System & Operator Control

configuration · feature flags · operator tools · access

Simulated datafail-closed · governor gates all actions

Operator Tools

human-in-the-loop · authenticated requests routed to the Governor — never a direct actuator command

Fleet E-STOP

Request governor-commanded MRC controlled-stop + HOLD (all assets)

request → governor

Hold Selected

Request a single-asset pause at the next safe waypoint

request → governor

Teleop Handoff

Request supervised manual control (governor still gates envelope)

request → governor

Lockout Reset

Request human reset of a LockedOut asset — requires supervisor key

request → governor

Display-only in this build. Operator intent enters as an authenticated, signed request to the fail-closed Governor, which adjudicates and commands the MRC under its own authority — the console never touches an actuator. Wired request path tracked in #412.

Active operator sessions

KIRRA-13Lockout reviewJ. Looney · since 11:58
KIRRA-10Supervised teleopA. Reyes · since 12:01

System Configuration

environment & runtime · secrets redacted

Key	Value	Scope
KIRRA_ADMIN_TOKEN	•••••••• set	env
KIRRA_SUPERVISOR_RESET_KEY	•••••••• set	env
KIRRA_VERIFIER_MODE	active	runtime
KIRRA_TRUSTED_INGRESS_MODE	true	env
KIRRA_VERIFIER_ADDR	0.0.0.0:8090	env
CHALLENGE_TTL_MS	30000	runtime
POSTURE_CACHE_TTL_MS	5000	runtime

Feature Flags

runtime capability toggles

Federated trust reconciliation v2
generation-ordered cross-controller reports
on
AV recovery hysteresis
5 healthy reports / 10s window
on
Telemetry watchdog
2s fault threshold
on
iceoryx2 transport spike
host-side spike — not in cert scope
off
TPM measured-boot quote
PCR16 follow-up (tracked)
off

Access Control

operators & service accounts

Member	Role	Access	Status
J. Looney	Fleet Supervisor	admin · reset key	active
A. Reyes	Operator	teleop · hold	active
M. Chen	Safety Engineer	read · compliance	idle
svc-orchestrator	Service account	mutation · token	active