Operator Consoles 1 / 6

Identity & Gate State

● tenant-swarm-read OIDC Active

▲ tenant-swarm-approve 1 Queued

■ kv-tenantswarm-ops Broker Ready

Workbench 1 · Wide Assessment, Target-State & Empirical Memory

Atlas Workbench — Estate Discovery & Blueprint Queue

WideAssessment.psm1 · F22 · F35

Bottom line: W1–W4 wide assessment normalizer and C14 target-state synthesis engine are verified offline. Connect live C11/C21/C24 snapshots to synthesize your next deployment wave.

PS > Invoke-WideAssessment.ps1 -Sources @('Azure','AWS','GCP','OnPrem')

✓ Normalized 4 estate sources into canonical C11 schema (0 raw IDs exposed).

✓ Decision-quality gate: 22/22 standards pillars aligned; empirical calibration F21 ready.

+ more: Next action to wire live sandbox telemetry

Run the T0 OIDC read identity setup (setup-spend-sandbox.sh, setup-spend-aws.sh, setup-spend-gcp.sh) to stream live multi-cloud discovery snapshots into Atlas.

Workbench 2 · Target-State Execution

Forge Workbench — Multicloud & Edge Baselines

Bicep · Terraform · Graph-as-Code

Bottom line: Ready to stamp out validated C14 manifests across Azure (Bicep), AWS/GCP (Terraform), Entra/Intune (Cleanbench F32), Cloudflare zones, and GitHub rulesets.

PS > New-SwarmChangePlan -Specialist Cloudflare -Action upsert-dns-record -Target "goparallax.dev"

✓ Enforced Day-0 anti-spoofing baseline (SPF -all, DMARC p=reject, null MX, Strict TLS) for goparallax.dev and goparallax.app.

+ more: Pre-deployment cost & hash lock

All Forge deployments require a pre-run estimate check against the $150/mo sandbox cap and an approved SHA-256 plan hash before minting a write token.

Workbench 3 · Multi-Agent Control Plane (F20)

Swarm Workbench — 14 Wave-1 Specialists

TenantOps.psm1 · TenantReport.psm1

Bottom line: Coordinator + 13 domain specialists (`Cost`, `Subscriptions`, `Identity`, `M365`, `AVD`, `AWS`, `GCP`, `Cloudflare`, `GitHub`, `Intune`, `PowerPlatform`, `ServiceNow`, `AiProviders`) are online with strict scope guards.

prlx swarm > "Run weekly multi-service posture sweep"

✓ Cost & Subscriptions: 0 stray compute meters across Azure, AWS, GCP.

✓ GitHub & Cloudflare: Default branch rulesets, secret scanning, and zone TLS verified.

▲ Intune: 3 stale session host records (avdlz-sh-01..03) inactive > 14d → Plan PLN-2026-1111-01 queued.

+ more: Inspect Specialist Tool Allowlist

Test-SpecialistScope in scripts/ops/TenantOps.psm1 blocks any specialist from invoking tools outside its domain or mutating state directly without emitting a hashed propose_change plan.

Workbench 4 · Dependency Closure & FinOps (F29 · F31 · F36)

Graph & Ledger Workbench — Blast Radius & Spend

EstateGraph.psm1 · EstatePortfolio.psm1

Bottom line: Transitive blast-radius closure, Tier-0 identity reachability, root-cause ranking, and cross-estate WAF percentile benchmarking are verified and ready.

PS > Invoke-EstateGraph.ps1 -Command BlastRadius -TargetId "intune://devices/avdlz-sh-01"

✓ Closure: 3 leaf nodes, 0 active user sessions, 0 production host pools impacted.

✓ Portfolio WAF score: p75 maturity across Reliability, Security, and Cost Optimization.

+ more: FinOps placement & stray-resource guard

Daily OIDC budget checks compare actual cloud + AI provider billing against estimates and automatically generate teardown plans for idle compute or unattached disks.

Workbench 5 · Active Deception & Prompt Defense (F28 · F27)

Ward Workbench — Canary Tripwires & PI Shield

■ Tripwires Armed · 0 Alerts

Bottom line: Native Entra decoy app credentials, honeytoken break-glass accounts, KQL alert rules, and the untrusted control-plane prompt-injection scanner (Test-UntrustedControlPlaneText) are active.

PS > New-EntraDeceptionPlan.ps1 -Environment Sandbox

✓ Decoy SP credential + honeytoken user armed with KQL high-severity sign-in alert and 1-step removal plan.

✓ Prompt-injection scanner: 0 PI-* anomalies across Entra, GitHub, Cloudflare, and ServiceNow inputs.

+ more: Emergency quarantine & Bunker handoff

Any tripwire hit halts pending Angle B approvals and triggers Pillar 6 (Parallax Bunker) to seal the current Last-Known-Good WORM archive snapshot.

Workbench 6 · WORM Archive, Cross-Cloud DR & COG (F30 · F33 · F37)

Bunker Workbench — Reconstitution & Drill Scorecard

Archive.psm1 · DrOrchestrator · CogOrchestrator

Bottom line: Chunked WORM archive with independent verifier, cross-tenant DR object-ID remapper, and 4-stage Continuity of Government reconstitution orchestrator are built and verified.

PS > Invoke-CogDrill.ps1 -Stage All -DryRun

✓ Stage 0 (Seal & LKG) → Stage 1 (Lifeboat DNS & Identity) → Stage 2 (Git Bundle & Cleanbench) → Stage 3 (Workloads) passed.

✓ Drill RPO/RTO scorecard logged back to Pillar 1 (Atlas) empirical memory.

+ more: 2-of-N Quorum & Line of Succession Guard

Canary liveness checks and a mandatory veto window prevent unauthorized reconstitution while the primary operator is active.