Settings
Rotate tokenUnavailableUpdate profileUnavailable
- Account
- James / Mode Sevenowner
- Operator identity
- ownerClerk:james@modeseven.test (owner)
- Display
- compact density, default contrastdashboard profile
- Tokens
- 4 classeshost, AI client, app session, builder session
- Audit rows
- 6dashboard-visible events
- Boundary blocks
- 2 deniedtrust-zone denials
- Proof receipts
- 24 proof artifacts
Account
| Field | Value |
|---|
| Account ID | acct_1 |
| Label | James / Mode Seven |
| Operator identity | Clerk:james@modeseven.test (owner) |
| Email | james@modeseven.test |
| Role | owner |
Control plane
| Area | Value | Status | Action |
|---|
| Clerk identity | james@modeseven.test | ready | manage external user |
| SurfaceKit authorization | accounts, memberships, grants, hosts, clients | ready | review access table |
| Display profile | compact density, default contrast | ready | adjust density and contrast |
| Host tokens | host credentials scoped per machine | review | rotate revoked hosts |
| AI client tokens | MCP client credentials scoped by grants | review | revoke stale clients |
| App-session tokens | runtime credentials expire per host session | review | inspect active sessions |
| Trust-zone policy | user, host, AI client, app runtime, builder, runner | ready | audit denied crossings |
| Builder policy | account-default model, no shell network by default | skeleton | set workspace limits |
Token classes
| Class | Holder | Scope | Status | Trust zone | Raw material |
|---|
| host token | host_1 | paired desktop heartbeat and host commands | active | host / rotate on host revoke | never rendered |
| ai-client token | client_codex | MCP tool calls gated by grants | active | ai-client / rotate on client revoke | never rendered |
| app-session token | install_work_surface / host_1 | runtime data, events, and artifact writes | expires | app-runtime / per session | redacted |
| builder-session token | builder_1 | plan approval and build job queue | expires | builder / per builder session | never rendered |
Trust-zone denials
| Zone | Action | Target | Reason | Audit event | Time |
|---|
| builder | builder:model:use | custom provider | provider not configured | audit_4 | 2026-06-21T18:55:00.000Z |
| ai-client | surfacekit.app.start | install_work_surface | missing app:install:start grant in expected failure proof | audit_6 | 2026-06-21T19:01:00.000Z |
Audit and proof receipts
| Surface | State | Evidence | Receipt |
|---|
| Audit trail | 6 rows | host.pairing.approved by user:user_james | local://dashboard/actions/audit-export |
| Boundary blocks | 2 denied | builder:model:use: provider not configured | local://dashboard/actions/trust-zone-denials-exported |
| Proof receipts | 2 receipts | .surfacekit/demo-runs/latest/host-render-receipt.json | sha256:host-render |