// mission control · observe · propose · confirm
Every app in the hive. one queen.
Deployments, CI, DNS, databases and uptime for the whole monorepo — watched from one dashboard, and changed only with explicit confirmation.
- 45 confirm-gated action kinds
- proposed → confirmed → executed → audited
- propose vercel_redeploy
- propose cloudflare_dns_set
- propose db_write
- propose app_maintenance_set
- append-only audit log
- a read-only role, enforced by Postgres
- HEAD ping every hour
- signups off · one owner · one gate
- 45
- confirm-gated action kinds
- env, deploys, DNS, SQL writes, bans — nothing runs unconfirmed
- 73
- tools the operator can call
- 46 of them only ever propose
- 6
- sessionless callers
- webhook, uptime cron, digest, VM check-in, approved VM software bundle, Keeper tickets — each reaching one narrow function
- 60
- minutes between pings
- every production URL, on a cron, into a durable incident ledger
// watch
A minute with Queen.
The fleet overview of CI, crons, databases and deploys, an outage and its incident page, the chat answering a CI question and proposing a change, the maintenance switches, users and AI usage.
Queen in a minute · 1:00
// how it works
Observation is free. mutation is gated.
01
Observe
Deployments, CI runs, cron health, DNS records and live uptime, pulled straight from the providers on every look.
02
Propose
Ask the chat or click a button — every mutation becomes a pending action with a human-readable preview of what would change.
03
Confirm
Nothing executes until it is explicitly confirmed, and every outcome lands in an append-only audit log.
// features
Built for a fleet of one owner.
Fleet monitoring
Uptime history, latency and deploy state for every app, on one board instead of five provider dashboards.
Confirm-before-apply
Env changes, redeploys, DNS edits and SQL writes all pass through one gate — proposed first, executed only on confirmation.
An operator you can talk to
The chat reads the fleet, diagnoses failures, and proposes fixes it can never run on its own.
Read-only by default
Cross-app database access goes through a dedicated Postgres role that cannot write — enforced by the database, not by app code.
Failure alerts
CI and deploy failures ring the bell and send mail, with an AI summary of why it broke before you open a single log.
Single-user by design
Signups are off. One owner, one gate on every surface, and everyone else gets a polite refusal.