The console

The console is where you work with Penv Cloud, the hosted provider for penv: your projects and values, machine identities, the audit record, and workspace settings.

Sidebar

Machine Identities, Integrations and Settings are groups with no page of their own. Slugs: roles and permissions.

We highlight the longest matching path: /identities/connect highlights Connect a Platform, not All Identities.

Your account menu at the bottom of the rail opens a project picker: search, your readable projects, the current project's environments, New Project, View All Projects. Only Free shows a Projects meter there, prompting an upgrade at four fifths of the limit.

Overview

Path: /dashboard, the first page you see after sign-in. Each part reads only what your permissions allow; a figure your role does not cover reads Not in your role, and one we could not read shows a dash, not a zero.

First visit

Until your workspace holds a value, you see Welcome to Penv Cloud, five steps and your plan. The next step is raised into a card with the one button that does it:

A step your role cannot do says so instead of showing a button. The last step is done once a machine reads with its credential. Your plan lists the plan, projects and members against its limits, and machine identities, which are free on every plan.

Established workspace

• The header counts the things to review, each marked amber below it.
• New Identity and New Project sit at its right, when your role can create them.
• Until a machine has read, a row names the next setup step.
• For Connect penv that row starts collapsed; Show how opens the schema header and the penv run command.

Activity leaves out sign-ins and sign-outs, organization switches, step-up checks, machine credential exchanges, and reads and exports of the audit log; the audit log has them. A credential, trust or keypair a person adds does appear.

Showing Activity is itself a read of the log, which we record as audit.read with via: overview.

The footer states the encryption every plan gets: each value sealed with AES-256-GCM and bound to its full address. It then names who holds the wrapping key, in the words the Encryption page uses:

Missing permissions

Terminal sign-in approval

Path: /device. penv login prints an eight-character code, valid for ten minutes, and opens this page. Type the code your terminal shows; we never fill it in from a link, so comparing the two is how you know the terminal is yours. Once you enter it, you see the name the terminal gave itself (anyone starting a sign-in can choose it, so we reduce it to plain words and say so), the request's source address, and when it asked. You choose which workspace the credential may reach: the one you are signed in to by default, any other you belong to, or all of them. The credential we mint lasts 30 days from its last use, and at most 90 days. A workspace that requires single sign-on or two-factor accepts it only if you approved it from a session that met that requirement.

Approving requires step-up when your account has an authenticator (security and MFA); denying never does, so you shut down an unrecognized code in one click.

We write each entry in the workspace you chose, or once per workspace you belong to when you chose all of them.

You answer agent reveal requests at /approvals/[id]: approve a reveal.

Next: projects and environments.