With several projects, clients, principals, hats, decisions and chains, an operator cannot see what happened, where things move and whether flows are right by composing signed requests by hand; supervision is used locally, like Longhorn's or a Kubernetes dashboard, and remotely through `ssh -L` or `kubectl port-forward`. signatio already has the shape the models it follows have (DD-eca's `Opus`, ontoref-daemon's `dispatch_op_request`): one operation layer, the dispatch in code/crates/signatiod/src/ops.rs, which the CLI reaches through `POST /v1/op`. redb holds its file exclusively, so no other process reads the store while the daemon runs (measured by the operations and CLI session, backlog bl-007). The agent runs with the operator's uid on the operator's host: a surface on localhost that accepted changes without a proof would be the path "keys stay out of the agent's reach, by mechanism" forbids. What is most worth seeing — a custodian that is down — is what an observer inside signatiod cannot show, since signatiod does not start without its custodian; that case is `signatio-boot service status`'s (wo-signatio-service-status-v2), outside the daemon.
EVERY SUPERVISION OR ADMINISTRATION SURFACE IS A CLIENT OF THE OPERATION LAYER. It reaches the authority only through the `signatio` binary and `POST /v1/op`, with the proofs the CLI carries — a live client's token, the person's signature for a human act — and it reads each answer only after the CLI verified it against the pinned authority key. No surface reads the store, and no surface can do what the same user could not do with the CLI. What the operation layer cannot show — the pack's units, a custodian down — a surface reads from the launcher, as ADR-004 decides.
THE SURFACE IS A DESKTOP APP OVER THE CLI. A Tauri app: its webview talks to its own Rust process over Tauri's IPC — no port — and each command it offers runs `signatio … --installed <handover>` as a subprocess and reads its JSON. The CLI is not linked as a library: the app has exactly the CLI's reach, by construction. Remote supervision opens `ssh -L` or `kubectl port-forward` to signatiod's TLS port and runs the same CLI through it.
SIGNATIOD OPENS NO OTHER LISTENER. It serves /v1/challenge, /v1/token and /v1/op on its declared `listen`, and its configuration declares no observation or administration socket. The processes that open the store are signatiod and, with the daemon stopped, `signatio bootstrap`.
A PERSON'S ACT IS PREPARED, SIGNED OUTSIDE, AND SENT. The app prepares the statement of an Assign or a rotation, the person signs it outside the app with minisign or an authenticator, and the app submits the result — the way PrepareRotation works. The administrator's client proves itself with SignedChallenge over a protected key, so the person's presence is shown by the proof, not by the network.
THE APP IS ITS OWN MEMBER. It lives in its own member of signatio's constellation, outside code's workspace and outside the pack: the pack stays binaries, schemas and launcher, and no build of signatio carries Tauri or a webview.
WHAT IT SHOWS IS NOT EVIDENCE. The app renders verified answers; its rendering is not signed and proves nothing. It says so on its own surface: in its About and on its Settings page, not on every page — a capture of another page does not carry the notice, and that is accepted.
signatiod serves /v1/challenge, /v1/token and /v1/op, and no other route
signatiod's configuration declares listen and its custodians' sockets, and no other listener or socket
Outside tests and examples, only signatiod's main and signatio bootstrap open the store
Neither code's workspace nor the pack carries Tauri
An observation listener in signatiod: a Unix socket with peer_cred, observation without a token, optional in signatiod-config.ncl
Rejected: A new surface of the daemon, to declare, check and police, for reads the operation layer answers already; and it cannot show the one case worth seeing most, a custodian down, since signatiod does not start without it.
A local web page served by a client process
Rejected: A browser does not speak Unix sockets, so it listens on TCP; 127.0.0.1 is open to every uid on the host, with the client's token behind it.
A read-only gov section in ontoref-daemon's UI, shown when a project declares signauthz.provider
Rejected: It depends on another project's UI and on gov-integration reaching enforced, and it would put signatio's supervision under ontoref's vocabulary.
A terminal UI, `signatio observe`, in the CLI
Rejected: Workable over plain ssh, but it puts a TUI and its dependencies into the administrator's CLI and the pack; the principal chose the desktop app over the same CLI.
The app links signatio-cli as a library
Rejected: Two surfaces to keep in parity, and a refactor of the CLI into a library, where a subprocess gives the app exactly the CLI's reach.