If the outage lasts longer than about a minute, the retries stop and the banner stays up. Reload the console once the connection is back.

Status bar

A thin status bar runs along the bottom of every screen. On its right edge it shows:

• Chain head: ● chain ok followed by the head position of your operator audit chain, captured when you signed in. This tells you where the tamper-evident record stood at that point. It is not itself a verification. Full chain verification lives on the Audit log page.
• UTC clock: the current UTC timestamp, matching the clock in the top bar.