Health and recon

Freshness

The console header shows when the data was last read from GitLab. A green mark means the last refresh is recent; amber means it is older than fifteen minutes; a spinning mark means a refresh is running now.

Refresh

Attest refreshes on its own schedule and on pipeline events. An administrator can trigger a refresh from Control. A refresh re reads every security repository, rebuilds the fleet, and recomputes every verdict. Because GitLab is the system of record and every Attest cache is disposable, a refresh is always safe.

The health endpoint

/api/health is open without a session. It reports liveness, the last refresh time, the build running, and the security repositories discovered. Deployments use it as their readiness check.

Recon

Recon, administrators only, is what the server actually saw: errors, warnings, GitLab responses, authentication and ingest events, with counts for the last hour and the buffer. Filter by level or by source, open a row for its detail, and switch to live to watch it update. When nothing has gone wrong since the container started, it says so.

Claims

Control lists every active claim: which reviewer has which container and since when. A claim that is stuck, because a reviewer left mid review, can be released by an administrator. The release is recorded with a visible note; it does not decide anything on the reviewer's behalf.

Sessions

Sessions are held server side and expire on a fixed schedule. A redeploy ends every session; people sign in again and are returned to the page they were on.

Deployment

Attest is a single container image serving the console and the API from one origin. Paths under /api/, /auth/, /cera/, and /login are the service; hashed /assets/ are cached indefinitely; every other path serves the console and the router takes it from there. The same rule is written for nginx for deployments where the console ships in its own image and the API base is set at runtime.