Overnight Operator
Live host-health from the overnight sentinel, plus a read-only view of the operator framework: runs, risk mode, artifacts, proof, approvals, collector output, and morning packets. This page is read-first — it triggers no host actions, sends no messages, and exposes no local paths or secrets.
sentinel snapshot
auto-eligible only
gated affordances
on tab load
Current status
Checking
Checking overnight host health… no observation has loaded yet. No green status is shown until a real snapshot returns.
Source: nyx-overnight-sentinel via the Mission Control API. The
poll reads a cached snapshot every 90s; only the explicit Recheck button forces
a real re-run. Green is shown only with an observation timestamp.
Overnight runs
No run state has loaded yet. No green status is shown until a real run returns.
Open-thread collector (newest)
No open-thread collector output recorded yet. The collector is read-only and does not auto-run from this page.
Source: the Overnight Operator controller's durable run state via the Mission Control API. Every run summary, morning packet, proof file, open-thread list, and approval is sanitized server-side — no local filesystem path or secret is exposed here. "View packet" loads a run on demand; "Mark reviewed" records an acknowledgement in an MC-owned store and never mutates operator state.
Risk mode
Reversible, in-scope, no external side effects. Auto-eligible to execute after the review gate returns ACCEPT.
External or harder-to-reverse. Never auto-executed — emits an approval packet for the operator instead.
Deploy, push, send, spend, trade, or schema change. Forbidden unattended; requires explicit human approval.
Risk class follows the operator risk-class policy. The lane never elevates its own risk mode; anything beyond Green becomes an approval packet rather than an automatic action.
Artifacts
Artifacts are stored on the operator host. They are never linked by local path
from the browser — the live runs panel above serves sanitized copies of the
morning packet, proof, and open threads via GET /api/overnight/runs/:id.
Proof, approvals & open threads
proof.md is loaded on demand under "View packet" — evidence, not assertions.
These were honest empty states before the feed existed; they now read from the
live /api/overnight/* endpoints in the runs panel above. Nothing is
fabricated — a run with no proof or approvals says so.
Morning packets
Each run renders a fixed-shape morning packet (mission, DoD, proof, blockers,
approvals, memory-checked). Use "View packet" on any run in the runs panel
above to load it from GET /api/overnight/runs/:id — sanitized,
with no local paths or secrets.
Controls
Open the rendered morning packet, proof, and open threads for a run.
GET /api/overnight/runs/:id (live, in the runs list above) Record that the operator has read a morning packet (MC-owned store).
POST /api/overnight/mark-reviewed (CSRF, live in the runs list) Set a queued or running lane to cancelled with a reason.
host process — run the controller directly; not web-triggerable Re-run the read-only open-thread collector for a date.
host process — run the collector directly; not web-triggerable Deliberately the only controls: view and mark-reviewed are live (read + CSRF-gated MC-owned acknowledgement). Cancel run and Re-run collector spawn host processes and are intentionally left disabled — not web-triggerable, so no new attack surface. There is no deploy, send, spend, or run-everything action, and nothing fires on load.